Edit tour

Windows Analysis Report
user.exe

Overview

General Information

Sample name:	user.exe
Analysis ID:	1584838
MD5:	5cc8a6ec6d6fc9d98ef59c905274e4c3
SHA1:	bbd7891793055343f045807124138701beb2937c
SHA256:	c330b29ffa94084d183e23e4ed0bbbd864e51523ab9df30a09b78078fc5cfc00
Tags:	exeuser-aachum
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found pyInstaller with non standard icon

Uses the Telegram API (likely for C&C communication)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

user.exe (PID: 7564 cmdline: "C:\Users\user\Desktop\user.exe" MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

user.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\user.exe" MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

cmd.exe (PID: 7752 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

user.exe (PID: 7760 cmdline: C:\Users\user\Desktop\user.exe MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

user.exe (PID: 7840 cmdline: C:\Users\user\Desktop\user.exe MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

user.exe (PID: 7976 cmdline: "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

user.exe (PID: 2596 cmdline: "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe MD5: 5CC8A6EC6D6FC9D98EF59C905274E4C3)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: user.exe

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B65DC0 CRYPTO_memcmp,	7_2_00007FF8E5B65DC0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B611E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyObject_GetBuffer,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	7_2_00007FF8E5B611E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0CD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D0CD30
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0A6D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	7_2_00007FF8E5D0A6D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D326B0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	7_2_00007FF8E5D326B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	7_2_00007FF8E5CF1212
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D34660 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	7_2_00007FF8E5D34660
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	7_2_00007FF8E5CF162C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D56650 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	7_2_00007FF8E5D56650
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	7_2_00007FF8E5CF13D9
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF24CD CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	7_2_00007FF8E5CF24CD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D48620 CRYPTO_memcmp,	7_2_00007FF8E5D48620
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D105E0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	7_2_00007FF8E5D105E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF1488
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF85A0 CRYPTO_zalloc,CRYPTO_free,	7_2_00007FF8E5CF85A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D66550 CRYPTO_memcmp,	7_2_00007FF8E5D66550
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D04530 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	7_2_00007FF8E5D04530
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D5C8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D5C8E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D6A8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	7_2_00007FF8E5D6A8F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF26B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	7_2_00007FF8E5CF26B2
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E8C0 CRYPTO_free,	7_2_00007FF8E5D3E8C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D54860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	7_2_00007FF8E5D54860
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D68870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D68870
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2423 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF2423
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1F3C CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1F3C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1CA3 CRYPTO_strdup,CRYPTO_free,	7_2_00007FF8E5CF1CA3
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF25F4 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	7_2_00007FF8E5CF25F4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1F28 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	7_2_00007FF8E5CF1F28
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF1401
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E781 CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D3E781
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF16A4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	7_2_00007FF8E5CF120D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF103C CRYPTO_malloc,COMP_expand_block,	7_2_00007FF8E5CF103C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E700 CRYPTO_free,	7_2_00007FF8E5D3E700
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF1389
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E200 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5D3E200
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E190 CRYPTO_free,	7_2_00007FF8E5D3E190
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF15E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF15E6
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1F55 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF1F55
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	7_2_00007FF8E5CF19DD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF4100 CRYPTO_free,	7_2_00007FF8E5CF4100
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF1ACD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF18B6
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF26E4 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	7_2_00007FF8E5CF26E4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D24490 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5D24490
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF1AC3
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF198D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0E427 CRYPTO_THREAD_write_lock,	7_2_00007FF8E5D0E427
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF23DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF23DD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D12410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	7_2_00007FF8E5D12410
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D543C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	7_2_00007FF8E5D543C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D5A3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5D5A3D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	7_2_00007FF8E5CF1D93
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D48390 CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D48390
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1B31
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D02360 CRYPTO_THREAD_run_once,	7_2_00007FF8E5D02360
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF4300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF4300
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D50330 CRYPTO_free,CRYPTO_strndup,	7_2_00007FF8E5D50330
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D62EE0 CRYPTO_memcmp,	7_2_00007FF8E5D62EE0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF17E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF17E9
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFCEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	7_2_00007FF8E5CFCEA0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF117C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D38E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5D38E90
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF236A
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	7_2_00007FF8E5D0EDC1
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	7_2_00007FF8E5CF1B54
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	7_2_00007FF8E5CF1811
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	7_2_00007FF8E5D0EDC1
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1771 CRYPTO_free,	7_2_00007FF8E5CF1771
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	7_2_00007FF8E5CF222F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D38D40 OPENSSL_cleanse,CRYPTO_free,	7_2_00007FF8E5D38D40
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1CBC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF136B
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D250D8 EVP_MAC_CTX_free,CRYPTO_free,	7_2_00007FF8E5D250D8
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2374
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D330A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	7_2_00007FF8E5D330A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF14CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF14CE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF21DF CRYPTO_memcmp,	7_2_00007FF8E5CF21DF
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D19084 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	7_2_00007FF8E5D19084
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D1F070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy,	7_2_00007FF8E5D1F070
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D55070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5D55070
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D6B070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5D6B070
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2117
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF4FD0 CRYPTO_free,	7_2_00007FF8E5CF4FD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF20E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF20E5
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2144
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	7_2_00007FF8E5CF1A05
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF114F CRYPTO_free,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF114F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF1492
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D32A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	7_2_00007FF8E5D32A50
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF24EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF24EB
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D489F0 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5D489F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF17DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF17DF
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF204F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D04990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D04990
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1893
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2185
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1EE2
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3E920 CRYPTO_free,	7_2_00007FF8E5D3E920
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D04930 CRYPTO_get_ex_new_index,	7_2_00007FF8E5D04930
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF139D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D48CA0 CRYPTO_free,CRYPTO_strndup,	7_2_00007FF8E5D48CA0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	7_2_00007FF8E5CF257C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D38C80 CRYPTO_free,	7_2_00007FF8E5D38C80
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF22D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF22D9
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3EC70 CRYPTO_free,	7_2_00007FF8E5D3EC70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D54C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	7_2_00007FF8E5D54C40
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF4C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF4C00
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3EC10 CRYPTO_free,	7_2_00007FF8E5D3EC10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1AB4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1A0F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0EB48 CRYPTO_free,	7_2_00007FF8E5D0EB48
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF4B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF4B30
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	7_2_00007FF8E5CF1460
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D06B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	7_2_00007FF8E5D06B20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D1EB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	7_2_00007FF8E5D1EB10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D356D0 CRYPTO_free,	7_2_00007FF8E5D356D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF12CB CRYPTO_THREAD_run_once,	7_2_00007FF8E5CF12CB
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFF650 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	7_2_00007FF8E5CFF650
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D5B660 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	7_2_00007FF8E5D5B660
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D63650 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	7_2_00007FF8E5D63650
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	7_2_00007FF8E5CF110E
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D01620 CRYPTO_free,CRYPTO_strndup,	7_2_00007FF8E5D01620
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF1181
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2379 CRYPTO_free,	7_2_00007FF8E5CF2379
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF21E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF21E9
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2469
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF20F4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF20F4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF193D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D47570 CRYPTO_realloc,	7_2_00007FF8E5D47570
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D1D510 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	7_2_00007FF8E5D1D510
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	7_2_00007FF8E5CF1654
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D238C0 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D238C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF13DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF13DE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	7_2_00007FF8E5CF589C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D07840 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	7_2_00007FF8E5D07840
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D09870 CRYPTO_free,CRYPTO_strdup,	7_2_00007FF8E5D09870
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D657FE CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5D657FE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	7_2_00007FF8E5CF1087
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D477A0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D477A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D517A1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	7_2_00007FF8E5D517A1
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF11BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF11BD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D41750 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5D41750
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5CF1023
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D292E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5D292E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1A32
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	7_2_00007FF8E5CF195B
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1F8C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D63260 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5D63260
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	7_2_00007FF8E5CF1262
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	7_2_00007FF8E5CF1B90
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D57230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	7_2_00007FF8E5D57230
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFD227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CFD227
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	7_2_00007FF8E5CF1A23
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D1D170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	7_2_00007FF8E5D1D170
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D51170 ERR_new,ERR_set_debug,CRYPTO_clear_free,	7_2_00007FF8E5D51170
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFF160 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5CFF160
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF11A9 EVP_MAC_CTX_free,CRYPTO_free,	7_2_00007FF8E5CF11A9
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D39120 CRYPTO_malloc,ERR_new,ERR_set_debug,	7_2_00007FF8E5D39120
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D414E0 CRYPTO_memcmp,	7_2_00007FF8E5D414E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1992
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	7_2_00007FF8E5CF1393
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D63480 CRYPTO_free,CRYPTO_strndup,	7_2_00007FF8E5D63480
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5CF1EDD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2126
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	7_2_00007FF8E5CF1444
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	7_2_00007FF8E5CF1997
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D6B430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	7_2_00007FF8E5D6B430
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFD3CA CRYPTO_free,	7_2_00007FF8E5CFD3CA
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	7_2_00007FF8E5CF111D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFB300 CRYPTO_clear_free,	7_2_00007FF8E5CFB300
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF1677
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF17F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF17F8
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2680 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	7_2_00007FF8E5CF2680
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF5EE0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	7_2_00007FF8E5CF5EE0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF107D CRYPTO_free,	7_2_00007FF8E5CF107D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF3EB0 CRYPTO_free,	7_2_00007FF8E5CF3EB0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF25DB CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF25DB
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	7_2_00007FF8E5CF150F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2720 CRYPTO_free,CRYPTO_strdup,	7_2_00007FF8E5CF2720
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D5BE20 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D5BE20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2310 ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	7_2_00007FF8E5CF2310
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D15E10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5D15E10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF108C ERR_new,ERR_set_debug,CRYPTO_free,	7_2_00007FF8E5CF108C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1D89 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5CF1D89
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D15D20 CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D15D20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D53D20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	7_2_00007FF8E5D53D20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	7_2_00007FF8E5CF1CEE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	7_2_00007FF8E5CF1361
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D480C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	7_2_00007FF8E5D480C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D120A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	7_2_00007FF8E5D120A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D500A0 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5D500A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D0C080 CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5D0C080
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFE0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	7_2_00007FF8E5CFE0AD
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF2527
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF23EC CRYPTO_free,CRYPTO_memdup,	7_2_00007FF8E5CF23EC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D16030 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	7_2_00007FF8E5D16030
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF202C CRYPTO_free,	7_2_00007FF8E5CF202C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1019 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CF1019
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CFDFB5 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	7_2_00007FF8E5CFDFB5
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	7_2_00007FF8E5CF1B18

Source: user.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2626855364.00007FF8E6BB7000.00000002.00000001.01000000.00000018.sdmp, user.exe, 00000005.00000003.1467693768.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1601648258.00007FF8E5B07000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: user.exe, 00000002.00000002.2629554504.00007FF8E742A000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E620A000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.1382993293.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1468200856.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.2628358963.00007FF8E6F95000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000007.00000002.1614754021.00007FF8E5D75000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.2626615099.00007FF8E6AF1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637906283.00007FF8F8CA4000.00000002.00000001.01000000.00000011.sdmp, user.exe, 00000005.00000003.1452996149.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.1383240668.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1468502118.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.1362577469.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637209525.00007FF8F8354000.00000002.00000001.01000000.00000005.sdmp, user.exe, 00000005.00000003.1447477413.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1620143500.00007FF8F0954000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.2629554504.00007FF8E7392000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E6172000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.1362577469.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637209525.00007FF8F8354000.00000002.00000001.01000000.00000005.sdmp, user.exe, 00000005.00000003.1447477413.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1620143500.00007FF8F0954000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.2625975165.00007FF8E6A03000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.2629554504.00007FF8E742A000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E620A000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.2625975165.00007FF8E6A03000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.1362747723.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637506375.00007FF8F8B85000.00000002.00000001.01000000.00000012.sdmp, user.exe, 00000005.00000003.1447786494.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1614093263.00007FF8E5C05000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2638100481.00007FF8F8FF3000.00000002.00000001.01000000.0000000C.sdmp, user.exe, 00000005.00000003.1467463412.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.2626615099.00007FF8E6AF1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.2635380374.00007FF8F7043000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2636947025.00007FF8F8306000.00000002.00000001.01000000.00000014.sdmp, user.exe, 00000005.00000003.1449287226.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1612639997.00007FF8E5B66000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634036136.00007FF8E7E1B000.00000002.00000001.01000000.0000000A.sdmp, user.exe, 00000005.00000003.1449590565.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634902972.00007FF8F6DA3000.00000002.00000001.01000000.00000015.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634036136.00007FF8E7E1B000.00000002.00000001.01000000.0000000A.sdmp, user.exe, 00000005.00000003.1449590565.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2636675020.00007FF8F7A9D000.00000002.00000001.01000000.00000009.sdmp, user.exe, 00000005.00000003.1448428595.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1619967318.00007FF8E7C5D000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637906283.00007FF8F8CA4000.00000002.00000001.01000000.00000011.sdmp, user.exe, 00000005.00000003.1452996149.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2635936237.00007FF8F7A29000.00000002.00000001.01000000.0000000B.sdmp, user.exe, 00000005.00000003.1449899794.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1619808462.00007FF8E6E69000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620851258.000001B2958F0000.00000002.00000001.01000000.00000006.sdmp, user.exe, 00000005.00000003.1464787734.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.2631025301.00007FF8E78F8000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.1362747723.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637506375.00007FF8F8B85000.00000002.00000001.01000000.00000012.sdmp, user.exe, 00000005.00000003.1447786494.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1614093263.00007FF8E5C05000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.2628358963.00007FF8E6F95000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000007.00000002.1614754021.00007FF8E5D75000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.2633466176.00007FF8E7C7E000.00000002.00000001.01000000.0000000D.sdmp, user.exe, 00000007.00000002.1617610822.00007FF8E62DE000.00000002.00000001.01000000.00000026.sdmp

Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F09280 FindFirstFileExW,FindClose,	0_2_00007FF653F09280
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF653F083C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F09280 FindFirstFileExW,FindClose,	2_2_00007FF653F09280
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF653F083C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	2_2_00007FF8E69F3540
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5943540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	7_2_00007FF8E5943540

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

2_2_00007FF8E69F53D0

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.9:56077 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: user.exe, 00000002.00000002.2623756571.000001B2966C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: user.exe, 00000002.00000002.2627578878.00007FF8E6C46000.00000002.00000001.01000000.00000010.sdmp, user.exe, 00000007.00000002.1614451503.00007FF8E5C76000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: http://.css
Source: user.exe, 00000002.00000002.2627578878.00007FF8E6C46000.00000002.00000001.01000000.00000010.sdmp, user.exe, 00000007.00000002.1614451503.00007FF8E5C76000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: http://.jpg
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1467693768.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535125970.0000022959B14000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1576691804.000002295759C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1586342647.00000229598FA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1530468425.00000229598F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1559156843.000002295759B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1522247460.0000022959947000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525652249.0000022959947000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556416046.0000022959987000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553300194.0000022959973000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl3
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535125970.0000022959B14000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlp
Source: user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554544679.0000022959815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlE
Source: user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1586342647.00000229598FA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1530468425.00000229598F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: user.exe, 00000005.00000003.1464454740.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: user.exe, 00000002.00000003.1392791148.000001B296102000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2623641827.000001B2965C0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481704199.000002295994C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481495642.0000022959A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1561217432.00000229594F0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959495000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.000002295948D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527277139.00000229594ED000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545714532.00000229594EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532495083.0000022959516000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524506481.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532495083.0000022959516000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1574461610.0000022959516000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524506481.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: user.exe, 00000002.00000002.2627578878.00007FF8E6C46000.00000002.00000001.01000000.00000010.sdmp, user.exe, 00000007.00000002.1614451503.00007FF8E5C76000.00000002.00000001.01000000.00000029.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es4~
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462946364.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python-hyper.org/en/latest/contributing.html
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545202926.0000022959973000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1522247460.0000022959947000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525652249.0000022959947000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587502806.0000022959AD3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553300194.0000022959973000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532731618.0000022959AC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/K
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/g
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/m
Source: user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1577293229.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579139270.0000022959AAE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1549008784.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htmcl5
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535125970.0000022959B14000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554991563.000002295942E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556347958.000002295947E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1371831524.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1373211473.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1370331782.0000027A3E329000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1465549201.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1583915927.0000022959373000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1576165187.0000022959373000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1552656439.000002295936B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520348822.000002295918A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524800001.0000022959197000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1530618628.00000229591AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1577293229.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1549008784.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: user.exe, 00000002.00000003.1421855039.000001B2960E6000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532731618.0000022959AC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: user.exe, 00000002.00000003.1392791148.000001B296102000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584186864.00000229593D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481704199.000002295994C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481495642.0000022959A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: user.exe, 00000002.00000002.2623880663.000001B296850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codecov.io/gh/python-hyper/h2
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://codecov.io/gh/python-hyper/h2/branch/master/graph/badge.svg
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: user.exe, 00000002.00000003.1390949588.000001B295AEF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: user.exe, 00000002.00000002.2620916508.000001B295920000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1386669756.000001B2957A1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1472767584.000002295924E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1583589141.0000022959260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: user.exe, 00000002.00000002.2619623100.000001B295514000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: user.exe, 00000002.00000002.2619623100.000001B295514000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: user.exe, 00000002.00000003.1387568398.000001B2956D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387249458.000001B2956DF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387801808.000001B2956DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: user.exe, 00000002.00000002.2623880663.000001B29682C000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520071289.0000022959A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621634585.000001B295D40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: user.exe, 00000007.00000002.1590791512.000002295A148000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: user.exe, 00000002.00000002.2623880663.000001B296818000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/550K
Source: user.exe, user.exe, 00000007.00000002.1600413520.00007FF8E5A52000.00000002.00000001.01000000.00000032.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/orgs/python-hyper/people
Source: user.exe, 00000002.00000002.2623756571.000001B2966C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2/actions
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-hyper/h2/workflows/CI/badge.svg
Source: user.exe, 00000002.00000003.1387568398.000001B2956D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387249458.000001B2956DF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2619623100.000001B295514000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387801808.000001B2956DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390303985.000001B295A34000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389494302.000001B295E80000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584131705.00000229593BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2168
Source: user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192
Source: user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621634585.000001B295D40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: user.exe, 00000002.00000003.1392364563.000001B295F92000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526338996.0000022959533000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
Source: user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitter.im/python-hyper/community
Source: user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.000002295948D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1557709596.0000022959890000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.0000022959844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1557709596.0000022959890000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.0000022959844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h2.readthedocs.io
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://h2.readthedocs.io/en/latest/
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598BB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545129782.00000229598C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: user.exe, 00000002.00000003.1421141726.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520071289.0000022959A4C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598BB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524380998.00000229598B1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.00000229598B2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1578585574.0000022959A62000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554991563.000002295942E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556103241.00000229598B3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959A43000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584628060.0000022959475000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1549008784.0000022959A62000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1533380875.00000229593FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584238680.000002295940A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/chat-join_now-brightgreen.svg
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1552656439.000002295936B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392895163.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392791148.000001B296118000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553591785.0000022959484000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: user.exe, 00000002.00000002.2623303617.000001B296260000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588969154.0000022959B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: user.exe, 00000002.00000002.2623880663.000001B2968A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: user.exe, 00000002.00000002.2623880663.000001B2968A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jsExtensions
Source: user.exe, 00000002.00000003.1385108111.000001B2956B1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621508196.000001B295C40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585008614.0000022959570000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1470465704.00000229575DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: user.exe, 00000002.00000002.2631025301.00007FF8E78F8000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: user.exe, 00000002.00000002.2623880663.000001B29682C000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1590791512.000002295A15C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: user.exe, 00000007.00000002.1590791512.000002295A15C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error0
Source: user.exe, 00000002.00000002.2623880663.000001B29682C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errorpS
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.github.com/python-hyper/documentation/master/source/logo/hyper-black-bg-white.png
Source: user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/h2/badge/?version=latest
Source: user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.read
Source: user.exe, 00000002.00000002.2623756571.000001B2966C0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1533380875.00000229593FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584238680.000002295940A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480894513.000002295980D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: user.exe, 00000002.00000003.1390949588.000001B295AEF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584353212.0000022959423000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.000002295948D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: user.exe, 00000007.00000002.1588969154.0000022959B90000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: user.exe, 00000000.00000003.1366646900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: user.exe, 00000000.00000003.1366702047.0000027A3E32F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1366616298.0000027A3E32F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1366646900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1459342420.00000245209D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: user.exe, 00000002.00000002.2624678476.000001B297144000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: user.exe, 00000002.00000002.2624678476.000001B297144000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstorer
Source: user.exe, 00000002.00000002.2624678476.000001B297144000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2628458287.00007FF8E6FD0000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000002.00000002.2630080832.00007FF8E74D4000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000005.00000003.1464454740.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1617434983.00007FF8E62B4000.00000002.00000001.01000000.00000028.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1533380875.00000229593FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584238680.000002295940A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392895163.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392791148.000001B296118000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553591785.0000022959484000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: user.exe, 00000002.00000002.2631025301.00007FF8E78F8000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392364563.000001B295FA3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553505399.00000229598E7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: user.exe, 00000002.00000003.1421492929.000001B2961F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1557709596.0000022959890000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.0000022959844000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F4F70 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,

2_2_00007FF8E69F4F70

Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F58E0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	2_2_00007FF8E69F58E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F5980 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	2_2_00007FF8E69F5980
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5945980 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	7_2_00007FF8E5945980
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59458E0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	7_2_00007FF8E59458E0

Source: C:\Users\user\Desktop\user.exe

File created: C:\Windows\system32\errors.log

Jump to behavior

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F26964	0_2_00007FF653F26964
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F089E0	0_2_00007FF653F089E0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F01000	0_2_00007FF653F01000
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F25C00	0_2_00007FF653F25C00
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F11D54	0_2_00007FF653F11D54
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F1E570	0_2_00007FF653F1E570
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F135A0	0_2_00007FF653F135A0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F25E7C	0_2_00007FF653F25E7C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F19EA0	0_2_00007FF653F19EA0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F1DEF0	0_2_00007FF653F1DEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F29728	0_2_00007FF653F29728
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F11740	0_2_00007FF653F11740
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F11F60	0_2_00007FF653F11F60
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F18794	0_2_00007FF653F18794
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F09800	0_2_00007FF653F09800
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F21874	0_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F240AC	0_2_00007FF653F240AC
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F208C8	0_2_00007FF653F208C8
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F180E4	0_2_00007FF653F180E4
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F11944	0_2_00007FF653F11944
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F12164	0_2_00007FF653F12164
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F139A4	0_2_00007FF653F139A4
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F1DA5C	0_2_00007FF653F1DA5C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0A2DB	0_2_00007FF653F0A2DB
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F11B50	0_2_00007FF653F11B50
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F12C10	0_2_00007FF653F12C10
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F23C10	0_2_00007FF653F23C10
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F26418	0_2_00007FF653F26418
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F208C8	0_2_00007FF653F208C8
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0A474	0_2_00007FF653F0A474
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0ACAD	0_2_00007FF653F0ACAD
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F15D30	0_2_00007FF653F15D30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F26964	2_2_00007FF653F26964
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F01000	2_2_00007FF653F01000
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F11D54	2_2_00007FF653F11D54
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F1E570	2_2_00007FF653F1E570
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F135A0	2_2_00007FF653F135A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F25E7C	2_2_00007FF653F25E7C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F19EA0	2_2_00007FF653F19EA0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F1DEF0	2_2_00007FF653F1DEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F29728	2_2_00007FF653F29728
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F11740	2_2_00007FF653F11740
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F11F60	2_2_00007FF653F11F60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F18794	2_2_00007FF653F18794
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F09800	2_2_00007FF653F09800
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F21874	2_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F240AC	2_2_00007FF653F240AC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F208C8	2_2_00007FF653F208C8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F180E4	2_2_00007FF653F180E4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F11944	2_2_00007FF653F11944
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F12164	2_2_00007FF653F12164
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F139A4	2_2_00007FF653F139A4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F089E0	2_2_00007FF653F089E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F1DA5C	2_2_00007FF653F1DA5C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0A2DB	2_2_00007FF653F0A2DB
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F11B50	2_2_00007FF653F11B50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F25C00	2_2_00007FF653F25C00
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F12C10	2_2_00007FF653F12C10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F23C10	2_2_00007FF653F23C10
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F26418	2_2_00007FF653F26418
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F208C8	2_2_00007FF653F208C8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0A474	2_2_00007FF653F0A474
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0ACAD	2_2_00007FF653F0ACAD
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F15D30	2_2_00007FF653F15D30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F43F0	2_2_00007FF8E69F43F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F3930	2_2_00007FF8E69F3930
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F3540	2_2_00007FF8E69F3540
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A38A30	2_2_00007FF8E6A38A30
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A4A880	2_2_00007FF8E6A4A880
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A385E0	2_2_00007FF8E6A385E0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A28550	2_2_00007FF8E6A28550
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A62300	2_2_00007FF8E6A62300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A684A0	2_2_00007FF8E6A684A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A4CB70	2_2_00007FF8E6A4CB70
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A5ECC0	2_2_00007FF8E6A5ECC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A53780	2_2_00007FF8E6A53780
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A5F690	2_2_00007FF8E6A5F690
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A53230	2_2_00007FF8E6A53230
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A61FC0	2_2_00007FF8E6A61FC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A4DA90	2_2_00007FF8E6A4DA90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6B11950	2_2_00007FF8E6B11950
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6B11300	2_2_00007FF8E6B11300
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6B12270	2_2_00007FF8E6B12270
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BD10A0	2_2_00007FF8E6BD10A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BCC840	2_2_00007FF8E6BCC840
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BC3A50	2_2_00007FF8E6BC3A50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1AFD0	2_2_00007FF8E6C1AFD0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C375D0	2_2_00007FF8E6C375D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C3EBD0	2_2_00007FF8E6C3EBD0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C095F0	2_2_00007FF8E6C095F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1A1F0	2_2_00007FF8E6C1A1F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C0B790	2_2_00007FF8E6C0B790
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C27790	2_2_00007FF8E6C27790
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C20F80	2_2_00007FF8E6C20F80
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C24980	2_2_00007FF8E6C24980
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C20BB0	2_2_00007FF8E6C20BB0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BF5B40	2_2_00007FF8E6BF5B40
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BFA540	2_2_00007FF8E6BFA540
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C06740	2_2_00007FF8E6C06740
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C37D50	2_2_00007FF8E6C37D50
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BF3D60	2_2_00007FF8E6BF3D60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C19770	2_2_00007FF8E6C19770
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C42370	2_2_00007FF8E6C42370
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C25F60	2_2_00007FF8E6C25F60
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C39510	2_2_00007FF8E6C39510
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BFC910	2_2_00007FF8E6BFC910
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C22700	2_2_00007FF8E6C22700
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C3DD20	2_2_00007FF8E6C3DD20
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1C2D0	2_2_00007FF8E6C1C2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C22AD0	2_2_00007FF8E6C22AD0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C36ED0	2_2_00007FF8E6C36ED0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BFB2D0	2_2_00007FF8E6BFB2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1EEC0	2_2_00007FF8E6C1EEC0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C3B8C0	2_2_00007FF8E6C3B8C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C410C0	2_2_00007FF8E6C410C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C3C4C0	2_2_00007FF8E6C3C4C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BFDEF0	2_2_00007FF8E6BFDEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C026F0	2_2_00007FF8E6C026F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1F290	2_2_00007FF8E6C1F290
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C27290	2_2_00007FF8E6C27290
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C04490	2_2_00007FF8E6C04490
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C3F8B0	2_2_00007FF8E6C3F8B0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C1E6A0	2_2_00007FF8E6C1E6A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C404A0	2_2_00007FF8E6C404A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C37A40	2_2_00007FF8E6C37A40
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BF6660	2_2_00007FF8E6BF6660
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C05660	2_2_00007FF8E6C05660
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C07C60	2_2_00007FF8E6C07C60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5943930	7_2_00007FF8E5943930
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5943540	7_2_00007FF8E5943540
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59443F0	7_2_00007FF8E59443F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5988A30	7_2_00007FF8E5988A30
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59885E0	7_2_00007FF8E59885E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5978550	7_2_00007FF8E5978550
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E599A880	7_2_00007FF8E599A880
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59B84A0	7_2_00007FF8E59B84A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59B2300	7_2_00007FF8E59B2300
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59AECC0	7_2_00007FF8E59AECC0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E599CB70	7_2_00007FF8E599CB70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59AF690	7_2_00007FF8E59AF690
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59A3780	7_2_00007FF8E59A3780
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59A3230	7_2_00007FF8E59A3230
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59B1FC0	7_2_00007FF8E59B1FC0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E599DA90	7_2_00007FF8E599DA90
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A62270	7_2_00007FF8E5A62270
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A61950	7_2_00007FF8E5A61950
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A61300	7_2_00007FF8E5A61300
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B210A0	7_2_00007FF8E5B210A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B1C840	7_2_00007FF8E5B1C840
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B13A50	7_2_00007FF8E5B13A50
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B611E0	7_2_00007FF8E5B611E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B61E20	7_2_00007FF8E5B61E20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5BB36D0	7_2_00007FF8E5BB36D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B72A80	7_2_00007FF8E5B72A80
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B74280	7_2_00007FF8E5B74280
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B95E50	7_2_00007FF8E5B95E50
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B99A60	7_2_00007FF8E5B99A60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B72E70	7_2_00007FF8E5B72E70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B90E10	7_2_00007FF8E5B90E10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B975C0	7_2_00007FF8E5B975C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9A9D0	7_2_00007FF8E5B9A9D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B969E0	7_2_00007FF8E5B969E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9A1E0	7_2_00007FF8E5B9A1E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B87180	7_2_00007FF8E5B87180
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B98190	7_2_00007FF8E5B98190
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B7D190	7_2_00007FF8E5B7D190
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B939B0	7_2_00007FF8E5B939B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B71D40	7_2_00007FF8E5B71D40
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B94950	7_2_00007FF8E5B94950
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9B100	7_2_00007FF8E5B9B100
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B74900	7_2_00007FF8E5B74900
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B87D10	7_2_00007FF8E5B87D10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B98D20	7_2_00007FF8E5B98D20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B80920	7_2_00007FF8E5B80920
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B7592C	7_2_00007FF8E5B7592C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5BB3130	7_2_00007FF8E5BB3130
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B93480	7_2_00007FF8E5B93480
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9B880	7_2_00007FF8E5B9B880
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B79080	7_2_00007FF8E5B79080
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B888A0	7_2_00007FF8E5B888A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B8A040	7_2_00007FF8E5B8A040
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B75850	7_2_00007FF8E5B75850
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B75C63	7_2_00007FF8E5B75C63
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9C070	7_2_00007FF8E5B9C070
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B94420	7_2_00007FF8E5B94420
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B96420	7_2_00007FF8E5B96420
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B89430	7_2_00007FF8E5B89430
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B7CC30	7_2_00007FF8E5B7CC30
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B953C0	7_2_00007FF8E5B953C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B79FD0	7_2_00007FF8E5B79FD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B96FF0	7_2_00007FF8E5B96FF0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B97B80	7_2_00007FF8E5B97B80
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B73380	7_2_00007FF8E5B73380
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9FF8B	7_2_00007FF8E5B9FF8B
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9C7A0	7_2_00007FF8E5B9C7A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B713B0	7_2_00007FF8E5B713B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B7E3B0	7_2_00007FF8E5B7E3B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B98760	7_2_00007FF8E5B98760
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B92F70	7_2_00007FF8E5B92F70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B75F75	7_2_00007FF8E5B75F75
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B93F10	7_2_00007FF8E5B93F10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B76316	7_2_00007FF8E5B76316
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9CF20	7_2_00007FF8E5B9CF20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B7671A	7_2_00007FF8E5B7671A
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B9E71B	7_2_00007FF8E5B9E71B
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B73B20	7_2_00007FF8E5B73B20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B99330	7_2_00007FF8E5B99330
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C110C0	7_2_00007FF8E5C110C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C116A0	7_2_00007FF8E5C116A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C2B2D0	7_2_00007FF8E5C2B2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4C2D0	7_2_00007FF8E5C4C2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C52AD0	7_2_00007FF8E5C52AD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C66ED0	7_2_00007FF8E5C66ED0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4EEC0	7_2_00007FF8E5C4EEC0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C6C4C0	7_2_00007FF8E5C6C4C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C710C0	7_2_00007FF8E5C710C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C6B8C0	7_2_00007FF8E5C6B8C0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C2DEF0	7_2_00007FF8E5C2DEF0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C326F0	7_2_00007FF8E5C326F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C34490	7_2_00007FF8E5C34490
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4F290	7_2_00007FF8E5C4F290
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C57290	7_2_00007FF8E5C57290
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C6F8B0	7_2_00007FF8E5C6F8B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4E6A0	7_2_00007FF8E5C4E6A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C704A0	7_2_00007FF8E5C704A0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C67A40	7_2_00007FF8E5C67A40
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C72A70	7_2_00007FF8E5C72A70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C26660	7_2_00007FF8E5C26660
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C35660	7_2_00007FF8E5C35660
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C37C60	7_2_00007FF8E5C37C60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4DA60	7_2_00007FF8E5C4DA60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4AC10	7_2_00007FF8E5C4AC10
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C22400	7_2_00007FF8E5C22400
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C56C20	7_2_00007FF8E5C56C20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4AFD0	7_2_00007FF8E5C4AFD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C675D0	7_2_00007FF8E5C675D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C6EBD0	7_2_00007FF8E5C6EBD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C395F0	7_2_00007FF8E5C395F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C4A1F0	7_2_00007FF8E5C4A1F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C3B790	7_2_00007FF8E5C3B790
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C57790	7_2_00007FF8E5C57790
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C50F80	7_2_00007FF8E5C50F80
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C54980	7_2_00007FF8E5C54980
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C50BB0	7_2_00007FF8E5C50BB0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C67D50	7_2_00007FF8E5C67D50
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C25B40	7_2_00007FF8E5C25B40
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C2A540	7_2_00007FF8E5C2A540
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C36740	7_2_00007FF8E5C36740
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C49770	7_2_00007FF8E5C49770
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C72370	7_2_00007FF8E5C72370
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C23D60	7_2_00007FF8E5C23D60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C55F60	7_2_00007FF8E5C55F60
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C2C910	7_2_00007FF8E5C2C910
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C69510	7_2_00007FF8E5C69510
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C52700	7_2_00007FF8E5C52700
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C6DD20	7_2_00007FF8E5C6DD20
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF16FE	7_2_00007FF8E5CF16FE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D68870	7_2_00007FF8E5D68870
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF116D	7_2_00007FF8E5CF116D
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF8720	7_2_00007FF8E5CF8720
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1D93	7_2_00007FF8E5CF1D93
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF117C	7_2_00007FF8E5CF117C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1B54	7_2_00007FF8E5CF1B54
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1CBC	7_2_00007FF8E5CF1CBC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF149C	7_2_00007FF8E5CF149C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2702	7_2_00007FF8E5CF2702
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1618	7_2_00007FF8E5CF1618
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1EE2	7_2_00007FF8E5CF1EE2
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D28920	7_2_00007FF8E5D28920
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D6AC80	7_2_00007FF8E5D6AC80
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1A0F	7_2_00007FF8E5CF1A0F
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF2617	7_2_00007FF8E5CF2617
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D63650	7_2_00007FF8E5D63650
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1654	7_2_00007FF8E5CF1654
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF13DE	7_2_00007FF8E5CF13DE
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF21C6	7_2_00007FF8E5CF21C6
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D5D2D0	7_2_00007FF8E5D5D2D0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF24DC	7_2_00007FF8E5CF24DC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1C12	7_2_00007FF8E5CF1C12
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF17F8	7_2_00007FF8E5CF17F8
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1546	7_2_00007FF8E5CF1546
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D3DE50	7_2_00007FF8E5D3DE50
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF1FDC	7_2_00007FF8E5CF1FDC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF21E4	7_2_00007FF8E5CF21E4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5D16030	7_2_00007FF8E5D16030

Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5D6D32F appears 273 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5D6DB03 appears 37 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5A3C400 appears 47 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5974BF0 appears 77 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5D6D425 appears 39 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6A24BF0 appears 77 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6AEC400 appears 47 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E59889C0 appears 248 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5B13900 appears 116 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6BC3900 appears 116 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6A389C0 appears 248 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5974250 appears 68 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5B13880 appears 51 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6BC3880 appears 51 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E6A24250 appears 68 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5CF1325 appears 400 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF653F02710 appears 104 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF653F02910 appears 34 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5D6D33B appears 33 times
Source: C:\Users\user\Desktop\user.exe	Code function: String function: 00007FF8E5D6D341 appears 1016 times

Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.5.dr	Static PE information: No import functions for PE file found
Source: python3.dll.11.dr	Static PE information: No import functions for PE file found

Source: user.exe, 00000000.00000003.1362747723.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1372027234.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000000.00000003.1380441449.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.1382993293.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1363533994.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1383240668.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1383106327.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1363672400.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1362577469.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000000.00000003.1383240668.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1381043666.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000000.00000003.1362270059.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs user.exe
Source: user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe	Binary or memory string: OriginalFilename vs user.exe
Source: user.exe, 00000002.00000002.2637315032.00007FF8F835A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000002.00000002.2620603180.000001B295712000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs user.exe
Source: user.exe, 00000002.00000002.2634320682.00007FF8E7E23000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2626712654.00007FF8E6B02000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.2626091431.00007FF8E6A11000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000002.00000002.2633656105.00007FF8E7C9A000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2628458287.00007FF8E6FD0000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000002.00000002.2638003535.00007FF8F8CA8000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2635638616.00007FF8F704E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2630080832.00007FF8E74D4000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs user.exe
Source: user.exe, 00000002.00000002.2636782078.00007FF8F7AA2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2633333141.00007FF8E7B30000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs user.exe
Source: user.exe, 00000002.00000002.2636214243.00007FF8F7A33000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2627148448.00007FF8E6BBC000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2637048773.00007FF8F830D000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2638349165.00007FF8F8FF6000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2620851258.000001B2958F0000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000002.00000002.2635060021.00007FF8F6DA6000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000002.00000002.2637615819.00007FF8F8B89000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1468330749.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1468200856.00000245209D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1448877672.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1448428595.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1452996149.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1468502118.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1466886855.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepythoncom313.dll0 vs user.exe
Source: user.exe, 00000005.00000003.1468502118.00000245209D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32trace.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1446624839.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1464787734.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs user.exe
Source: user.exe, 00000005.00000003.1449287226.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1447477413.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000005.00000003.1449079706.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1467463412.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1449590565.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1467693768.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1447786494.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000005.00000003.1449899794.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs user.exe
Source: user.exe, 00000005.00000003.1464454740.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs user.exe
Source: user.exe, 00000005.00000003.1468200856.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_win32sysloader.pyd0 vs user.exe
Source: user.exe, 00000005.00000003.1467334854.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe	Binary or memory string: OriginalFilename vs user.exe
Source: user.exe, 00000007.00000002.1604461859.00007FF8E5B0C000.00000002.00000001.01000000.00000031.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs user.exe
Source: user.exe, 00000007.00000002.1617434983.00007FF8E62B4000.00000002.00000001.01000000.00000028.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs user.exe
Source: user.exe, 00000007.00000002.1618311849.00007FF8E635E000.00000002.00000001.01000000.00000020.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs user.exe
Source: user.exe, 00000007.00000002.1620206310.00007FF8F095A000.00000002.00000001.01000000.0000001E.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs user.exe
Source: user.exe, 00000007.00000002.1617889378.00007FF8E6306000.00000002.00000001.01000000.00000025.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs user.exe
Source: user.exe, 00000007.00000002.1618100944.00007FF8E6333000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs user.exe
Source: user.exe, 00000007.00000002.1614330240.00007FF8E5C18000.00000002.00000001.01000000.0000002A.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs user.exe
Source: user.exe, 00000007.00000002.1600413520.00007FF8E5A52000.00000002.00000001.01000000.00000032.sdmp	Binary or memory string: OriginalFilenamepywintypes313.dll0 vs user.exe
Source: user.exe, 00000007.00000002.1614164021.00007FF8E5C09000.00000002.00000001.01000000.0000002B.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs user.exe
Source: user.exe, 00000007.00000002.1613217094.00007FF8E5B6D000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs user.exe

Source: classification engine

Classification label: mal60.troj.evad.winEXE@12/145@1/1

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F3930 PyArg_ParseTuple,GetLastError,?PyWin_GetErrorMessageModule@@YAPEAUHINSTANCE__@@K@Z,FormatMessageW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,PyErr_Clear,PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z,malloc,PyErr_NoMemory,memset,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,FormatMessageW,PyEval_RestoreThread,PyExc_SystemError,PyErr_SetString,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,free,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,LocalFree,_Py_Dealloc,

2_2_00007FF8E69F3930

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F4C00 _Py_NoneStruct,PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyEval_SaveThread,GetDiskFreeSpaceW,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,Py_BuildValue,

2_2_00007FF8E69F4C00

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E6A31330 PyArg_ParseTuple,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z,PyObject_IsInstance,PyErr_Occurred,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_GetAttrString,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,_Py_Dealloc,PyEval_SaveThread,CoCreateInstance,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,

2_2_00007FF8E6A31330

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69FCBB0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,?PyWinObject_AsResourceId@@YAHPEAU_object@@PEAPEA_WH@Z,FindResourceExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,SizeofResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LoadResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,LockResource,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,PyBytes_FromStringAndSize,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,?PyWinObject_FreeResourceId@@YAXPEA_W@Z,

2_2_00007FF8E69FCBB0

Source: C:\Users\user\Desktop\user.exe

File created: C:\Users\user\Desktop\errors.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03

Source: C:\Users\user\Desktop\user.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI75642

Jump to behavior

Source: user.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\user.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Users\user\Desktop\user.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: user.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\user.exe

File read: C:\Users\user\Desktop\user.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: unknown	Process created: C:\Users\user\Desktop\user.exe C:\Users\user\Desktop\user.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe C:\Users\user\Desktop\user.exe
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe C:\Users\user\Desktop\user.exe	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe	Jump to behavior

Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: user.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: user.exe

Static file information: File size 16756993 > 1048576

Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: user.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: user.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: user.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2626855364.00007FF8E6BB7000.00000002.00000001.01000000.00000018.sdmp, user.exe, 00000005.00000003.1467693768.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1601648258.00007FF8E5B07000.00000002.00000001.01000000.00000031.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: user.exe, 00000002.00000002.2629554504.00007FF8E742A000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E620A000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\_win32sysloader.pdb source: user.exe, 00000000.00000003.1382993293.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1468200856.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: user.exe, 00000002.00000002.2628358963.00007FF8E6F95000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000007.00000002.1614754021.00007FF8E5D75000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb** source: user.exe, 00000002.00000002.2626615099.00007FF8E6AF1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637906283.00007FF8F8CA4000.00000002.00000001.01000000.00000011.sdmp, user.exe, 00000005.00000003.1452996149.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb}},GCTL source: user.exe, 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32trace.pdb source: user.exe, 00000000.00000003.1383240668.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1468502118.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: user.exe, 00000000.00000003.1362577469.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637209525.00007FF8F8354000.00000002.00000001.01000000.00000005.sdmp, user.exe, 00000005.00000003.1447477413.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1620143500.00007FF8F0954000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: user.exe, 00000002.00000002.2629554504.00007FF8E7392000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E6172000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: user.exe, 00000000.00000003.1362577469.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637209525.00007FF8F8354000.00000002.00000001.01000000.00000005.sdmp, user.exe, 00000005.00000003.1447477413.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1620143500.00007FF8F0954000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb!! source: user.exe, 00000002.00000002.2625975165.00007FF8E6A03000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: user.exe, 00000002.00000002.2629554504.00007FF8E742A000.00000002.00000001.01000000.0000000E.sdmp, user.exe, 00000007.00000002.1616958688.00007FF8E620A000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\win32api.pdb source: user.exe, 00000002.00000002.2625975165.00007FF8E6A03000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: user.exe, 00000000.00000003.1362747723.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637506375.00007FF8F8B85000.00000002.00000001.01000000.00000012.sdmp, user.exe, 00000005.00000003.1447786494.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1614093263.00007FF8E5C05000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: user.exe, 00000000.00000003.1381436900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2638100481.00007FF8F8FF3000.00000002.00000001.01000000.0000000C.sdmp, user.exe, 00000005.00000003.1467463412.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pywintypes.pdb source: user.exe, 00000002.00000002.2626615099.00007FF8E6AF1000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: user.exe, 00000002.00000002.2635380374.00007FF8F7043000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: user.exe, 00000000.00000003.1363837714.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2636947025.00007FF8F8306000.00000002.00000001.01000000.00000014.sdmp, user.exe, 00000005.00000003.1449287226.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1612639997.00007FF8E5B66000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634036136.00007FF8E7E1B000.00000002.00000001.01000000.0000000A.sdmp, user.exe, 00000005.00000003.1449590565.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: user.exe, 00000000.00000003.1364615537.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634902972.00007FF8F6DA3000.00000002.00000001.01000000.00000015.sdmp, user.exe, 00000005.00000003.1449788223.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-313\Release\pythoncom.pdb source: user.exe, 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: user.exe, 00000000.00000003.1364422732.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2634036136.00007FF8E7E1B000.00000002.00000001.01000000.0000000A.sdmp, user.exe, 00000005.00000003.1449590565.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: user.exe, 00000000.00000003.1363208241.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2636675020.00007FF8F7A9D000.00000002.00000001.01000000.00000009.sdmp, user.exe, 00000005.00000003.1448428595.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1619967318.00007FF8E7C5D000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: user.exe, 00000000.00000003.1365340376.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637906283.00007FF8F8CA4000.00000002.00000001.01000000.00000011.sdmp, user.exe, 00000005.00000003.1452996149.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: user.exe, 00000000.00000003.1364990790.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2635936237.00007FF8F7A29000.00000002.00000001.01000000.0000000B.sdmp, user.exe, 00000005.00000003.1449899794.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1619808462.00007FF8E6E69000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: user.exe, 00000000.00000003.1372505324.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620851258.000001B2958F0000.00000002.00000001.01000000.00000006.sdmp, user.exe, 00000005.00000003.1464787734.00000245209C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: user.exe, 00000002.00000002.2631025301.00007FF8E78F8000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: user.exe, 00000000.00000003.1362747723.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2637506375.00007FF8F8B85000.00000002.00000001.01000000.00000012.sdmp, user.exe, 00000005.00000003.1447786494.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1614093263.00007FF8E5C05000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: user.exe, 00000002.00000002.2628358963.00007FF8E6F95000.00000002.00000001.01000000.0000000F.sdmp, user.exe, 00000007.00000002.1614754021.00007FF8E5D75000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: user.exe, 00000002.00000002.2633466176.00007FF8E7C7E000.00000002.00000001.01000000.0000000D.sdmp, user.exe, 00000007.00000002.1617610822.00007FF8E62DE000.00000002.00000001.01000000.00000026.sdmp

Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: user.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69FEFE0 ?PyWinGlobals_Ensure@@YAHXZ,PyModule_Create2,PyModule_GetDict,?PyWinExc_ApiError@@3PEAU_object@@EA,PyDict_SetItemString,PyLong_FromLong,PyDict_SetItemString,PyLong_FromLong,PyDict_SetItemString,PyLong_FromLong,PyDict_SetItemString,PyType_Ready,PyDict_SetItemString,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,PyModule_AddIntConstant,GetModuleHandleW,LoadLibraryExW,GetProcAddressForCaller,GetProcAddress,GetModuleHandleW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00007FF8E69FEFE0

Source: mfc140u.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim
Source: mfc140u.dll.5.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.5.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.5.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.5.dr	Static PE information: section name: .00cfg
Source: python313.dll.5.dr	Static PE information: section name: PyRuntim
Source: mfc140u.dll.11.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.11.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.11.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.11.dr	Static PE information: section name: .00cfg
Source: python313.dll.11.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\user.exe

Code function: 7_2_00007FF8E5D14331 push rcx; ret

7_2_00007FF8E5D14332

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\user.exe	Process created: "C:\Users\user\Desktop\user.exe"
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe
Source: C:\Users\user\Desktop\user.exe	Process created: "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe

Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79762\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI77602\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F05830 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF653F05830

Source: C:\Users\user\Desktop\user.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 7_2_00007FF8E5D38816 sgdt fword ptr [rax]

7_2_00007FF8E5D38816

Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\backend_c.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_brotli.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pythoncom313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\_cffi.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75642\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI77602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\user.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79762\python313.dll	Jump to dropped file

Source: C:\Users\user\Desktop\user.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17641

Source: C:\Users\user\Desktop\user.exe	API coverage: 1.5 %
Source: C:\Users\user\Desktop\user.exe	API coverage: 0.7 %

Source: C:\Users\user\Desktop\user.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F09280 FindFirstFileExW,FindClose,	0_2_00007FF653F09280
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF653F083C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F09280 FindFirstFileExW,FindClose,	2_2_00007FF653F09280
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F21874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF653F21874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F083C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF653F083C0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E69F3540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	2_2_00007FF8E69F3540
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5943540 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindFirstFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,?PyObject_FromWIN32_FIND_DATAW@@YAPEAU_object@@PEAU_WIN32_FIND_DATAW@@@Z,PyList_Append,_Py_Dealloc,FindNextFileW,GetLastError,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,FindClose,_Py_Dealloc,	7_2_00007FF8E5943540

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F53D0 PyArg_ParseTuple,GetLogicalDriveStringsW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,GetLogicalDriveStringsW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W_J@Z,

2_2_00007FF8E69F53D0

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69FFC78 VirtualQuery,GetSystemInfo,

2_2_00007FF8E69FFC78

Source: user.exe, 00000000.00000003.1365856313.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1456453809.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: user.exe, 00000007.00000002.1585491425.00000229597C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b})
Source: user.exe, 00000007.00000003.1547776294.000002295A23E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390949588.000001B295BC9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
Source: user.exe, 00000007.00000002.1585491425.00000229597C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: user.exe, 00000007.00000002.1585491425.00000229597C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemu
Source: user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1533380875.00000229593FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWAddr%SystemRoot%\system32\mswsock.dll
Source: user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dro.kernel.qemu
Source: user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\Z

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF653F1A614

Source: C:\Users\user\Desktop\user.exe

2_2_00007FF8E69FEFE0

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F23480 GetProcessHeap,

0_2_00007FF653F23480

Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF653F1A614
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF653F0C8A0
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF653F0D12C
Source: C:\Users\user\Desktop\user.exe	Code function: 0_2_00007FF653F0D30C SetUnhandledExceptionFilter,	0_2_00007FF653F0D30C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F1A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF653F1A614
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF653F0C8A0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF653F0D12C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF653F0D30C SetUnhandledExceptionFilter,	2_2_00007FF653F0D30C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A018B0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6A018B0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A00CAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6A00CAC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A01A98 SetUnhandledExceptionFilter,	2_2_00007FF8E6A01A98
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A7A874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6A7A874
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A7B3F4 SetUnhandledExceptionFilter,	2_2_00007FF8E6A7B3F4
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A7B20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6A7B20C
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6AEFBFC SetUnhandledExceptionFilter,	2_2_00007FF8E6AEFBFC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6AEE8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6AEE8FC
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6AEFA14 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6AEFA14
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6B12C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6B12C90
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6B13248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6B13248
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BD43F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6BD43F0
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6BD49A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6BD49A8
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6C449E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6C449E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5951A98 SetUnhandledExceptionFilter,	7_2_00007FF8E5951A98
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5950CAC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5950CAC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59518B0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E59518B0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59CA874 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E59CA874
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59CB20C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E59CB20C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E59CB3F4 SetUnhandledExceptionFilter,	7_2_00007FF8E59CB3F4
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A3FA14 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5A3FA14
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A3E8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5A3E8FC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A3FBFC SetUnhandledExceptionFilter,	7_2_00007FF8E5A3FBFC
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A63248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5A63248
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5A62C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5A62C90
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B243F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5B243F0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B249A8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5B249A8
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B419E0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5B419E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B41420 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5B41420
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B51DF0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5B51DF0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B51830 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5B51830
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B63DD0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5B63DD0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5B64390 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5B64390
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5BDDC70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5BDDC70
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C04738 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5C04738
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C12E7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5C12E7C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C1335C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5C1335C
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5C749E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF8E5C749E0
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5CF212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF8E5CF212B

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69FDC70 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FF8E69FDC70

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69FDD10 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

2_2_00007FF8E69FDD10

Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe"	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe C:\Users\user\Desktop\user.exe	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Process created: C:\Users\user\Desktop\user.exe "C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E6AE7EB0 PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,GetSecurityDescriptorDacl,free,SetSecurityDescriptorDacl,GetSecurityDescriptorOwner,free,GetSecurityDescriptorGroup,free,free,free,

2_2_00007FF8E6AE7EB0

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E6AE8D60 PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,_Py_Dealloc,AllocateAndInitializeSid,PyExc_ValueError,PyErr_SetString,_Py_NewReference,malloc,memset,memcpy,

2_2_00007FF8E6AE8D60

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F29570 cpuid

0_2_00007FF653F29570

Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\backend_c.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75642 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\__init__.py VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\errors.log VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\messages.json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_brotli.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\backend_c.cp313-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\Desktop\user.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\user.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI77602 VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F0D010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF653F0D010

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F4200 PyArg_ParseTuple,GetUserNameW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,

2_2_00007FF8E69F4200

Source: C:\Users\user\Desktop\user.exe

Code function: 0_2_00007FF653F25C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF653F25C00

Source: C:\Users\user\Desktop\user.exe

Code function: 2_2_00007FF8E69F7890 PyArg_ParseTuple,GetVersionExW,?PyWin_SetAPIError@@YAPEAU_object@@PEADJ@Z,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,Py_BuildValue,GetVersionExW,?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z,Py_BuildValue,PyExc_ValueError,PyErr_Format,

2_2_00007FF8E69F7890

Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A34620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,	2_2_00007FF8E6A34620
Source: C:\Users\user\Desktop\user.exe	Code function: 2_2_00007FF8E6A33430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue,	2_2_00007FF8E6A33430
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5984620 PyArg_ParseTuple,PyEval_SaveThread,CreateBindCtx,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyEval_SaveThread,PyEval_RestoreThread,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyObject_IsSubclass,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,	7_2_00007FF8E5984620
Source: C:\Users\user\Desktop\user.exe	Code function: 7_2_00007FF8E5983430 PyArg_ParseTuple,?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z,PyObject_IsInstance,PyExc_ValueError,PyErr_Format,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,CreateBindCtx,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,PyEval_SaveThread,MkParseDisplayName,PyEval_RestoreThread,?PyWinObject_FreeWCHAR@@YAXPEA_W@Z,_Py_Dealloc,_Py_NoneStruct,_Py_NoneStruct,?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z,PyDict_GetItem,_Py_Dealloc,PyErr_Clear,PyExc_TypeError,PyErr_SetString,PyEval_SaveThread,PyEval_RestoreThread,PyObject_IsSubclass,Py_BuildValue,	7_2_00007FF8E5983430

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	11 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	26 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
user.exe	12%	Virustotal		Browse
user.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pythoncom313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\win32\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32trace.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\_cffi.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\backend_c.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_brotli.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md__mypyc.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pythoncom313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pywintypes313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI77602\win32\_win32sysloader.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://repository.swisssign.com/K	0%	Avira URL Cloud	safe
https://requests.read	0%	Avira URL Cloud	safe
http://repository.swisssign.com/g	0%	Avira URL Cloud	safe
http://python-hyper.org/en/latest/contributing.html	0%	Avira URL Cloud	safe
https://h2.readthedocs.io	0%	Avira URL Cloud	safe
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	0%	Avira URL Cloud	safe
http://repository.swisssign.com/m	0%	Avira URL Cloud	safe
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error0	0%	Avira URL Cloud	safe
https://h2.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
http://ocsp.accv.es4~	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.telegram.org	149.154.167.220	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/asweigart/pyperclip/issues/55	user.exe, 00000007.00000002.1590791512.000002295A148000.00000004.00001000.00020000.00000000.sdmp	false		high
https://codecov.io/gh/python-hyper/h2	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin32	user.exe, user.exe, 00000007.00000002.1600413520.00007FF8E5A52000.00000002.00000001.01000000.00000032.sdmp	false		high
https://payments.google.com/payments/v4/js/integrator.jsExtensions	user.exe, 00000002.00000002.2623880663.000001B2968A8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/K	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2168	user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc2388#section-4.4	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480894513.000002295980D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	user.exe, 00000000.00000003.1366702047.0000027A3E32F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1366616298.0000027A3E32F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1366646900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1459342420.00000245209D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	user.exe, 00000002.00000003.1390949588.000001B295AEF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htmcl5	user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/entry-points/#file-format	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/g	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-hyper/h2/workflows/CI/badge.svg	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage	user.exe, 00000002.00000002.2623880663.000001B296850000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/orgs/python-hyper/people	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621634585.000001B295D40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cacerts.digi	user.exe, 00000000.00000003.1365161477.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382049145.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000000.00000003.1382942130.0000027A3E32E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1452786524.00000245209C3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1467693768.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0205/	user.exe, 00000002.00000003.1385108111.000001B2956B1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621508196.000001B295C40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585008614.0000022959570000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1470465704.00000229575DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535125970.0000022959B14000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	user.exe, 00000002.00000003.1392791148.000001B296102000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2623641827.000001B2965C0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481704199.000002295994C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481495642.0000022959A20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es	user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/3020	user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/h2/badge/?version=latest	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	user.exe, 00000002.00000003.1387568398.000001B2956D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387249458.000001B2956DF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2619623100.000001B295514000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387801808.000001B2956DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/get	user.exe, 00000002.00000003.1421141726.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520071289.0000022959A4C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598BB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524380998.00000229598B1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.00000229598B2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1578585574.0000022959A62000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554991563.000002295942E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556103241.00000229598B3000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959A43000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584628060.0000022959475000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1549008784.0000022959A62000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	false		high
https://h2.readthedocs.io	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.accv.es4~	user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	false		high
https://payments.google.com/payments/v4/js/integrator.js	user.exe, 00000002.00000002.2623880663.000001B2968A8000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.github.com/python-hyper/documentation/master/source/logo/hyper-black-bg-white.png	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390303985.000001B295A34000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389494302.000001B295E80000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584131705.00000229593BE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/m	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	user.exe, 00000000.00000003.1366646900.0000027A3E321000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1458538738.00000245209C3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://requests.read	user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/	user.exe, 00000002.00000003.1421492929.000001B2961F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1534313123.0000022959B29000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588628384.0000022959B2E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532495083.0000022959516000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1574461610.0000022959516000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524506481.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	user.exe, 00000002.00000002.2619126307.000001B293BA8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527184461.00000229575A2000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1562515908.00000229575D1000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python-hyper.org/en/latest/contributing.html	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://packaging.python.org/en/latest/specifications/core-metadata/#core-metadata	user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error0	user.exe, 00000007.00000002.1590791512.000002295A15C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://h2.readthedocs.io/en/latest/	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wwwsearch.sf.net/):	user.exe, 00000002.00000003.1392791148.000001B296102000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584186864.00000229593D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481704199.000002295994C000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481495642.0000022959A20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/wiki/Development-Methodology	user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/security/	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1586342647.00000229598FA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545326033.0000022959911000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556811900.0000022959912000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1530468425.00000229598F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526721995.0000022959905000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535125970.0000022959B14000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554991563.000002295942E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1556347958.000002295947E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1557709596.0000022959890000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.0000022959844000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	user.exe, 00000002.00000002.2623303617.000001B296260000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000002.00000002.2623413937.000001B296370000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1588969154.0000022959B90000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1587771128.0000022959AFF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545235200.0000022959AFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	user.exe, 00000002.00000002.2631025301.00007FF8E78F8000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	user.exe, 00000002.00000002.2624678476.000001B297144000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/cryptography/badge/?version=latest	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://foss.heptapod.net/pypy/pypy/-/issues/3539	user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621634585.000001B295D40000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1585152494.0000022959670000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	user.exe, 00000002.00000003.1392364563.000001B295F92000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959515000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1526338996.0000022959533000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.0000022959515000.00000004.00000020.00020000.00000000.sdmp	false		high
http://google.com/	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295AD7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.000002295947D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1561217432.00000229594F0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1480691004.0000022959495000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1482351531.000002295948D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1527277139.00000229594ED000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545714532.00000229594EF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crlE	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	user.exe, 00000002.00000002.2627578878.00007FF8E6C46000.00000002.00000001.01000000.00000010.sdmp, user.exe, 00000007.00000002.1614451503.00007FF8E5C76000.00000002.00000001.01000000.00000029.sdmp	false		high
https://mahler:8092/site-updates.py	user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392895163.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392791148.000001B296118000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1553591785.0000022959484000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	user.exe, 00000002.00000003.1421492929.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.../back.jpeg	user.exe, 00000002.00000002.2623756571.000001B2966C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	user.exe, 00000002.00000003.1390949588.000001B295AEF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525011279.000002295941F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584353212.0000022959423000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524234410.000002295941E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/post	user.exe, 00000002.00000003.1390949588.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1390060263.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389176083.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1389544051.000001B295B7E000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1481946088.00000229593F9000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1533380875.00000229593FF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1584238680.000002295940A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	user.exe, 00000002.00000002.2623880663.000001B29682C000.00000004.00001000.00020000.00000000.sdmp, user.exe, 00000007.00000002.1590791512.000002295A15C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	user.exe, 00000002.00000002.2619623100.000001B295514000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/	user.exe, 00000000.00000003.1366313980.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1457542424.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Ousret/charset_normalizer	user.exe, 00000002.00000003.1421492929.000001B29611B000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B29610A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B29612A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524116544.000002295948F000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520563388.000002295948A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545611948.0000022959490000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	user.exe, 00000002.00000003.1421141726.000001B2961CD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421669744.000001B295B7D000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B296174000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621109580.000001B295B67000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000002.1583915927.0000022959373000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532372203.0000022959AE5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1576165187.0000022959373000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1552656439.000002295936B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	user.exe, 00000002.00000002.2619623100.000001B295490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	user.exe, 00000002.00000002.2623527530.000001B2964C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://.css	user.exe, 00000002.00000002.2627578878.00007FF8E6C46000.00000002.00000001.01000000.00000010.sdmp, user.exe, 00000007.00000002.1614451503.00007FF8E5C76000.00000002.00000001.01000000.00000029.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	user.exe, 00000002.00000002.2624678476.000001B297118000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	user.exe, 00000002.00000003.1387568398.000001B2956D8000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387249458.000001B2956DF000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1387801808.000001B2956DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1563292594.0000022959173000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1579761417.0000022959175000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524321430.0000022959170000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yahoo.com/	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B295FDD000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598D5000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1557709596.0000022959890000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1525493888.0000022959844000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	user.exe, 00000002.00000002.2621109580.000001B295A20000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1535652585.0000022959812000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1528011348.00000229597FB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1554544679.0000022959815000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	user.exe, 00000002.00000002.2620603180.000001B2956B0000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520348822.000002295918A000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1524800001.0000022959197000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1530618628.00000229591AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-hyper/h2	user.exe, 00000000.00000003.1369355123.0000027A3E324000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000005.00000003.1462146123.00000245209C6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://html.spec.whatwg.org/multipage/	user.exe, 00000002.00000002.2621747627.000001B295EDA000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1392435767.000001B295F24000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1520665223.00000229598BB000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1545129782.00000229598C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	user.exe, 00000002.00000003.1421855039.000001B2960E6000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000002.2621747627.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000002.00000003.1421141726.000001B2960DE000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1518981653.0000022959AA7000.00000004.00000020.00020000.00000000.sdmp, user.exe, 00000007.00000003.1532731618.0000022959AC5000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584838
Start date and time:	2025-01-06 16:01:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	user.exe
Detection:	MAL
Classification:	mal60.troj.evad.winEXE@12/145@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 68 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:02:13	Task Scheduler	Run new task: WindowsUpdateService path: C:\Users\user\Desktop\user.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	UpdaterTool.exe	Get hash	malicious	Unknown	Browse
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	UpdaterTool.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	UpdaterTool.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll	UpdaterTool.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse
	main.exe	Get hash	malicious	Unknown	Browse
	user.exe	Get hash	malicious	Unknown	Browse
	DeltaX.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	winws1.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	zapret.exe	Get hash	malicious	Unknown	Browse
	discord.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd	UpdaterTool.exe	Get hash	malicious	Unknown	Browse
	user.exe	Get hash	malicious	Unknown	Browse
	List Furniture.bat	Get hash	malicious	Python Stealer, Braodo	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: UpdaterTool.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: user.exe, Detection: malicious, Browse Filename: DeltaX.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: winws1.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: zapret.exe, Detection: malicious, Browse Filename: discord.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: UpdaterTool.exe, Detection: malicious, Browse Filename: user.exe, Detection: malicious, Browse Filename: List Furniture.bat, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	823808
Entropy (8bit):	6.062213302300903
Encrypted:	false
SSDEEP:	12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
MD5:	5ED46A7126DBDB70F3C60530E35BA035
SHA1:	B5C0DCBE3EE42E258CADD54AC46F70F1F903AE1B
SHA-256:	67DFA82DCAED04ED3F358D84B18D1375D59126161DE92E00164D36087B179D4D
SHA-512:	7F5D2B52C310A239182EEDD60833951D46CDD18CA2EDD828FCABED4299B2AB5DF506A2B271E33F129D0256D6DB90F9C902EE4D18A7E41CA61F65365504451DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."/a.fN..fN..fN..o6..nN..v...dN..-6..dN..v...eN..v...nN..v...kN......eN..fN..[N......FN......gN......gN......gN..RichfN..........PE..d....Q.g.........." ...).L...H.......O....................................................`......................................... t..`....t.................. ....................J..............................`I..@............`...............................text...XJ.......L.................. ..`.rdata.......`.......P..............@..@.data................l..............@....pdata.. ............t..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI75642\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.120351253767657
Encrypted:	false
SSDEEP:	24:bOLRrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bOLRaJHlxE35QHOs5exm3ogF5n
MD5:	AA3B9B4395563DD427BE5F022EC321C1
SHA1:	80129BCE9030CF215FC93006DCE98B0BA8C778F8
SHA-256:	7A65A5AF0CBABF1C16251C7C6B2B7CB46D16A7222E79975B9B61FCD66A2E3F28
SHA-512:	62337AD684E4AA1192DBA00503EED316F28F6480ACEA90442774BE544C970C3F9012933B451C036DB3AC388C495153D6C9FA04E1844E0A483E8E767218B90690
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015-2020 Cory Benfield and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3583
Entropy (8bit):	4.978673419311688
Encrypted:	false
SSDEEP:	96:D7evWamPktjxsxMMrgfHcxfS+UvWQH46o1WvUXCR:+RsMCgfGfS+UvW63MyR
MD5:	566784A778E8B69F205F14DAC1D57817
SHA1:	B1B850F3D43CC453086BED7034675426F81C9BDE
SHA-256:	C504EAA29585F6BDD95644FEC420C7016599401DE0FF3CAA80AC429748A847A4
SHA-512:	CFD127A2868E94E5F4FAFAB78A3153094D45F6538AE77642ADE9FABC5580D47DA2EC40A2EB7BF11FD6F5A21553A4489F5278B76AC017D738B64C4C9579B38D55
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: h2.Version: 4.1.0.Summary: HTTP/2 State-Machine based protocol implementation.Home-page: https://github.com/python-hyper/h2.Author: Cory Benfield.Author-email: cory@lukasa.co.uk.License: MIT License.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Requires-Python: >=3.6.1.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: hyperframe (<7,>=6.0).

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.8211741515807445
Encrypted:	false
SSDEEP:	48:pnuXipSpe7lLCDHPk0M3T429PTW/2B7V0Wh85dGlLt4qYt29tw:sXEFgHe3T42VTW/2tV0MmdGlLtnY89m
MD5:	D87AEDCBB68CBE9452841B2CCF60912D
SHA1:	A52A782A2954A756483F58BC96007BA4183FA020
SHA-256:	2064CC9A20B0FB9F6BC1D8BB5C819AAC32A729C2D0CAD20933E1CD88397B84BB
SHA-512:	D2F863769FAFA427020C59FA0CCE704B4487D30FF8D5398FEB3724AFEFC273DC006CF16F2B24B875C3EC8550B74E09F02B910A8AC78C7A70A0F8D0496BE1DEA5
Malicious:	false
Preview:	h2-4.1.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..h2-4.1.0.dist-info/LICENSE,sha256=emWlrwy6vxwWJRx8ayt8tG0WpyIueZdbm2H81mouPyg,1102..h2-4.1.0.dist-info/METADATA,sha256=xQTqopWF9r3ZVkT-xCDHAWWZQB3g_zyqgKxCl0ioR6Q,3583..h2-4.1.0.dist-info/RECORD,,..h2-4.1.0.dist-info/WHEEL,sha256=OqRkF0eY5GHssMorFjlbTIq072vpHpF60fIQA6lS9xA,92..h2-4.1.0.dist-info/top_level.txt,sha256=Hiulx8KxI2jFUM1dG7-CZeRkO3j50MBwCLG36Vrq-kI,3..h2/__init__.py,sha256=inV-bCAUhD_QGjQe5Mk8gl7F85v26UW9W3BHov9vBAA,86..h2/__pycache__/__init__.cpython-313.pyc,,..h2/__pycache__/config.cpython-313.pyc,,..h2/__pycache__/connection.cpython-313.pyc,,..h2/__pycache__/errors.cpython-313.pyc,,..h2/__pycache__/events.cpython-313.pyc,,..h2/__pycache__/exceptions.cpython-313.pyc,,..h2/__pycache__/frame_buffer.cpython-313.pyc,,..h2/__pycache__/settings.cpython-313.pyc,,..h2/__pycache__/stream.cpython-313.pyc,,..h2/__pycache__/utilities.cpython-313.pyc,,..h2/__pycache__/windows.cpython-313.pyc,,..h2/config

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCfA5S:RtBMwlViQWBBf
MD5:	11AA48DBE7E7CC631B11DD66DC493AEB
SHA1:	249FDB01AD3E3F71356E33E1897D06F23CFB20C2
SHA-256:	3AA464174798E461ECB0CA2B16395B4C8AB4EF6BE91E917AD1F21003A952F710
SHA-512:	EDD5892C9B2FE1F2439C53D2CD05F4478EC360885054BD06AFCF7936F6D066377FEE07796DAE9ECDF810E3D6100E039CAD48F00AD0E3145693D53E844CC5319D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI75642\h2-4.1.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:Vn:V
MD5:	4217C1CE78C1E6BAE73FE12CE19C51D3
SHA1:	8BA0141FFAA18F4355DB911606B6B283D9BEF1B1
SHA-256:	1E2BA5C7C2B12368C550CD5D1BBF8265E4643B78F9D0C07008B1B7E95AEAFA42
SHA-512:	E735248AA6CC62335983C38AC04631F512B1444D3FACD5FE00064F6649D9382CC8A1661BFEF4978156B2BBD93C27FCDFD581416B05EBC91B59FEFD3C51207067
Malicious:	false
Preview:	h2.

C:\Users\user\AppData\Local\Temp\_MEI75642\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\python3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\python313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\select.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\_cffi.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	650752
Entropy (8bit):	6.407907101203656
Encrypted:	false
SSDEEP:	6144:Oz5QLUL4lK9bQkMZ/jZMaBHX7vu3XSAU128zkpWCucchvkf8HpbUPAKjgCX3oRx:Ozb4lK9ckWBHXKSA584ENcyv6sUPAKg
MD5:	0C4037C8EE7D926265B6AC499C323599
SHA1:	B2F5B324449814C25E7262E2B7598B2596AD34B8
SHA-256:	5134A34833CDCDC64546BEB50AABFC09496F457FFB76F6ECDE01E8D9D30BC177
SHA-512:	99C5CBA330D1266D46F51348CD1D08920385E42A41ED9BA53AACB5E39C9297B7153BB0F66EAC157D1869877D718BF24486E78033A2F2218E7891E415FE9EC2FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F...........1....r....I......r.....r.....r.....u......J..u.....u.....u]....u....Rich..........PE..d....'.f.........." ...(.....\......P........................................0............`.........................................0...\........................3........... .......d..............................Pc..@...............@............................text...x........................... ..`.rdata..b...........................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75642\zstandard\backend_c.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	520192
Entropy (8bit):	6.408267868238645
Encrypted:	false
SSDEEP:	12288:AL1TGmvt0Vwyow0k1rErgw25rDjEA0Z7k45sWOC:A5lvt0Vw9fk1rErV25rE57k
MD5:	23266E25821CE9E162F050DB8B81C6F9
SHA1:	FD1049338E304D7688562991091D59C310999B23
SHA-256:	0B494D168A67F2EB2D75593714A4DB65FE0F000B66388AB3C721A67515A2FEFC
SHA-512:	E118531A6BF5354BF082D4CEAAF5247FEA3305A9ADD399ECBBE08AB083D39AB760F3CA28A0DD2B4D5D8400F3E88EC3DECD696E3987FB9F2264A5B8B16F66A61B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................k...........k.....k.....k.....l......T..l.....l.....ln....l....Rich..................PE..d....'.f.........." ...(............ ........................................0............`......................................... ...d........................)........... ..d...0\...............................Z..@...............(............................text...H........................... ..`.rdata.............................@..@.data....-.......(..................@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..d.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_brotli.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	823808
Entropy (8bit):	6.062213302300903
Encrypted:	false
SSDEEP:	12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
MD5:	5ED46A7126DBDB70F3C60530E35BA035
SHA1:	B5C0DCBE3EE42E258CADD54AC46F70F1F903AE1B
SHA-256:	67DFA82DCAED04ED3F358D84B18D1375D59126161DE92E00164D36087B179D4D
SHA-512:	7F5D2B52C310A239182EEDD60833951D46CDD18CA2EDD828FCABED4299B2AB5DF506A2B271E33F129D0256D6DB90F9C902EE4D18A7E41CA61F65365504451DE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."/a.fN..fN..fN..o6..nN..v...dN..-6..dN..v...eN..v...nN..v...kN......eN..fN..[N......FN......gN......gN......gN..RichfN..........PE..d....Q.g.........." ...).L...H.......O....................................................`......................................... t..`....t.................. ....................J..............................`I..@............`...............................text...XJ.......L.................. ..`.rdata.......`.......P..............@..@.data................l..............@....pdata.. ............t..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\base_library.zip

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI77602\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI77602\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.120351253767657
Encrypted:	false
SSDEEP:	24:bOLRrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bOLRaJHlxE35QHOs5exm3ogF5n
MD5:	AA3B9B4395563DD427BE5F022EC321C1
SHA1:	80129BCE9030CF215FC93006DCE98B0BA8C778F8
SHA-256:	7A65A5AF0CBABF1C16251C7C6B2B7CB46D16A7222E79975B9B61FCD66A2E3F28
SHA-512:	62337AD684E4AA1192DBA00503EED316F28F6480ACEA90442774BE544C970C3F9012933B451C036DB3AC388C495153D6C9FA04E1844E0A483E8E767218B90690
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015-2020 Cory Benfield and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3583
Entropy (8bit):	4.978673419311688
Encrypted:	false
SSDEEP:	96:D7evWamPktjxsxMMrgfHcxfS+UvWQH46o1WvUXCR:+RsMCgfGfS+UvW63MyR
MD5:	566784A778E8B69F205F14DAC1D57817
SHA1:	B1B850F3D43CC453086BED7034675426F81C9BDE
SHA-256:	C504EAA29585F6BDD95644FEC420C7016599401DE0FF3CAA80AC429748A847A4
SHA-512:	CFD127A2868E94E5F4FAFAB78A3153094D45F6538AE77642ADE9FABC5580D47DA2EC40A2EB7BF11FD6F5A21553A4489F5278B76AC017D738B64C4C9579B38D55
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: h2.Version: 4.1.0.Summary: HTTP/2 State-Machine based protocol implementation.Home-page: https://github.com/python-hyper/h2.Author: Cory Benfield.Author-email: cory@lukasa.co.uk.License: MIT License.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Requires-Python: >=3.6.1.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: hyperframe (<7,>=6.0).

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.8211741515807445
Encrypted:	false
SSDEEP:	48:pnuXipSpe7lLCDHPk0M3T429PTW/2B7V0Wh85dGlLt4qYt29tw:sXEFgHe3T42VTW/2tV0MmdGlLtnY89m
MD5:	D87AEDCBB68CBE9452841B2CCF60912D
SHA1:	A52A782A2954A756483F58BC96007BA4183FA020
SHA-256:	2064CC9A20B0FB9F6BC1D8BB5C819AAC32A729C2D0CAD20933E1CD88397B84BB
SHA-512:	D2F863769FAFA427020C59FA0CCE704B4487D30FF8D5398FEB3724AFEFC273DC006CF16F2B24B875C3EC8550B74E09F02B910A8AC78C7A70A0F8D0496BE1DEA5
Malicious:	false
Preview:	h2-4.1.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..h2-4.1.0.dist-info/LICENSE,sha256=emWlrwy6vxwWJRx8ayt8tG0WpyIueZdbm2H81mouPyg,1102..h2-4.1.0.dist-info/METADATA,sha256=xQTqopWF9r3ZVkT-xCDHAWWZQB3g_zyqgKxCl0ioR6Q,3583..h2-4.1.0.dist-info/RECORD,,..h2-4.1.0.dist-info/WHEEL,sha256=OqRkF0eY5GHssMorFjlbTIq072vpHpF60fIQA6lS9xA,92..h2-4.1.0.dist-info/top_level.txt,sha256=Hiulx8KxI2jFUM1dG7-CZeRkO3j50MBwCLG36Vrq-kI,3..h2/__init__.py,sha256=inV-bCAUhD_QGjQe5Mk8gl7F85v26UW9W3BHov9vBAA,86..h2/__pycache__/__init__.cpython-313.pyc,,..h2/__pycache__/config.cpython-313.pyc,,..h2/__pycache__/connection.cpython-313.pyc,,..h2/__pycache__/errors.cpython-313.pyc,,..h2/__pycache__/events.cpython-313.pyc,,..h2/__pycache__/exceptions.cpython-313.pyc,,..h2/__pycache__/frame_buffer.cpython-313.pyc,,..h2/__pycache__/settings.cpython-313.pyc,,..h2/__pycache__/stream.cpython-313.pyc,,..h2/__pycache__/utilities.cpython-313.pyc,,..h2/__pycache__/windows.cpython-313.pyc,,..h2/config

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCfA5S:RtBMwlViQWBBf
MD5:	11AA48DBE7E7CC631B11DD66DC493AEB
SHA1:	249FDB01AD3E3F71356E33E1897D06F23CFB20C2
SHA-256:	3AA464174798E461ECB0CA2B16395B4C8AB4EF6BE91E917AD1F21003A952F710
SHA-512:	EDD5892C9B2FE1F2439C53D2CD05F4478EC360885054BD06AFCF7936F6D066377FEE07796DAE9ECDF810E3D6100E039CAD48F00AD0E3145693D53E844CC5319D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI77602\h2-4.1.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:Vn:V
MD5:	4217C1CE78C1E6BAE73FE12CE19C51D3
SHA1:	8BA0141FFAA18F4355DB911606B6B283D9BEF1B1
SHA-256:	1E2BA5C7C2B12368C550CD5D1BBF8265E4643B78F9D0C07008B1B7E95AEAFA42
SHA-512:	E735248AA6CC62335983C38AC04631F512B1444D3FACD5FE00064F6649D9382CC8A1661BFEF4978156B2BBD93C27FCDFD581416B05EBC91B59FEFD3C51207067
Malicious:	false
Preview:	h2.

C:\Users\user\AppData\Local\Temp\_MEI77602\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\python3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\python313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\select.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\_cffi.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	650752
Entropy (8bit):	6.407907101203656
Encrypted:	false
SSDEEP:	6144:Oz5QLUL4lK9bQkMZ/jZMaBHX7vu3XSAU128zkpWCucchvkf8HpbUPAKjgCX3oRx:Ozb4lK9ckWBHXKSA584ENcyv6sUPAKg
MD5:	0C4037C8EE7D926265B6AC499C323599
SHA1:	B2F5B324449814C25E7262E2B7598B2596AD34B8
SHA-256:	5134A34833CDCDC64546BEB50AABFC09496F457FFB76F6ECDE01E8D9D30BC177
SHA-512:	99C5CBA330D1266D46F51348CD1D08920385E42A41ED9BA53AACB5E39C9297B7153BB0F66EAC157D1869877D718BF24486E78033A2F2218E7891E415FE9EC2FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F...........1....r....I......r.....r.....r.....u......J..u.....u.....u]....u....Rich..........PE..d....'.f.........." ...(.....\......P........................................0............`.........................................0...\........................3........... .......d..............................Pc..@...............@............................text...x........................... ..`.rdata..b...........................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI77602\zstandard\backend_c.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	520192
Entropy (8bit):	6.408267868238645
Encrypted:	false
SSDEEP:	12288:AL1TGmvt0Vwyow0k1rErgw25rDjEA0Z7k45sWOC:A5lvt0Vw9fk1rErV25rE57k
MD5:	23266E25821CE9E162F050DB8B81C6F9
SHA1:	FD1049338E304D7688562991091D59C310999B23
SHA-256:	0B494D168A67F2EB2D75593714A4DB65FE0F000B66388AB3C721A67515A2FEFC
SHA-512:	E118531A6BF5354BF082D4CEAAF5247FEA3305A9ADD399ECBBE08AB083D39AB760F3CA28A0DD2B4D5D8400F3E88EC3DECD696E3987FB9F2264A5B8B16F66A61B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................k...........k.....k.....k.....l......T..l.....l.....ln....l....Rich..................PE..d....'.f.........." ...(............ ........................................0............`......................................... ...d........................)........... ..d...0\...............................Z..@...............(............................text...H........................... ..`.rdata.............................@..@.data....-.......(..................@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..d.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1044992
Entropy (8bit):	6.005174713821525
Encrypted:	false
SSDEEP:	12288:cVDH7h88c4vGmhhbrGRUDG+AYZ2OWTw/3EnrE:sDHdRcgFv8qWTwco
MD5:	9AF5F53A9201B7E62AC91EDC8AB89C6A
SHA1:	4DDFE7AF2248A76B5DB90AF0EAF4C80E2B4CD6DB
SHA-256:	F84528FC136D8ABAE77543B8E9E8C9489C4495C491807907E675C15F028816F6
SHA-512:	0581BA9951452BD7B2A193B8D73573B49CB8115468B6AF8B988628670A768A6882AC4C2C9FAA559F731ADD4378DCF606C3FFEEF96AD8A479B272E6C429DC1293
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;`K.Z...Z...Z..."...Z..=/...Z.......Z..."...Z.../...Z.../...Z.../...Z...Z...\.../...Z..=/...Z..=/...Z..=/...Z..=/...Z..Rich.Z..........................PE..d...~..g.........." .....\|...r......T1....................................................`.............................................T......h............p..............0..`\......T.......................(.......8................0...........................text....z.......\|.................. ..`.rdata.............................@..@.data........P.......6..............@....pdata......p......................@..@.rsrc................z..............@..@.reloc..`\...0...^..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_brotli.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	823808
Entropy (8bit):	6.062213302300903
Encrypted:	false
SSDEEP:	12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
MD5:	5ED46A7126DBDB70F3C60530E35BA035
SHA1:	B5C0DCBE3EE42E258CADD54AC46F70F1F903AE1B
SHA-256:	67DFA82DCAED04ED3F358D84B18D1375D59126161DE92E00164D36087B179D4D
SHA-512:	7F5D2B52C310A239182EEDD60833951D46CDD18CA2EDD828FCABED4299B2AB5DF506A2B271E33F129D0256D6DB90F9C902EE4D18A7E41CA61F65365504451DE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."/a.fN..fN..fN..o6..nN..v...dN..-6..dN..v...eN..v...nN..v...kN......eN..fN..[N......FN......gN......gN......gN..RichfN..........PE..d....Q.g.........." ...).L...H.......O....................................................`......................................... t..`....t.................. ....................J..............................`I..@............`...............................text...XJ.......L.................. ..`.rdata.......`.......P..............@..@.data................l..............@....pdata.. ............t..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\base_library.zip

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI79762\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.818583535960129
Encrypted:	false
SSDEEP:	96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
MD5:	56FE4F6C7E88212161F49E823CCC989A
SHA1:	16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
SHA-256:	002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
SHA-512:	7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	5.953784637413928
Encrypted:	false
SSDEEP:	3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
MD5:	10116447F9276F10664BA85A5614BA3A
SHA1:	EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
SHA-256:	C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
SHA-512:	C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.562603127346912
Encrypted:	false
SSDEEP:	192:1XxTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1XX7ohCE3sIPm6LciTwqU+96inhgB
MD5:	196EB487FE23136C14B43FE28FD62DAD
SHA1:	B7878EA852FA6C6A9B173E60B81029B5B00BA691
SHA-256:	4032FF71C85740D209A454E06F96CBC56302ACEC18E1BD539D39369292DB2110
SHA-512:	F2052E1F42C8EC69DCF501FFA32B27AEC939E769786BEE1F95C24466C774987F5AA8C13B5996D6C59D04755442EB421E53E0AE5EE0148872F9BD9FE01CF3FC8E
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__init__.cpython-313.pyc,,..cryptography/__pycache__/exceptions.cpython-313.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI79762\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.120351253767657
Encrypted:	false
SSDEEP:	24:bOLRrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bOLRaJHlxE35QHOs5exm3ogF5n
MD5:	AA3B9B4395563DD427BE5F022EC321C1
SHA1:	80129BCE9030CF215FC93006DCE98B0BA8C778F8
SHA-256:	7A65A5AF0CBABF1C16251C7C6B2B7CB46D16A7222E79975B9B61FCD66A2E3F28
SHA-512:	62337AD684E4AA1192DBA00503EED316F28F6480ACEA90442774BE544C970C3F9012933B451C036DB3AC388C495153D6C9FA04E1844E0A483E8E767218B90690
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015-2020 Cory Benfield and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3583
Entropy (8bit):	4.978673419311688
Encrypted:	false
SSDEEP:	96:D7evWamPktjxsxMMrgfHcxfS+UvWQH46o1WvUXCR:+RsMCgfGfS+UvW63MyR
MD5:	566784A778E8B69F205F14DAC1D57817
SHA1:	B1B850F3D43CC453086BED7034675426F81C9BDE
SHA-256:	C504EAA29585F6BDD95644FEC420C7016599401DE0FF3CAA80AC429748A847A4
SHA-512:	CFD127A2868E94E5F4FAFAB78A3153094D45F6538AE77642ADE9FABC5580D47DA2EC40A2EB7BF11FD6F5A21553A4489F5278B76AC017D738B64C4C9579B38D55
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: h2.Version: 4.1.0.Summary: HTTP/2 State-Machine based protocol implementation.Home-page: https://github.com/python-hyper/h2.Author: Cory Benfield.Author-email: cory@lukasa.co.uk.License: MIT License.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifier: Programming Language :: Python :: Implementation :: PyPy.Requires-Python: >=3.6.1.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: hyperframe (<7,>=6.0).

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	5.8211741515807445
Encrypted:	false
SSDEEP:	48:pnuXipSpe7lLCDHPk0M3T429PTW/2B7V0Wh85dGlLt4qYt29tw:sXEFgHe3T42VTW/2tV0MmdGlLtnY89m
MD5:	D87AEDCBB68CBE9452841B2CCF60912D
SHA1:	A52A782A2954A756483F58BC96007BA4183FA020
SHA-256:	2064CC9A20B0FB9F6BC1D8BB5C819AAC32A729C2D0CAD20933E1CD88397B84BB
SHA-512:	D2F863769FAFA427020C59FA0CCE704B4487D30FF8D5398FEB3724AFEFC273DC006CF16F2B24B875C3EC8550B74E09F02B910A8AC78C7A70A0F8D0496BE1DEA5
Malicious:	false
Preview:	h2-4.1.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..h2-4.1.0.dist-info/LICENSE,sha256=emWlrwy6vxwWJRx8ayt8tG0WpyIueZdbm2H81mouPyg,1102..h2-4.1.0.dist-info/METADATA,sha256=xQTqopWF9r3ZVkT-xCDHAWWZQB3g_zyqgKxCl0ioR6Q,3583..h2-4.1.0.dist-info/RECORD,,..h2-4.1.0.dist-info/WHEEL,sha256=OqRkF0eY5GHssMorFjlbTIq072vpHpF60fIQA6lS9xA,92..h2-4.1.0.dist-info/top_level.txt,sha256=Hiulx8KxI2jFUM1dG7-CZeRkO3j50MBwCLG36Vrq-kI,3..h2/__init__.py,sha256=inV-bCAUhD_QGjQe5Mk8gl7F85v26UW9W3BHov9vBAA,86..h2/__pycache__/__init__.cpython-313.pyc,,..h2/__pycache__/config.cpython-313.pyc,,..h2/__pycache__/connection.cpython-313.pyc,,..h2/__pycache__/errors.cpython-313.pyc,,..h2/__pycache__/events.cpython-313.pyc,,..h2/__pycache__/exceptions.cpython-313.pyc,,..h2/__pycache__/frame_buffer.cpython-313.pyc,,..h2/__pycache__/settings.cpython-313.pyc,,..h2/__pycache__/stream.cpython-313.pyc,,..h2/__pycache__/utilities.cpython-313.pyc,,..h2/__pycache__/windows.cpython-313.pyc,,..h2/config

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCfA5S:RtBMwlViQWBBf
MD5:	11AA48DBE7E7CC631B11DD66DC493AEB
SHA1:	249FDB01AD3E3F71356E33E1897D06F23CFB20C2
SHA-256:	3AA464174798E461ECB0CA2B16395B4C8AB4EF6BE91E917AD1F21003A952F710
SHA-512:	EDD5892C9B2FE1F2439C53D2CD05F4478EC360885054BD06AFCF7936F6D066377FEE07796DAE9ECDF810E3D6100E039CAD48F00AD0E3145693D53E844CC5319D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI79762\h2-4.1.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:Vn:V
MD5:	4217C1CE78C1E6BAE73FE12CE19C51D3
SHA1:	8BA0141FFAA18F4355DB911606B6B283D9BEF1B1
SHA-256:	1E2BA5C7C2B12368C550CD5D1BBF8265E4643B78F9D0C07008B1B7E95AEAFA42
SHA-512:	E735248AA6CC62335983C38AC04631F512B1444D3FACD5FE00064F6649D9382CC8A1661BFEF4978156B2BBD93C27FCDFD581416B05EBC91B59FEFD3C51207067
Malicious:	false
Preview:	h2.

C:\Users\user\AppData\Local\Temp\_MEI79762\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\python3.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\python313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pythoncom313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	678400
Entropy (8bit):	6.050905552138285
Encrypted:	false
SSDEEP:	6144:r0G3L613PCcuXLq0Qroh0abOY6RWd0GrNmFKlOKdSAjUpdc6YcAQE7KytwhrPYL+:AGm16c0QroXbWnGVlOKQpdAUmN+
MD5:	070B0C071A05B06223B927F1711E0B9C
SHA1:	C482B1E1C1CDA3E0AEB84A0C3EF315C355BA003B
SHA-256:	9D1097ABAD812B53A68C2BFCF9EFEF7559E39873950A000FAC9A7C7C5B199292
SHA-512:	D05389A078C66426EA9CA3A8DF1721ABE246F59A3684DCFA9C5B031A93D96506A0D3BB8795330CFC0E81B23BBF7D91BBDE51EFFD152A234BA5ED63673F41086B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........~..-..-..-...-...-..,..-..,..-..,..-..,..-..,..-..,..-...,..-..,..-..-...-..,...-..,..-..,..-Rich..-................PE..d......g.........." ................4........................................ ............`..........................................u...c..............l....`...{............... ..`1..T............................1..8............................................text...#........................... ..`.rdata...$.......&..................@..@.data....L..........................@....pdata...{...`...\|..................@..@.rsrc...l............4..............@..@.reloc... ......."...8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\pywin32_system32\pywintypes313.dll

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135680
Entropy (8bit):	6.0205382324631955
Encrypted:	false
SSDEEP:	3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
MD5:	2A87D04E9E7CBFF67E8EA4F6315C0EBB
SHA1:	CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
SHA-256:	D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
SHA-512:	2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\select.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.116146861242879
Encrypted:	false
SSDEEP:	192:ketklgde+ljBEs0I62SbPbVlQmUAaPHTPMRX7aMHvcqvn7yab6x/:/d1tT0h2SbAmFaPHTmphvH6x/
MD5:	5521E251A515964D04BC90CE8A2AA24C
SHA1:	F7B4AB985DC9A1C7EF2F716999D276D126515BEC
SHA-256:	F382CFFA30F533484FA6314E90A1408F0826867D70B3320220FD86AAFAC37526
SHA-512:	FFEB0185B6D74881B3DCA25BA1B11C33CBCF3B466F3F1B888D662611925399BA2C7D8F133673474F691C068E67811A3FAD0FC057036A5B156B735019FAA882B9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%g.ND..ND..ND..G<..LD...1..LD...<..LD...1..ED...1..FD...1..MD......MD..ND..dD..1..OD..1..OD..1..OD..RichND..................PE..d...\|..g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.868928551727267
Encrypted:	false
SSDEEP:	3072:mQKZG4IWJW8E60/c0nlRVFhLaNzvX2/qQvmYbtrprA3e:ZKZG7WgdnlRVgvm/qQDtrprA
MD5:	C5067F04B506B09E48D4D07470E5A182
SHA1:	20435C1A092141CE67E943C95E5CF522762ACD91
SHA-256:	E19294BC2C145A9D87D4A2D8412830C8FF4C8C1B9AD005BD68ABD4B566AF1887
SHA-512:	56F08A5EB927921DED50E92EA972253E68C1216DAA48871B3AA9ED62DB5712E665DFDA406C73E9F33736B61ED1F0CD016E6B4FFEE0237781FB98EEB63672F81E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V............................................+.............................................Rich............PE..d......g.........." .........................................................P............`......................................... ................0..\.......X............@..X...xv..T............................;..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...X(......."..................@....pdata..X...........................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.260538552870905
Encrypted:	false
SSDEEP:	384:k1CAOcv3ugutnS5nW8sHt+9Nie20T8DmDxPBQ/vMj75yn9OJg1Bl:kh/pWKJPy/0PUOJuB
MD5:	75C14B382EEF49322BB28F79DD2A7A54
SHA1:	13CCCA1F8B19D68331E7FE981113B042FAC34408
SHA-256:	5049C9956310FFC80C1C21C2D8A6562BA810E4592DB7DAD92462D238D82F65C0
SHA-512:	3182316DEF1F09FF45C87BF6A099EF4C4D0AFA0CFF073C54AB59159E79E096ADCA0C4912B1851DE42E5EE0FC5B6C4163FCCB833A4CCE8F2AA42079D0C11D0D7A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.F..F..F.......F...G...F...C...F...B...F...E..F.8.G...F...G...F...G...F..G...F.8.O..F.8.F..F.8.D..F.Rich.F.................PE..d...w..g.........." .....,...........(....................................................`..........................................Q..T....Q..........d....p..,....................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata..,....p.......R..............@..@.rsrc...d............X..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\_cffi.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	650752
Entropy (8bit):	6.407907101203656
Encrypted:	false
SSDEEP:	6144:Oz5QLUL4lK9bQkMZ/jZMaBHX7vu3XSAU128zkpWCucchvkf8HpbUPAKjgCX3oRx:Ozb4lK9ckWBHXKSA584ENcyv6sUPAKg
MD5:	0C4037C8EE7D926265B6AC499C323599
SHA1:	B2F5B324449814C25E7262E2B7598B2596AD34B8
SHA-256:	5134A34833CDCDC64546BEB50AABFC09496F457FFB76F6ECDE01E8D9D30BC177
SHA-512:	99C5CBA330D1266D46F51348CD1D08920385E42A41ED9BA53AACB5E39C9297B7153BB0F66EAC157D1869877D718BF24486E78033A2F2218E7891E415FE9EC2FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F...........1....r....I......r.....r.....r.....u......J..u.....u.....u]....u....Rich..........PE..d....'.f.........." ...(.....\......P........................................0............`.........................................0...\........................3........... .......d..............................Pc..@...............@............................text...x........................... ..`.rdata..b...........................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79762\zstandard\backend_c.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	520192
Entropy (8bit):	6.408267868238645
Encrypted:	false
SSDEEP:	12288:AL1TGmvt0Vwyow0k1rErgw25rDjEA0Z7k45sWOC:A5lvt0Vw9fk1rErV25rE57k
MD5:	23266E25821CE9E162F050DB8B81C6F9
SHA1:	FD1049338E304D7688562991091D59C310999B23
SHA-256:	0B494D168A67F2EB2D75593714A4DB65FE0F000B66388AB3C721A67515A2FEFC
SHA-512:	E118531A6BF5354BF082D4CEAAF5247FEA3305A9ADD399ECBBE08AB083D39AB760F3CA28A0DD2B4D5D8400F3E88EC3DECD696E3987FB9F2264A5B8B16F66A61B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................k...........k.....k.....k.....l......T..l.....l.....ln....l....Rich..................PE..d....'.f.........." ...(............ ........................................0............`......................................... ...d........................)........... ..d...0\...............................Z..@...............(............................text...H........................... ..`.rdata.............................@..@.data....-.......(..................@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..d.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gen_py\3.13\init.py

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:	3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\gen_py\3.13\dicts.dat

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	data
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.7219280948873625
Encrypted:	false
SSDEEP:	3:qW6:qW6
MD5:	2C7344F3031A5107275CE84AED227411
SHA1:	68ACAD72A154CBE8B2D597655FF84FD31D57C43B
SHA-256:	83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
SHA-512:	F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
Malicious:	false
Preview:	..K....}..

C:\Users\user\Desktop\errors.log

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	778
Entropy (8bit):	5.516961503328842
Encrypted:	false
SSDEEP:	12:5vIMN0CNrrhvEAQHj9LgYMd7mtY9tPc+KxkWIMN0CNrrhvEAQHj9LgYMd7mtY9tB:5vIQXhcdG7/kKWIQXhcdG7/kU
MD5:	CECAF5EA2737B33CFDB51FFFF439C952
SHA1:	3C8894BB04A37C431683D7FA2F6FEA5C71CAA02A
SHA-256:	3DABC84DDF621C31F88239A595961CED7A92E69F4ABB9717BAAC1BC5A5E0E0B8
SHA-512:	2E455E6FC8B26F8694D70609D505660AA4C446467609231D10E63E1E184500BB2C8443001A0CA26DBE923FAD20EBAA85FBD7CE3E0F327BAF557F53D4DFC69AFB
Malicious:	false
Preview:	2025-01-06 12:01:48,409 - ERROR - Error sending Telegram message: HTTPSConnectionPool(host='api.telegram.org', port=443): Max retries exceeded with url: /bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)')))..2025-01-06 12:01:49,168 - ERROR - Error sending Telegram message: HTTPSConnectionPool(host='api.telegram.org', port=443): Max retries exceeded with url: /bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)')))..

C:\Windows\System32\errors.log

Download File

Process:	C:\Users\user\Desktop\user.exe
File Type:	ASCII text, with very long lines (387), with CRLF line terminators
Category:	dropped
Size (bytes):	778
Entropy (8bit):	5.515876302847998
Encrypted:	false
SSDEEP:	12:DJJGIMN0CNrrhvEAQHj9LgYMd7mtY9tPc+KxCOWIMN0CNrrhvEAQHj9LgYMd7mt+:DLGIQXhcdG7/kZWIQXhcdG7/kU
MD5:	3029AC7700C64C8D41C8D0E4BC819DD7
SHA1:	42E57AF5EBF26AB18D9C0E4DDFE31BCCAE10F8E3
SHA-256:	530B0D71C0EBA75923C1021BC5991D725B2FB3EE0404921446F4DAEC6B4E04E4
SHA-512:	1E521D6B7F944F90363DF3C8B8865A680BC92A360D1FF182D8CD4096901412601F16C41A881586ADE6C99F514560A6CE87291A0E3C4B168022820BD672CC91F8
Malicious:	false
Preview:	2025-01-06 12:02:07,439 - ERROR - Error sending Telegram message: HTTPSConnectionPool(host='api.telegram.org', port=443): Max retries exceeded with url: /bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)')))..2025-01-06 12:02:08,112 - ERROR - Error sending Telegram message: HTTPSConnectionPool(host='api.telegram.org', port=443): Max retries exceeded with url: /bot8198088572:AAHuCRMqYLAInPh6sc5IXCxLBzQUYapjKZ8/sendMessage (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)')))..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.994589178330262
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	user.exe
File size:	16'756'993 bytes
MD5:	5cc8a6ec6d6fc9d98ef59c905274e4c3
SHA1:	bbd7891793055343f045807124138701beb2937c
SHA256:	c330b29ffa94084d183e23e4ed0bbbd864e51523ab9df30a09b78078fc5cfc00
SHA512:	6736892be97e5103327a2f1dbf0cbeb191500e3c9b50cc0471fbbb83f473bdc68c14af45e8926922d32e740f5d9005ab45b4f0034a70d6ea6db78d46bb173dfa
SSDEEP:	393216:kVlj87d5Io/Fa63huceXMCHWUjvcuIF//PGMhyCa:kVl8Zzr3hreXMb8k1//3Ra
TLSH:	5EF6331666D81F6ED7A381B498A0934DE415BF9F16B3C56AC2A47E123D631C04CBFCB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d..

File Icon


Icon Hash:	0f33a9cdcdc96317

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67704D3B [Sat Dec 28 19:10:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC040BFDA2Ch
dec eax
add esp, 28h
jmp 00007FC040BFD64Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FC040BFDDF8h
test eax, eax
je 00007FC040BFD7F3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FC040BFD7D7h
dec eax
cmp ecx, eax
je 00007FC040BFD7E6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FC040BFD7C0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FC040BFD7C9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FC040BFD7D9h
mov byte ptr [00035765h], 00000001h
call 00007FC040BFCF25h
call 00007FC040BFE210h
test al, al
jne 00007FC040BFD7D6h
xor al, al
jmp 00007FC040BFD7E6h
call 00007FC040C0AD2Fh
test al, al
jne 00007FC040BFD7DBh
xor ecx, ecx
call 00007FC040BFE220h
jmp 00007FC040BFD7BCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FC040BFD839h
cmp ecx, 01h
jnbe 00007FC040BFD83Ch
call 00007FC040BFDD6Eh
test eax, eax
je 00007FC040BFD7FAh
test ebx, ebx
jne 00007FC040BFD7F6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FC040C0AB22h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x10e34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x58000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	2a7ae207b6295492e9da088072661752	False	0.5514439174107143	data	6.487454925709845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	9aa040933eae140a6bffbe5019b25316	False	0.5244661458333333	data	5.752622892794091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	f5559f14427a02f0a5dbd0dd026cae54	False	0.470703125	data	5.291665041994019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x10e34	0x11000	e963a5ba5d34917c3f18755597b3b01e	False	0.13597196691176472	data	4.022502943941432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x58000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x470e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	0.12723293505264402
RT_GROUP_ICON	0x57910	0x14	data	1.15
RT_MANIFEST	0x57924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 16:02:12.203779936 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.203813076 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.203887939 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.205046892 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.205058098 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.831927061 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.832801104 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.832820892 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.834217072 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.834295988 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.835732937 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.835917950 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.835918903 CET	443	49782	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.835999966 CET	49782	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.968049049 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.968075037 CET	443	49789	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:12.968153954 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.968622923 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:12.968636990 CET	443	49789	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:13.569895029 CET	443	49789	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:13.591777086 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:13.591803074 CET	443	49789	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:13.593348980 CET	443	49789	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:13.593425989 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:13.594516039 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:13.594629049 CET	49789	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.235745907 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.235794067 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.235865116 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.236892939 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.236908913 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.856201887 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.857127905 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.857141018 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.858213902 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.858385086 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.860027075 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.860162973 CET	443	49903	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.860377073 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.860377073 CET	49903	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.866811991 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.866842985 CET	443	49908	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:31.866920948 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.867377043 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:31.867391109 CET	443	49908	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:32.509147882 CET	443	49908	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:32.512417078 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:32.512434006 CET	443	49908	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:32.513459921 CET	443	49908	149.154.167.220	192.168.2.9
Jan 6, 2025 16:02:32.513520956 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:32.533605099 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:32.533801079 CET	49908	443	192.168.2.9	149.154.167.220
Jan 6, 2025 16:02:50.442365885 CET	56077	53	192.168.2.9	162.159.36.2
Jan 6, 2025 16:02:50.447215080 CET	53	56077	162.159.36.2	192.168.2.9
Jan 6, 2025 16:02:50.447290897 CET	56077	53	192.168.2.9	162.159.36.2
Jan 6, 2025 16:02:50.452105045 CET	53	56077	162.159.36.2	192.168.2.9
Jan 6, 2025 16:02:50.916594982 CET	56077	53	192.168.2.9	162.159.36.2
Jan 6, 2025 16:02:50.921519995 CET	53	56077	162.159.36.2	192.168.2.9
Jan 6, 2025 16:02:50.921590090 CET	56077	53	192.168.2.9	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 16:02:12.181469917 CET	51470	53	192.168.2.9	1.1.1.1
Jan 6, 2025 16:02:12.188179970 CET	53	51470	1.1.1.1	192.168.2.9
Jan 6, 2025 16:02:50.441827059 CET	53	62653	162.159.36.2	192.168.2.9
Jan 6, 2025 16:02:50.976677895 CET	53	61959	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 16:02:12.181469917 CET	192.168.2.9	1.1.1.1	0xe0f4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 16:02:12.188179970 CET	1.1.1.1	192.168.2.9	0xe0f4	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	10:02:05
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe"
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:02:07
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe"
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:02:13
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7bd430000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:02:13
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\user.exe
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:02:13
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:02:16
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\user.exe
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:02:20
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:02:26
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\user.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\user.exe" C:\Users\user\Desktop\user.exe
Imagebase:	0x7ff653f00000
File size:	16'756'993 bytes
MD5 hash:	5CC8A6EC6D6FC9D98EF59C905274E4C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00007FF653F089E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF653F045F4,00000000,00007FF653F01985), ref: 00007FF653F093C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08A56

Part of subcall function 00007FF653F1A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1A490

Part of subcall function 00007FF653F1871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F18783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08AE6
CreateProcessW.KERNELBASE ref: 00007FF653F08B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08B28

Part of subcall function 00007FF653F02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02C9E
Part of subcall function 00007FF653F02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02D63
Part of subcall function 00007FF653F02C50: MessageBoxW.USER32 ref: 00007FF653F02D99

RegisterClassW.USER32 ref: 00007FF653F08B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08B8B
CreateWindowExW.USER32 ref: 00007FF653F08BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08C15
PeekMessageW.USER32 ref: 00007FF653F08C39
TranslateMessage.USER32 ref: 00007FF653F08C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08C51
PeekMessageW.USER32 ref: 00007FF653F08C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08E04
GetExitCodeProcess.KERNEL32 ref: 00007FF653F08E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF653F03F7F), ref: 00007FF653F08E2F

Strings

CreateProcessW, xrefs: 00007FF653F08B37
Failed to create child process!, xrefs: 00007FF653F08B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF653F08B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF653F08B95

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: e0df15e2182edd67daaad9127b5eaf3b087da786bd6eef1743b974300e1895fb
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 2DD16232A18A82C6EB108F78EC566A93762FF44F58F484235EE5EB36A5DF3CD5458700

Function 00007FF653F01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-disable-windowed-traceback, xrefs: 00007FF653F03BB2
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF653F03EBB
Could not create temporary directory!, xrefs: 00007FF653F03CBF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF653F03971
VCRUNTIME140.dll, xrefs: 00007FF653F03DB1
Failed to start splash screen!, xrefs: 00007FF653F03ED4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF653F03C61
pyi-contents-directory, xrefs: 00007FF653F03B8D
pyi-python-flag, xrefs: 00007FF653F03AD6
Failed to load splash screen resources!, xrefs: 00007FF653F03E85
_PYI_SPLASH_IPC, xrefs: 00007FF653F03A23, 00007FF653F03EF5
Failed to remove temporary directory: %s, xrefs: 00007FF653F03FCF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF653F03E0A
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF653F03BE8
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF653F03A17, 00007FF653F03A2F, 00007FF653F03A9B
MEI, xrefs: 00007FF653F03933
pkg, xrefs: 00007FF653F039BE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF653F03EA6
_PYI_ARCHIVE_FILE, xrefs: 00007FF653F038D2, 00007FF653F039FF
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF653F03D35
pyi-runtime-tmpdir, xrefs: 00007FF653F03B68
Py_GIL_DISABLED, xrefs: 00007FF653F03AF4
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF653F03882, 00007FF653F038AF
Failed to convert DLL search path!, xrefs: 00007FF653F03DDC
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF653F03D12
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF653F03B32
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF653F039DE
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF653F03A0B, 00007FF653F03CD4, 00007FF653F03F6B

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction ID: 6f1148d2599242c5b2dfd5bd3867833bb3dda389e09b1707573d3dbd7b3c30f2
Opcode Fuzzy Hash: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction Fuzzy Hash: 59327121A2C68291FB15DB69D9573B966A3AF44F44F8C4032DA5EF32D6EF2CE558C300

Function 00007FF653F25C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF653F25C45

Part of subcall function 00007FF653F25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F255AC

Part of subcall function 00007FF653F1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A95E
Part of subcall function 00007FF653F1A948: GetLastError.KERNEL32(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A968

Part of subcall function 00007FF653F1A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF653F1A8DF,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1A909
Part of subcall function 00007FF653F1A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF653F1A8DF,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1A92E

_get_daylight.LIBCMT ref: 00007FF653F25C34

Part of subcall function 00007FF653F255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F2560C

_get_daylight.LIBCMT ref: 00007FF653F25EAA
_get_daylight.LIBCMT ref: 00007FF653F25EBB
_get_daylight.LIBCMT ref: 00007FF653F25ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF653F2610C), ref: 00007FF653F25EF3

Strings

Eastern Standard Time, xrefs: 00007FF653F25F99
Eastern Summer Time, xrefs: 00007FF653F25FB1

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: b8c3a5181aa7a1fc45ef6f25496bc13374628244f10c2d7fd819711766e18795
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 78D1C322A2868286EB20DF21DE431B9A353EF84F94F488136FA4DF7695DF3CE4418740

Function 00007FF653F26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F266D9
Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F26757
Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F267A8

CreateFileW.KERNELBASE ref: 00007FF653F26A6A
CreateFileW.KERNEL32 ref: 00007FF653F26ABA
GetLastError.KERNEL32 ref: 00007FF653F26AEA
GetFileType.KERNELBASE ref: 00007FF653F26AFF
GetLastError.KERNEL32 ref: 00007FF653F26B09
CloseHandle.KERNEL32 ref: 00007FF653F26B3C
CloseHandle.KERNEL32 ref: 00007FF653F26C9F
CreateFileW.KERNEL32 ref: 00007FF653F26CD4
GetLastError.KERNEL32 ref: 00007FF653F26CE3

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c0df3d7ab4698e2bc700680b1ac1df8c4526abcf32db50eed6dd3cc41c0dc4ea
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 0EC1A036B28A86C5EB10CFA5D9926AC3762F749F98B094235EE1EB7794CF38D451C700

Function 00007FF653F25E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF653F25EAA

Part of subcall function 00007FF653F255F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F2560C

_get_daylight.LIBCMT ref: 00007FF653F25EBB

Part of subcall function 00007FF653F25598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F255AC

_get_daylight.LIBCMT ref: 00007FF653F25ECC

Part of subcall function 00007FF653F255C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F255DC

Part of subcall function 00007FF653F1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A95E
Part of subcall function 00007FF653F1A948: GetLastError.KERNEL32(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF653F2610C), ref: 00007FF653F25EF3

Strings

Eastern Standard Time, xrefs: 00007FF653F25F99
Eastern Summer Time, xrefs: 00007FF653F25FB1

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 032884434e37cbf4095f153d11afda82c2c05f28516cdcb95b20ec81aa652d17
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 40516032A2868286E710DF61EE835B9A763BB48F84F484136EA4DF7695DF3CE4518740

Function 00007FF653F09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF653F092B3
FindClose.KERNELBASE ref: 00007FF653F092C2

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 25c36eecb776269812dfb5f67d1a7147d46a34bf3760cb8077b9a7a8e6296dde
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 63F0CD22A2C74187F7A08B54B8967667351AB44B24F080335D96E736D4DF3CD058CA00

Function 00007FF653F01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F07F90: _fread_nolock.LIBCMT ref: 00007FF653F0803A

_fread_nolock.LIBCMT ref: 00007FF653F01A1B

Part of subcall function 00007FF653F02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF653F01B6A), ref: 00007FF653F0295E

Strings

MEI, xrefs: 00007FF653F01991
fseek, xrefs: 00007FF653F019F5
calloc, xrefs: 00007FF653F01A68
Could not allocate buffer for TOC!, xrefs: 00007FF653F01B1B
malloc, xrefs: 00007FF653F01B22
fread, xrefs: 00007FF653F01A32, 00007FF653F01B5C
Error on file., xrefs: 00007FF653F01B8D
Could not read full TOC!, xrefs: 00007FF653F01B55
Could not allocate memory for archive structure!, xrefs: 00007FF653F01A61
Failed to seek to cookie position!, xrefs: 00007FF653F019EE
Failed to read cookie!, xrefs: 00007FF653F01A2B

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction ID: 029d99e68dd487bbcfacb5923a1cb7f62739487c84acfd97c446f2610257d53b
Opcode Fuzzy Hash: e060d84aa5bf36d8a380aea433863807716a2bfcfbbc2a242715e1548c9dcf31
Instruction Fuzzy Hash: 8A819475A2868686EB20DB18E5436F933A2EF84F44F488435ED8EF7785DE3CE5458740

Function 00007FF653F01600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF653F017DF
fseek, xrefs: 00007FF653F016E1
Failed to extract %s: failed to open target file!, xrefs: 00007FF653F0165C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF653F016DA
malloc, xrefs: 00007FF653F01749
fread, xrefs: 00007FF653F017E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF653F016A2
fopen, xrefs: 00007FF653F01663
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF653F017CA
fwrite, xrefs: 00007FF653F017D1
Failed to create symbolic link %s!, xrefs: 00007FF653F01622
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF653F01742

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: cb3c2a77d8d213a9a8c367c96bf5f808a4f883a2ce5e30ac5d600dd79daf51e0
Instruction ID: 54686896bca15203c323a29cbf6e130f4815362373c58e9174ca6b5e392f0c2e
Opcode Fuzzy Hash: cb3c2a77d8d213a9a8c367c96bf5f808a4f883a2ce5e30ac5d600dd79daf51e0
Instruction Fuzzy Hash: D251DF65B2864792EA109B19E9421B923A2BF80F94F8C4531EE4EF77D2DE3CF955C300

Function 00007FF653F08660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF653F03CBB), ref: 00007FF653F08704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF653F03CBB), ref: 00007FF653F0870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF653F03CBB), ref: 00007FF653F0874C

Part of subcall function 00007FF653F08830: GetEnvironmentVariableW.KERNEL32(00007FF653F0388E), ref: 00007FF653F08867
Part of subcall function 00007FF653F08830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF653F08889

Part of subcall function 00007FF653F18238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F18251

Part of subcall function 00007FF653F02810: MessageBoxW.USER32 ref: 00007FF653F028EA

Strings

LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF653F0877E
TMP, xrefs: 00007FF653F0869C, 00007FF653F087A3
_MEI%d, xrefs: 00007FF653F08712
LOADER: failed to set the TMP environment variable., xrefs: 00007FF653F086DC
TMP, xrefs: 00007FF653F086C2

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 3bb40402b9a6cf051be10737ba0a3b9f5044b09df7a104b7d13abaeff9da0c1e
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 71417161A3968284EA15A769FA572B91293AF84FC0F4C4131ED0EF77DADE3CE505C700

Function 00007FF653F01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF653F012BA
malloc, xrefs: 00007FF653F012C1, 00007FF653F012F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF653F0141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF653F012EF
1.3.1, xrefs: 00007FF653F01249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF653F01276

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction ID: 101883517acd0e3675cfaf44fbdc243f9aff0ce228241cdac421b969071278d0
Opcode Fuzzy Hash: c68ada16c8054f5beab9184a2d33c9fb43cd0d4882f5edf9030f6e60bcef94b6
Instruction Fuzzy Hash: F2512866A2868281EA209B19E8423BA6293FF85F94F4C4131ED4EF77D5EF3CE445C700

Function 00007FF653F036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF653F03804), ref: 00007FF653F036E1
GetLastError.KERNEL32(?,00007FF653F03804), ref: 00007FF653F036EB

Part of subcall function 00007FF653F02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02C9E
Part of subcall function 00007FF653F02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02D63
Part of subcall function 00007FF653F02C50: MessageBoxW.USER32 ref: 00007FF653F02D99

Strings

GetModuleFileNameW, xrefs: 00007FF653F036FA
\\?\, xrefs: 00007FF653F0375A
Failed to resolve full path to executable %ls., xrefs: 00007FF653F03739
Failed to obtain executable path., xrefs: 00007FF653F036F3
Failed to convert executable path to UTF-8., xrefs: 00007FF653F03790

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 7c9025d879be53a4a17c58ea6e91d9bad98bb5d8c12ec42be0f2074c83987bdc
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 8A218361B3C68291FA20D728ED523BA6292BF88B54F484132E65FF75E5EE2CE504C740

Function 00007FF653F1BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1BE89

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction ID: 8d8e2ca3f0ded474f2a51296c36356b5f9816522e6992a25c36b39252dae521c
Opcode Fuzzy Hash: 1c0df5e74df0118619baac061aee596465bcef498cfc928fc9eaa168a483e3b3
Instruction Fuzzy Hash: F4C1DFB2A2C686D1E6648B15E4422BE3B62FBC1F90F5D4131EA4EB3791CF7DE8558700

Function 00007FF653F08570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF653F08590
OpenProcessToken.ADVAPI32 ref: 00007FF653F085A3
GetTokenInformation.KERNELBASE ref: 00007FF653F085C8
GetLastError.KERNEL32 ref: 00007FF653F085D2
GetTokenInformation.KERNELBASE ref: 00007FF653F08612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF653F0862E
CloseHandle.KERNEL32 ref: 00007FF653F08646

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: 342020a6bae985eb40ed4f7f70bbbdf93a058ad1664e8a1e7a217e83e2cdf19f
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: B0217931A1C64681EB118B59F94563EA3A2FF85BA0F580235EA6EB37E4DF7CD8458700

Function 00007FF653F090E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F08570: GetCurrentProcess.KERNEL32 ref: 00007FF653F08590
Part of subcall function 00007FF653F08570: OpenProcessToken.ADVAPI32 ref: 00007FF653F085A3
Part of subcall function 00007FF653F08570: GetTokenInformation.KERNELBASE ref: 00007FF653F085C8
Part of subcall function 00007FF653F08570: GetLastError.KERNEL32 ref: 00007FF653F085D2
Part of subcall function 00007FF653F08570: GetTokenInformation.KERNELBASE ref: 00007FF653F08612
Part of subcall function 00007FF653F08570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF653F0862E
Part of subcall function 00007FF653F08570: CloseHandle.KERNEL32 ref: 00007FF653F08646

LocalFree.KERNEL32(?,00007FF653F03C55), ref: 00007FF653F0916C
LocalFree.KERNEL32(?,00007FF653F03C55), ref: 00007FF653F09175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF653F09157
S-1-3-4, xrefs: 00007FF653F09121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF653F09142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF653F09183

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 926ec5a28e1c1e99cc991b9a05b63ef44c6c4babfe77d59830102ce5115235aa
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: B1212321A2878192F6109B54E9167FA62A6FF84B80F484035FA4EB7796DF3CD9458740

Function 00007FF653F07E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF653F0352C,?,00000000,00007FF653F03F23), ref: 00007FF653F07F32

Strings

\, xrefs: 00007FF653F07E97
%.*s, xrefs: 00007FF653F07EEB
%s%c, xrefs: 00007FF653F07EA4

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 5ed3189e24336b978d3e0cc17401057f4e80ad0d8e4ac40fdcb6e33bf2195972
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 0831E621629AC145EA218B24E8527EA6356EF84FE0F480230FE6EF77C9DF3CD6458740

Function 00007FF653F1CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF653F1CF4B), ref: 00007FF653F1D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF653F1CF4B), ref: 00007FF653F1D107

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: b2ffe93d641d3b2e965c9e99091d8a653f275f733f871018263747ea3d3b4857
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 5C91B6B2F28A5195F7509F65E8422BD2BB2BB44F88F184139EE0EB7695DF38D442C700

Function 00007FF653F1F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF653F1FA7C
_get_daylight.LIBCMT ref: 00007FF653F1FA8D
_get_daylight.LIBCMT ref: 00007FF653F1FA9E
_isindst.LIBCMT ref: 00007FF653F1FB69

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: e1404727a0156260331156e7994cac0e49cabb1e743f1b4856e712aa6e547bff
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 9951E8B2F242129AEB14CF64E9566BD2766AB44B68F580335DD1DB3BE5DF3CE4028600

Function 00007FF653F1577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF653F157AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF653F15811
GetLastError.KERNEL32 ref: 00007FF653F158A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF653F156B4), ref: 00007FF653F158EE

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 5f966285e5aa51676735893002b4c63cc91456067e2c2f85419d7d29811f0302
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: DE518CB2E286458AFB14CFB1E5523BD27B2AB48F68F184435DE0DBB688DF78D4408700

Function 00007FF653F15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F15655
CreateFileW.KERNELBASE ref: 00007FF653F15694
CloseHandle.KERNEL32 ref: 00007FF653F156C9

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: d109240ed295eec31f2791edf69e3a9853b065d7dfd2f001f253aecc1c0b7376
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 4841A4B2D3878283E7148B20E5123797261FB94BA4F148335EA9C63AD1DF7CE4E08740

Function 00007FF653F0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF653F0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF653F0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF653F0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF653F0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF653F0CD21

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: b704c9a3671d367279017fa028cb42cf0648f3a74309811f7e3e3c77ad31361d
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: A0313C25E2914781FA14AB69E9533BA16C39F41F88F4C5034E95FFB2D7DE2CF9048281

Function 00007FF653F1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10277

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 4bfa3a8946d0c955afd483b899b88bb92e27290810ed1a801af087e63324fd86
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 98510BB1B2928386FB649A26E40267A6693BF84FA4F1C4735ED7DB77D5CE3CD4018600

Function 00007FF653F1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF653F1C2CD), ref: 00007FF653F1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF653F1C2CD), ref: 00007FF653F1C18A

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 823fe7ce4ec10ae09a58a95c9b71f79767512926ac736367d5f1e1dcc399faec
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 341104B2A28A8181DA608B25F8110696362AB41FF4F580331EEBDB77E9CE7CD4108700

Function 00007FF653F15924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF653F15839), ref: 00007FF653F15957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF653F15839), ref: 00007FF653F1596D

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: 3b2a067cb0326e78c920f3c5e5abe80a56b1718e6a163d2317995e26d00d50b3
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 5511C1B261C74282EB108B04F41243AB7A2FB84B71F940236FA9DE29D8EF6CD414CB00

Function 00007FF653F1A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A95E
GetLastError.KERNEL32(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A968

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 034ebd3ce6d5820c75d39ee0e1bbe993827256da2605abae38421e775d740840
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: F0E04FA0E2924282FE155BF2A84713812535F84F40F4C0030D80DF32A1DE2CE8918710

Function 00007FF653F1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF653F1A9D5,?,?,00000000,00007FF653F1AA8A), ref: 00007FF653F1ABC6
GetLastError.KERNEL32(?,?,?,00007FF653F1A9D5,?,?,00000000,00007FF653F1AA8A), ref: 00007FF653F1ABD0

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 94550033bc6b0540cfba2566c8ce62b84250361bb12b75558da3388e6ead4e20
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 7E216FB1B3878241EEA597A5F59227A16939F84FA4F0C4239EA2EF77D1CE6CE4414310

Function 00007FF653F1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1BED4

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: d150eacb5ea3484084e236b680b552bf3ce24a9003247ae6d8707ca38795b510
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 3041D672928245C7EA349B99F54227973A2EB95F91F180131D68EF36D1CF2CE802DB51

Function 00007FF653F07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF653F0803A

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 92d29e443cb0c06cef3e21f718b83060998d20949f4fd0e1cf3ffbb0f0d41c49
Instruction ID: 4e28151d87e3ad88121e8f35d686c8ca4d698455f3a1798c91082761c69b3219
Opcode Fuzzy Hash: 92d29e443cb0c06cef3e21f718b83060998d20949f4fd0e1cf3ffbb0f0d41c49
Instruction Fuzzy Hash: AE21D621B2879246FA119A26BA063FA9652BF45FD4F8C4430EE4EB7786CE7DE041C300

Function 00007FF653F1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1B9C2

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 592ac17fe1b118f7583fd9ae5d37af1e7b7b359723c94ae59786525fd8c1c559
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 193150B2A3861285E6115B55E44237C2AA2AFC0FA4F890135E95DB73D2CF7CE8528711

Function 00007FF653F15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F15EF9

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d1fcebdb9db8a72b157d3af17a6c033c196c74a93570645305f170760865c1a6
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 2F1163B1A3C64181EA609F11F40217DA266BF85F84F4C4431EA4CF7B96CF7DD4109710

Function 00007FF653F26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F26377

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 8febc2df9162f2e693ba1f5cad775494dad32bba61baa145e95e42b7a7656f67
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F421D772628A81C6EB618F18E94177976A2FB84F54F184234FA9DE77D9DF7CD8018B00

Function 00007FF653F103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10410

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 65b6a90bd5481facd2b20c52bae4deeee30543804b42c0832896245a9005e014
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 960188B1A2874681E904DF52E942579A696BF85FE0F4C4631EE5CB7BD6CE3CE4119300

Function 00007FF653F1EB98 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF653F1B32A,?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A), ref: 00007FF653F1EBED

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction ID: 6cc997445a990d2deb3c328bfff76370def5e4f11623489ad249225b1fee613f
Opcode Fuzzy Hash: 0190c006dd090f1dc8136ef035d08a675b61e1fdbed98732a32380f018d60316
Instruction Fuzzy Hash: 17F06DB4B2A24381FE5996A5E9532B612935FA8F80F4C4530DD0FF73C1EE1CE4808210

Function 00007FF653F1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF653F10C90,?,?,?,00007FF653F122FA,?,?,?,?,?,00007FF653F13AE9), ref: 00007FF653F1D63A

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 96cde7c94b1af91993bee0578af45a171717d17f6710c11b98fa48e2ec77c821
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 5DF0F8A0F39A4785FE6567B1A94367522A65FD4FA0F0C0730ED2EF72C2DE2CE4909650

Non-executed Functions

Function 00007FF653F05830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F05840
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F05852
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F05889
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0589B
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F058B4
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F058C6
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F058DF
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F058F1
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0590D
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0591F
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0593B
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0594D
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F05969
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F0597B
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F05997
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F059A9
GetProcAddress.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F059C5
GetLastError.KERNEL32(?,00007FF653F064CF,?,00007FF653F0336E), ref: 00007FF653F059D7

Strings

PyObject_CallFunctionObjArgs, xrefs: 00007FF653F05D25, 00007FF653F05D47
PyConfig_Read, xrefs: 00007FF653F059E9, 00007FF653F05A0B
PyObject_CallFunction, xrefs: 00007FF653F05CF7, 00007FF653F05D19
PyStatus_Exception, xrefs: 00007FF653F05E39, 00007FF653F05E5B
Py_InitializeFromConfig, xrefs: 00007FF653F05903, 00007FF653F05925
PyErr_Restore, xrefs: 00007FF653F05B87, 00007FF653F05BA9
PyErr_NormalizeException, xrefs: 00007FF653F05AFD, 00007FF653F05B1F
PyImport_AddModule, xrefs: 00007FF653F05BE3, 00007FF653F05C05
PyEval_EvalCode, xrefs: 00007FF653F05BB5, 00007FF653F05BD7
PyRun_SimpleStringFlags, xrefs: 00007FF653F05E0B, 00007FF653F05E2D
Py_DecodeLocale, xrefs: 00007FF653F0587F, 00007FF653F058A1
PyMarshal_ReadObjectFromString, xrefs: 00007FF653F05C6D, 00007FF653F05C8F
PySys_SetObject, xrefs: 00007FF653F05E95, 00007FF653F05EB7
PySys_GetObject, xrefs: 00007FF653F05E67, 00007FF653F05E89
PyUnicode_Decode, xrefs: 00007FF653F05EF1, 00007FF653F05F13
PyErr_Print, xrefs: 00007FF653F05B59, 00007FF653F05B7B
PyUnicode_Replace, xrefs: 00007FF653F05FD7, 00007FF653F05FF9
PyMem_RawFree, xrefs: 00007FF653F05C9B, 00007FF653F05CBD
PyErr_Fetch, xrefs: 00007FF653F05ACF, 00007FF653F05AF1
Py_PreInitialize, xrefs: 00007FF653F0595F, 00007FF653F05981
PyErr_Occurred, xrefs: 00007FF653F05B2B, 00007FF653F05B4D
PyConfig_SetBytesString, xrefs: 00007FF653F05A17, 00007FF653F05A39
Py_DecRef, xrefs: 00007FF653F05836, 00007FF653F05858
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF653F05DDD, 00007FF653F05DFF
Failed to get address for %hs, xrefs: 00007FF653F05861
GetProcAddress, xrefs: 00007FF653F05868
Py_IsInitialized, xrefs: 00007FF653F05931, 00007FF653F05953
PyObject_Str, xrefs: 00007FF653F05DAF, 00007FF653F05DD1
PyObject_SetAttrString, xrefs: 00007FF653F05D81, 00007FF653F05DA3
PyImport_ImportModule, xrefs: 00007FF653F05C3F, 00007FF653F05C61
PyConfig_InitIsolatedConfig, xrefs: 00007FF653F059BB, 00007FF653F059DD
PyUnicode_DecodeFSDefault, xrefs: 00007FF653F05F1F, 00007FF653F05F41
PyUnicode_FromString, xrefs: 00007FF653F05F7B, 00007FF653F05F9D
Py_ExitStatusException, xrefs: 00007FF653F058AA, 00007FF653F058CC
PyUnicode_AsUTF8, xrefs: 00007FF653F05EC3, 00007FF653F05EE5
Py_Finalize, xrefs: 00007FF653F058D5, 00007FF653F058F7
PyConfig_SetString, xrefs: 00007FF653F05A45, 00007FF653F05A67
PyModule_GetDict, xrefs: 00007FF653F05CC9, 00007FF653F05CEB
PyObject_GetAttrString, xrefs: 00007FF653F05D53, 00007FF653F05D75
PyConfig_Clear, xrefs: 00007FF653F0598D, 00007FF653F059AF
PyErr_Clear, xrefs: 00007FF653F05AA1, 00007FF653F05AC3
PyImport_ExecCodeModule, xrefs: 00007FF653F05C11, 00007FF653F05C33
PyUnicode_FromFormat, xrefs: 00007FF653F05F4D, 00007FF653F05F6F
PyConfig_SetWideStringList, xrefs: 00007FF653F05A73, 00007FF653F05A95
PyUnicode_Join, xrefs: 00007FF653F05FA9, 00007FF653F05FCB

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: ac7406e7f5b4805a2550b345931520fc0cad7ea76268c9298ed41e2a85485fa0
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: 4922B174A2DB8BC1FA15DB59AE525B422A3EF04F49B5C5035E85FB3260EF7CF9488240

Function 00007FF653F240AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF653F240FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F24766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F248DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F24B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F24DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F24FF7
memcpy_s.LIBCPMT ref: 00007FF653F250D2
memcpy_s.LIBCPMT ref: 00007FF653F2517D
memcpy_s.LIBCPMT ref: 00007FF653F2524C

Strings

1#QNAN, xrefs: 00007FF653F24213
1#SNAN, xrefs: 00007FF653F2420A
1#INF, xrefs: 00007FF653F24223
1#IND, xrefs: 00007FF653F241E7

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: a765fa55c530ac06fa6399bc8507bebc237701c4d2145619f01ef33a5c1417ab
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 61B2C672A282D2CBE7258E64DE417FD77A2FB54B44F481135EA0DB7A84DF78E9108B40

Function 00007FF653F083C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F0842B
RemoveDirectoryW.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F084AE
DeleteFileW.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F084CD
FindNextFileW.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F084DB
FindClose.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F084EC
RemoveDirectoryW.KERNEL32(?,00007FF653F08919,00007FF653F03FA5), ref: 00007FF653F084F5

Strings

%s\*, xrefs: 00007FF653F083F2

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 6f6dcca445290742cddbd5a3bad003aa8b18ccf9edb071ddc43dd6f76fe8f581
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: C241A625A2C682C1EA219F68F8465BA6362FB94F54F480232E95FF36D4DF3CE545C700

Function 00007FF653F0ACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

too many length or distance symbols, xrefs: 00007FF653F0AE46
invalid distance too far back, xrefs: 00007FF653F0B670
invalid code lengths set, xrefs: 00007FF653F0AE2D
invalid literal/length code, xrefs: 00007FF653F0B3E2
invalid distances set, xrefs: 00007FF653F0B1A0
invalid code -- missing end-of-block, xrefs: 00007FF653F0B0C6
invalid literal/lengths set, xrefs: 00007FF653F0B133
invalid bit length repeat, xrefs: 00007FF653F0B099
invalid distance code, xrefs: 00007FF653F0B5B4

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction ID: fa9cc17b363bf9e1c684aa43e01aa26a00dd7fb95eda082cb259a5142fbf315a
Opcode Fuzzy Hash: 55880860ec2df9374ed9e05eb7c1f9660e2769407a38999da05ffb99d6c3dc89
Instruction Fuzzy Hash: E352E672A256A687DBA48F18C559B7E3BAAFB44740F094139E64BA7780DF3CD844CB40

Function 00007FF653F0D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF653F0D148
RtlCaptureContext.KERNEL32 ref: 00007FF653F0D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF653F0D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF653F0D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF653F0D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF653F0D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF653F0D24C

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 956884f17823275e8bf1eaf567de5a62329486813081b33568c0cd248aed27b6
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 48313076618B85C6EB608F64EC817EE7365FB84B44F48403AEA4EA7B94DF38D548C710

Function 00007FF653F1A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF653F1A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF653F1A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF653F1A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF653F1A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF653F1A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF653F1A72E

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: 6a9ef02f438326d9fb2d9d074b2a06d7c9e3592caf8c47f0725071d2f06bfa2b
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: AD317336628F8186DB60CF25EC412AE73A5FB88B54F580135EA9DA3B94DF3CD555CB00

Function 00007FF653F21874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F218C0
FindFirstFileExW.KERNEL32 ref: 00007FF653F219CA

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: c24b32601020ae9a25c4d9f08819041d08d20df657d5f39f57badf04ace16b54
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 36B1C762B286D281EE619B22EE021BD6362EB44FE4F495131FD4DB7B95DE3CE441C704

Function 00007FF653F0D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF653F0D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF653F0D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF653F0D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF653F0D066

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 8e3c87826af56130569a2544d33f5d6a7e23b41f78a235c11b35a29ae411607e
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: C7111C26B24B05CAEB008B60ED552B933A4FB59B58F480E31EE6DA77A4DF78D5588340

Function 00007FF653F23C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF653F23C76
memcpy_s.LIBCPMT ref: 00007FF653F23CA1

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 1b989efb3e173a9437a9a46814813bb5d28673a9f5f2310572cf6c9881205e7d
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 94C112B2B286C6C7D724CF55A94466AB792F784F84F488135EB4AA3744CE3DE845CB40

Function 00007FF653F0A474 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF653F0A921
, xrefs: 00007FF653F0A55B
unknown header flags set, xrefs: 00007FF653F0A4C5

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction ID: fd7362db726925936a4bf36b2fd620aea3c0e5467a96bffa1edfc1528bc338e3
Opcode Fuzzy Hash: fcf6ea83c7a46010d3591867e81b0f53761d3f113121264a3729654d2d1b513f
Instruction Fuzzy Hash: 64F18572A253D58BEBA58B18C489B3E3AEAFF44B44F094538DA4AB7390DF38D541C750

Function 00007FF653F29728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF653F29977
RaiseException.KERNEL32 ref: 00007FF653F29988

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 5551de9c5990dbf58db43e28003c30f7aae659221bf49eff20c0fe7a3e9ab793
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 20B13673A10B89CBEB19CF29C9463693BA1F744F48F598921EA5D937A4CF39D461C700

Function 00007FF653F139A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF653F13D54
, xrefs: 00007FF653F13B12

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 0893ca6aee5ba75466059ef311b8ba518b1eb0f46f43c9ccd62b3dafdcbd557b
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 9AE1B2B6E2864685EB68CE69E15213D33A2FF45F48F1C4236DA0EB7794DF29E851C700

Function 00007FF653F0A2DB Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF653F0A442
incorrect header check, xrefs: 00007FF653F0A45B

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction ID: ac8ea8f6e8b6ef8c60546e63d7512b7c05e754a3e38154d11e4b5ff6fccd97ec
Opcode Fuzzy Hash: 7e7bac63e97a7e962ac1d8bc37368dc0e110af78d4507200a91f80e7c7b94e68
Instruction Fuzzy Hash: 09919872A282C587EBA48A18C449B3E3A9AFF44B50F154139DA4BB77D0DF38E940CB40

Function 00007FF653F1DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF653F1E07A
e+000, xrefs: 00007FF653F1DFFD

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 12c9029be2dff6d894bc16598a03bcfd2e7af6e350b6ab9678bafee3c282187f
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 655188B2B286C186E7258E35E8127797B92E754F94F4C8231DB9CA7AD5CE3DD040C700

Function 00007FF653F208C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction ID: 5f7291017a471954a026f3526582d61ff05600405d496922215cdb36456bfd6a
Opcode Fuzzy Hash: 537422541fbed36a77ddee3a41e978a3695e14332b64c7d8d0a2d6c09592a1ae
Instruction Fuzzy Hash: D8027D62A3E68781FA659B11AE1227D2692AF41FA0F8D4634FD5EF73D1DE3CE4418310

Function 00007FF653F1DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF653F1DD9E

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: c4fc58e9d9d387c86a8f5d9ee58202fdf52082119e8f204441c7c6bacd72b4d3
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 8AA147B2B18BC986EB21CF25F4417BA77A2AB51B84F088131EE4DA7785DE3DE401C700

Function 00007FF653F18794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF653F187B3

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction ID: 45650004c9792319094f4413897d7a045ada2a0867bea51da6058a43f4a971df
Opcode Fuzzy Hash: 09cdd7cf7fc9e7e425d724a32e8c9d3bd5c12dba7606eca5b930980d9b4d1239
Instruction Fuzzy Hash: 1251A4A1F2864241FA66AA27FB1317A52926F44FE4F5C4035DD0EF77D6EE7CE4418204

Function 00007FF653F23480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF653F23484

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 24265972913b9576a3fd7887f94769230712f45d57f75bcf90ef5e9403a464c7
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 0CB09220E27B42C2EA092B616D8321822A67F58B00F9C0139C44CB2330DE2C75F55700

Function 00007FF653F135A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: af77d060aaaba4c6cb98326f0cbb5f7afa6401af791b5cac4367925c6b07803f
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: 03D1D2B2E2864285EB688B69E15263D27A2AB45F58F1C0236CE0DB77D5CF39E845C740

Function 00007FF653F09800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: de748a256f3b9a083275edf7ab51e179975b392d19822512f43d128271971178
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 6EC1AE762281E08BD289EB29E86947A73D1F78930DB99406BEF87577C5CB3CE414DB10

Function 00007FF653F12C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: a24a428fbb7dcd9a9a9ca4aac0a6a511f64cccc70e462d9294772f9ffbc59eda
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 80B18DB2A2878595EB688F69E05223C3BA2FB49F48F280135CA4EB7395CF79D441D744

Function 00007FF653F1E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 21763f2ff659e695a368d9ef5f515b8a11c3fef7c12a7d6914ed4cdbb20ff120
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: C78116B2A2878146E774CF19F44237A7A92FB55B94F484235DA9DA3B89DF3DE4408B00

Function 00007FF653F26418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction ID: 45d3884d4428fc2265931508d9df19c27f7f295dc1135700861e4641dd8faca8
Opcode Fuzzy Hash: 403f67b08c5d8b9127b9d27d37b93e2a1e0a746a19683c5483168a42cc689f1f
Instruction Fuzzy Hash: AB61FA72E282D2C6F7648A689D5363D6683AF40F64F1C0239F65DF76D5DEADE8408B00

Function 00007FF653F11D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 3dd43d2e51ccbf3a79e061a0bf75646ee0dbddc161e0e074f8acfc69c82910fd
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 925193B6A2865682E7348B29E04133833A2EB55F68F284131CE4DB77D5CF3AE853C740

Function 00007FF653F11944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 273c253b475fb3351f361beb05cef49f29c255060a727f04dd7fffc4b174dcc0
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 0B5185B6A3865186E7248B29E04133937A2EB44F68F2C4131CE9DB7794DF3AE853C740

Function 00007FF653F12164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: c545d7edfb67b1e4d6e288bbf266a292f587f471905d848571352ab3bda335a4
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 6551B4B6A2865596E7648B69E44123C73A2FB58F68F2C4131CE4CB7794CF3AE843C740

Function 00007FF653F11740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 46b773787873a1ec9d6f9cb622a8dbce207aed9c3d9cf7163182f675e7b33719
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: E05164B7A3865585E7248B29E04123837A2EB45F68F2C8131CE4DB7794CF7AE843C780

Function 00007FF653F11F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 871e902b0430e77d91d677737a5c1ff7689341ab49d5d6a93261e4dee9cb0212
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: A75163B6A2865586E7648B29E04523C37A2EB54F58F284131DE4DB77A5CF3AE843C780

Function 00007FF653F11B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 9341908ecd96565f2008030d4526b173327214c341bfd94560dda45014b65220
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: DB518FB6A38A5186E7248F29E04237937A2EB45F58F2C5131DE4DB7794DF3AE842C740

Function 00007FF653F15D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: f680b1b6124d78e89dcb6f47b244ee94407f3887d805b12d731943d45e65a3c2
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 1D4182F2C2D74A05E9A98918E50A6B436829F22FA0E5C52B8DD9DB73D3CD0DF597C300

Function 00007FF653F19EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction ID: 78819cddb03ac6b3ccdc36f4981357dab9c583a99773befe4f82fd58c051b6a8
Opcode Fuzzy Hash: 1c7003d4bfacf113f63307708dabd17e5ede6cda44dccf6aa27d02a6b9ea0481
Instruction Fuzzy Hash: A341F5B3724A5582EF04CF6AEA156A96392BB48FD0B4D9032EE0DF7B64DE3CC4418740

Function 00007FF653F180E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 32ffe107576c291390ea795e8daf53c340331b737842b738f452666670ac5638
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: 7231C772729B8281E7559F25B94213E76D6AB85FD0F184238EA4EB3BD5DF3CD0118704

Function 00007FF653F29570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: f046303aa4ddd079c8f0322be66c0e870fba697a7f98bb298f5525fbb47346b0
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 45F044727282958BDB988FA9A90363977D1F708780F88903AE589D3A04DE3CD0618F04

Function 00007FF653F0D30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: b3e93f7ce7edf7d35f06d2f4e389fd3c7c448768222c7672ac491fa3e6065a37
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: 7DA0012592C94AD0E6498B14AD920352222BB54B00B880031F40EB20A09E2CE8049240

Function 00007FF653F076C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF653F076D7
GetLastError.KERNEL32 ref: 00007FF653F076E9
GetProcAddress.KERNEL32 ref: 00007FF653F07725
GetLastError.KERNEL32 ref: 00007FF653F07737
GetProcAddress.KERNEL32 ref: 00007FF653F07750
GetLastError.KERNEL32 ref: 00007FF653F07762
GetProcAddress.KERNEL32 ref: 00007FF653F0777B
GetLastError.KERNEL32 ref: 00007FF653F0778D
GetProcAddress.KERNEL32 ref: 00007FF653F077A9
GetLastError.KERNEL32 ref: 00007FF653F077BB
GetProcAddress.KERNEL32 ref: 00007FF653F077D7
GetLastError.KERNEL32 ref: 00007FF653F077E9
GetProcAddress.KERNEL32 ref: 00007FF653F07805
GetLastError.KERNEL32 ref: 00007FF653F07817
GetProcAddress.KERNEL32 ref: 00007FF653F07833
GetLastError.KERNEL32 ref: 00007FF653F07845
GetProcAddress.KERNEL32 ref: 00007FF653F07861
GetLastError.KERNEL32 ref: 00007FF653F07873

Strings

Tcl_JoinThread, xrefs: 00007FF653F07885, 00007FF653F078A7
Tcl_MutexLock, xrefs: 00007FF653F078B3, 00007FF653F078D5
Tcl_ThreadQueueEvent, xrefs: 00007FF653F079C7, 00007FF653F079E9
Tcl_CreateObjCommand, xrefs: 00007FF653F07A7F, 00007FF653F07AA1
Tcl_CreateInterp, xrefs: 00007FF653F0771B, 00007FF653F0773D
Tcl_Init, xrefs: 00007FF653F076D0, 00007FF653F076EF
Tcl_DeleteInterp, xrefs: 00007FF653F077FB, 00007FF653F0781D
Tcl_ConditionNotify, xrefs: 00007FF653F0796B, 00007FF653F0798D
Tcl_ThreadAlert, xrefs: 00007FF653F079F5, 00007FF653F07A17
Tcl_SetVar2Ex, xrefs: 00007FF653F07B37, 00007FF653F07B59
Tcl_NewStringObj, xrefs: 00007FF653F07ADB, 00007FF653F07AFD
Tcl_EvalObjv, xrefs: 00007FF653F07BEF, 00007FF653F07C11
Tcl_NewByteArrayObj, xrefs: 00007FF653F07B09, 00007FF653F07B2B
Tcl_GetObjResult, xrefs: 00007FF653F07B65, 00007FF653F07B87
Tcl_MutexUnlock, xrefs: 00007FF653F078E1, 00007FF653F07903
Tcl_EvalEx, xrefs: 00007FF653F07BC1, 00007FF653F07BE3
Tcl_GetCurrentThread, xrefs: 00007FF653F07857, 00007FF653F07879
Tcl_ConditionFinalize, xrefs: 00007FF653F0793D, 00007FF653F0795F
Tcl_Finalize, xrefs: 00007FF653F0779F, 00007FF653F077C1
Failed to get address for %hs, xrefs: 00007FF653F076F8
GetProcAddress, xrefs: 00007FF653F076FF
Tcl_CreateThread, xrefs: 00007FF653F07829, 00007FF653F0784B
Tcl_EvalFile, xrefs: 00007FF653F07B93, 00007FF653F07BB5
Tcl_DoOneEvent, xrefs: 00007FF653F07771, 00007FF653F07793
Tk_GetNumMainWindows, xrefs: 00007FF653F07CA7, 00007FF653F07CC9
Tcl_FindExecutable, xrefs: 00007FF653F07746, 00007FF653F07768
Tcl_GetVar2, xrefs: 00007FF653F07A23, 00007FF653F07A45
Tcl_Free, xrefs: 00007FF653F07C4B, 00007FF653F07C6D
Tcl_FinalizeThread, xrefs: 00007FF653F077CD, 00007FF653F077EF
Tcl_ConditionWait, xrefs: 00007FF653F07999, 00007FF653F079BB
Tcl_GetString, xrefs: 00007FF653F07AAD, 00007FF653F07ACF
Tcl_Alloc, xrefs: 00007FF653F07C1D, 00007FF653F07C3F
Tcl_SetVar2, xrefs: 00007FF653F07A51, 00007FF653F07A73
Tcl_MutexFinalize, xrefs: 00007FF653F0790F, 00007FF653F07931
Tk_Init, xrefs: 00007FF653F07C79, 00007FF653F07C9B

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: f4c724d4b2733de1ae27d656413df9bdb38ba50ddbe1331814a0c49cf387356d
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 65029624A2DB87D1FA15DB59AE169782363EF04F55B5C1035E86EF3264EF3CF9498200

Function 00007FF653F081D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF653F09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF653F045F4,00000000,00007FF653F01985), ref: 00007FF653F093C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF653F086B7,?,?,00000000,00007FF653F03CBB), ref: 00007FF653F0822C

Part of subcall function 00007FF653F02810: MessageBoxW.USER32 ref: 00007FF653F028EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF653F08373
%.*s, xrefs: 00007FF653F0830C
CreateDirectory, xrefs: 00007FF653F0837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF653F08240
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF653F0829D
\, xrefs: 00007FF653F08261
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF653F08203
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF653F082D9

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 0acaf2aabfc43f91b5a51cc59f05470cc21eb9696bac7008aac95e3b113f32c0
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: D1518A11A3CA8291FA519B29ED536BE6392AF94F80F4C4431EA4FF76D5EE3CE5048740

Function 00007FF653F02180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF653F021AB
SelectObject.GDI32 ref: 00007FF653F021F2
DrawTextW.USER32 ref: 00007FF653F02215
SelectObject.GDI32 ref: 00007FF653F0222B
ReleaseDC.USER32 ref: 00007FF653F0223B
MoveWindow.USER32 ref: 00007FF653F0228B
MoveWindow.USER32 ref: 00007FF653F022CB
MoveWindow.USER32 ref: 00007FF653F0231E
MoveWindow.USER32 ref: 00007FF653F02366

Strings

P%, xrefs: 00007FF653F021FF

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 992acdb7977b7af45d97ed06d82b4e00dea6ef2ef9f7e41db08701cead1773d1
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: EC5119266187A186D6349F26E8581BAB7A2F798B61F044131EFDF93794DF3CE045CB10

Function 00007FF653F080C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF653F080FF
GetWindowLongPtrW.USER32 ref: 00007FF653F0817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF653F08192
GetLastError.KERNEL32 ref: 00007FF653F0819C
SetWindowLongPtrW.USER32 ref: 00007FF653F081B3

Strings

Needs to remove its temporary files., xrefs: 00007FF653F08185

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: f043b7619242788457843869a2a581367632f000524ffbde10ee949c51c9dc00
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 62217621B28A82C2E7528B7AFD451796252EF84F90F5C4131EE2EF33A5DE2CD9518201

Function 00007FF653F16290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F162D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F166C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1695C

Strings

-, xrefs: 00007FF653F16369
p, xrefs: 00007FF653F16385
:, xrefs: 00007FF653F1648C
f, xrefs: 00007FF653F163F5
p, xrefs: 00007FF653F163FD

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: acfc6441fee9de5f9881966aa655447792f1e51bdd7458ad87ae18a52e98c9ff
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 0B1292B2E2C24386FB245A14F15667976A3FB50F50F8C4135EA89B76C4DF7CE5809B10

Function 00007FF653F10FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F11008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F113D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1166F

Strings

f, xrefs: 00007FF653F11255
f, xrefs: 00007FF653F110A0
p, xrefs: 00007FF653F110AD
f, xrefs: 00007FF653F1110A
p, xrefs: 00007FF653F11112

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 9dc5bbd1dca9f6920ef014c9968893ba528da7e6656456f35e7f4a8c0315cb09
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: D11280B2E2C14386FB245A15F05667967A7FB80F50F8C4131D68AB7AC8DF3CE5808B00

Function 00007FF653F01050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF653F011F6
fseek, xrefs: 00007FF653F010D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF653F010CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF653F01108
malloc, xrefs: 00007FF653F0110F
fread, xrefs: 00007FF653F011FD
Failed to extract %s: failed to open archive file!, xrefs: 00007FF653F01098

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3201fc6698c0733d934283fdf0b7fc99b444569cb26fde5c5b53d3a473a789a2
Instruction ID: 09fca9992416a3856ffa2c3fa08bf733d8e7c0bd2bda77cfaf425678c137027f
Opcode Fuzzy Hash: 3201fc6698c0733d934283fdf0b7fc99b444569cb26fde5c5b53d3a473a789a2
Instruction Fuzzy Hash: B241B265B2869282EA04DB16E9026B96397FF44FC4F8C4432ED4EB7796DE3CE5418740

Function 00007FF653F01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF653F015DF
fseek, xrefs: 00007FF653F014E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF653F014DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF653F01518
malloc, xrefs: 00007FF653F0151F
fread, xrefs: 00007FF653F015E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF653F0149F

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: b7d9ed86abc52d5975ef8ae8469ac47edc22ad97562613f38df161424eb54398
Instruction ID: aa7f794fe0d3abc7bcc3e9fb26c8ac8328d9bb5245cb7d0909fb0e5117feb772
Opcode Fuzzy Hash: b7d9ed86abc52d5975ef8ae8469ac47edc22ad97562613f38df161424eb54398
Instruction Fuzzy Hash: 0941B235A2868286EB10DB65E9425B96392FF44F84F4C4432ED4EBBB95DF3CE542C700

Function 00007FF653F0EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF653F0EA65

Part of subcall function 00007FF653F0F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF653F0F9FF
Part of subcall function 00007FF653F0F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF653F0FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF653F0EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF653F0ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF653F0EE98

Strings

csm, xrefs: 00007FF653F0EB60
csm, xrefs: 00007FF653F0EA7F
csm, xrefs: 00007FF653F0EAE6

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 20937ae9240a81b90166a4451ca9bfcdd3715f5439721db0f97a561ed1a21def
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: E9D18272A18B4586EB209F69D4423AD77A1FB55B88F180135EE4EB7796DF3CE184C700

Function 00007FF653F1ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF653F1F0AA,?,?,0000027A3E316BD8,00007FF653F1AD53,?,?,?,00007FF653F1AC4A,?,?,?,00007FF653F15F3E), ref: 00007FF653F1EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF653F1F0AA,?,?,0000027A3E316BD8,00007FF653F1AD53,?,?,?,00007FF653F1AC4A,?,?,?,00007FF653F15F3E), ref: 00007FF653F1EE98

Strings

ext-ms-, xrefs: 00007FF653F1EDE9
api-ms-, xrefs: 00007FF653F1EDD6

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 071bd3694b408cc37e9f9ea800912fbc37eba257e27765f267684b72478f3c2c
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 6D41C2B2B29A1281EA26CB16ED116752292BF58F90F8D4539ED1DF7794EE3CE8458300

Function 00007FF653F02C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02D63
MessageBoxW.USER32 ref: 00007FF653F02D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF653F02D70
Error, xrefs: 00007FF653F02D8C
[PYI-%d:ERROR] , xrefs: 00007FF653F02CA6
%ls: , xrefs: 00007FF653F02D22

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: b8ed3058ee21e3e4c39906e353a408628ba2627efaf95b954e4254417efed025
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 4231F632718A4192E6209B25B9112AF6792BF88F98F440135EF4EF7759DF3CE546C700

Function 00007FF653F0DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF653F0DF7A,?,?,?,00007FF653F0DC6C,?,?,?,00007FF653F0D869), ref: 00007FF653F0DD4D
GetLastError.KERNEL32(?,?,?,00007FF653F0DF7A,?,?,?,00007FF653F0DC6C,?,?,?,00007FF653F0D869), ref: 00007FF653F0DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF653F0DF7A,?,?,?,00007FF653F0DC6C,?,?,?,00007FF653F0D869), ref: 00007FF653F0DD85
FreeLibrary.KERNEL32(?,?,?,00007FF653F0DF7A,?,?,?,00007FF653F0DC6C,?,?,?,00007FF653F0D869), ref: 00007FF653F0DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF653F0DF7A,?,?,?,00007FF653F0DC6C,?,?,?,00007FF653F0D869), ref: 00007FF653F0DDFF

Strings

api-ms-, xrefs: 00007FF653F0DD6D

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 9226052d53619e1c92bc451c105d5c620fe8814573ce00beb3629a298927a0e5
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: E931B025B2B642D1EE129B0AA8026B56396FF48FA4F5D4535FD2EB7394EF3CE4448304

Function 00007FF653F06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF653F06407
LoadLibrary, xrefs: 00007FF653F064AE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF653F063C7
Failed to load Python DLL '%ls'., xrefs: 00007FF653F064A7
ucrtbase.dll, xrefs: 00007FF653F063DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF653F06456

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: ba9e228f831235ea05b0c7ec56d340b2d1b9b4ff490d714e99797dd8626da206
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 8B41A331A28AC7D1EA21DB29E9161ED6353FF44B44F880132EA5EB3295EF3CE509C740

Function 00007FF653F02A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF653F0351A,?,00000000,00007FF653F03F23), ref: 00007FF653F02AA0

Strings

0, xrefs: 00007FF653F02B16
Warning, xrefs: 00007FF653F02B1E
WARNING, xrefs: 00007FF653F02AAF
Warning [ANSI Fallback], xrefs: 00007FF653F02B0F
[PYI-%d:%s] , xrefs: 00007FF653F02AA8

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 26a7daad5ea7cc3ffdaf142eb5d782523e15aee2191c4fd3c049299c231fdc1f
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: BA21E57262878182E7209B55F8427EA6395FB88BC4F440132FE8DB3659DF3CD5458740

Function 00007FF653F1B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF653F1B15F
FlsGetValue.KERNEL32 ref: 00007FF653F1B174
FlsSetValue.KERNEL32 ref: 00007FF653F1B195
FlsSetValue.KERNEL32 ref: 00007FF653F1B1C2
FlsSetValue.KERNEL32 ref: 00007FF653F1B1D3
FlsSetValue.KERNEL32 ref: 00007FF653F1B1E4
SetLastError.KERNEL32 ref: 00007FF653F1B1FF

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction ID: bc964626718184f3fae6e43929303b1400100fd321f0a291ddf8ced719947a9f
Opcode Fuzzy Hash: a42b9cf7ed1ffe71ebcf97f5a72f2c90d2921d4b6bb9ef7954fc9d2fe8c6feaf
Instruction Fuzzy Hash: 432139B0E2C64281FAA96321EA5713992535F94FB0F1D4734E93EF7AD6DE2CE8408311

Function 00007FF653F27D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF653F27D9D
GetLastError.KERNEL32 ref: 00007FF653F27DA9
CloseHandle.KERNEL32 ref: 00007FF653F27DC1
CreateFileW.KERNEL32 ref: 00007FF653F27DEC
WriteConsoleW.KERNEL32 ref: 00007FF653F27E0B

Strings

CONOUT$, xrefs: 00007FF653F27DCD

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: e0fbfa9cc806cd24f1431582f50ffafdb150362ee596ccf7a8aba58780787405
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 98118121A28B81C6E7518B52ED5632972A1FB98FE4F080234EE5DE77A4DF3CD814C740

Function 00007FF653F08ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F08EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F08F5A

Part of subcall function 00007FF653F09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF653F045F4,00000000,00007FF653F01985), ref: 00007FF653F093C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F08FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F09044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F09055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF653F03FB1), ref: 00007FF653F0906A

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: a30ccee301cd071edcc2afb0efbf19bde48f3582e714178bf7afbf3037f63af4
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: 1C419662A2968282EA309B25E5416BA7396FB85FC4F484135DF4EF77A9EE3CD500C700

Function 00007FF653F1B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B30D
FlsSetValue.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B33A
FlsSetValue.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B34B
FlsSetValue.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B35C
SetLastError.KERNEL32(?,?,?,00007FF653F14F11,?,?,?,?,00007FF653F1A48A,?,?,?,?,00007FF653F1718F), ref: 00007FF653F1B377

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction ID: 4ea91410b490e6bf68fac156e4d35862057e319faff9bbcb4036cefdfb738ce7
Opcode Fuzzy Hash: 1c08c83365d44066401784e1b70b71c7670d14ff4fb682678828c33d1612b477
Instruction Fuzzy Hash: 00112970A2C64282FA59A721E65313D51439F94FB0F0C4734E82EF76D6DE6CE8518311

Function 00007FF653F02910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF653F01B6A), ref: 00007FF653F0295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF653F02966
Error, xrefs: 00007FF653F02A0E
Error [ANSI Fallback], xrefs: 00007FF653F029FF
%s: %s, xrefs: 00007FF653F029E8

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: df34c0b28494ef1b2d00388d7fdac4e19bdd30582d90846334bada619d13de6b
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: E831F672B2868152E7109765BD422EA6296BF88BD4F480132FE8DF3759EF3CD54A8600

Function 00007FF653F02390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF653F023C8
DialogBoxIndirectParamW.USER32 ref: 00007FF653F0248E
DeleteObject.GDI32 ref: 00007FF653F024C1
DestroyIcon.USER32 ref: 00007FF653F024D3

Strings

Unhandled exception in script, xrefs: 00007FF653F023F8

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 79be44b85dddc023113df11613069033807477ab103eb47a75ddfe447064ba20
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: BE316276A29A8185EB20DB65EC562F96361FF88B84F480135FE4EABB59DF3CD104C700

Function 00007FF653F02B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF653F0918F,?,00007FF653F03C55), ref: 00007FF653F02BA0
MessageBoxW.USER32 ref: 00007FF653F02C2A

Strings

Warning, xrefs: 00007FF653F02C1D
[PYI-%d:%ls] , xrefs: 00007FF653F02BA8
WARNING, xrefs: 00007FF653F02BAF

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 7c2059387869fcce6d7cc4df9fdbb02eccd7d2574ff235df96ef3f29615804bc
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: E621D172728B8192E7109B18F9827EA63A5EB88B84F440136EE8DB7755DE3CE605C740

Function 00007FF653F02710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF653F01B99), ref: 00007FF653F02760

Strings

ERROR, xrefs: 00007FF653F0276F
Error, xrefs: 00007FF653F027DE
Error [ANSI Fallback], xrefs: 00007FF653F027CF
[PYI-%d:%s] , xrefs: 00007FF653F02768

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: ce98ea6c16f4ff326723b041cb32cf0014382daa88ac55bcde77eb9a6cc1e09f
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 8121E572A2878182E710CB54F9427EA6395FB88B84F440131FE8DB3659DF3CD5458740

Function 00007FF653F19A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF653F19AAD
GetProcAddress.KERNEL32 ref: 00007FF653F19AC3
FreeLibrary.KERNEL32 ref: 00007FF653F19AEA

Strings

mscoree.dll, xrefs: 00007FF653F19AA4
CorExitProcess, xrefs: 00007FF653F19ABC

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: daa0d2f3be8c2442be59623bcdfe9821358eed6bbd997794ccc0413fe8be30ed
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: B5F0AF61A2860682EA108B20E88673A2322AF45B61F580235DA6EA71E4DF2CE448C380

Function 00007FF653F29368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF653F29390
_set_statfp.LIBCMT ref: 00007FF653F293AB
_set_statfp.LIBCMT ref: 00007FF653F293C7
_set_statfp.LIBCMT ref: 00007FF653F29403

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 9703d76167783c5fb575d661ff5b759b089b6bfbc8d7877c04d171dd696165ac
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: B1119322D78A8283F6541155EEA377B1146EF58B60E8D4634FA6EB72D6CE6CEC614100

Function 00007FF653F1B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF653F1A5A3,?,?,00000000,00007FF653F1A83E,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF653F1A5A3,?,?,00000000,00007FF653F1A83E,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF653F1A5A3,?,?,00000000,00007FF653F1A83E,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF653F1A5A3,?,?,00000000,00007FF653F1A83E,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1B407
FlsSetValue.KERNEL32(?,?,?,00007FF653F1A5A3,?,?,00000000,00007FF653F1A83E,?,?,?,?,?,00007FF653F1A7CA), ref: 00007FF653F1B418

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction ID: 18f541e539024cd57f81f37fbf3d0a8d335c6adfc4ea5bf2074248af1966963c
Opcode Fuzzy Hash: 44f6b3e63c936746b9124b5af5da9c753e88c88086b63197a25bc1506e4861c0
Instruction Fuzzy Hash: A2112CB0E2864281FA58A725F55357A61435F94FB0F4C8334E92DF76E6DE2CE8429311

Function 00007FF653F1B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF653F1B235
FlsSetValue.KERNEL32 ref: 00007FF653F1B254
FlsSetValue.KERNEL32 ref: 00007FF653F1B27C
FlsSetValue.KERNEL32 ref: 00007FF653F1B28D
FlsSetValue.KERNEL32 ref: 00007FF653F1B29E

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction ID: 5b032a4df10044c7b81aec299daad58e7a893d4ef7414d17507040fa2d939e68
Opcode Fuzzy Hash: 92671db20a050c4f2636db97a8291f7b9cbb2c044339a59ef12305351f814945
Instruction Fuzzy Hash: BB1118B0E2824781F96A6261E95317E91834F96F30F0C4734D93EFB6D2DE2CF8449261

Function 00007FF653F15FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F15FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F16106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F161BC

Strings

verbose, xrefs: 00007FF653F15FB0

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 0a9fcbe41c89af17124e4e07c9234924c0d728779930db2f65a9b84dc61116c8
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 7791C1B2A2868681FB618E24E45237D77A2AB40F94F4C4136DE9DB73D6DF3DE4458300

Function 00007FF653F1FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1FEA7

Part of subcall function 00007FF653F17A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F17A59

Strings

UTF-8, xrefs: 00007FF653F1FE26
ccs, xrefs: 00007FF653F1FDE2
UTF-16LEUNICODE, xrefs: 00007FF653F1FE45

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 5ae1b06a09102a3afd436ffb9f8735c0067a37af9027b07a77e9fccff442f4c0
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: F481C3F2E28743A5F7749F2AE11227836A2AB11F44F5D4235CA0DF7295CF2DE9019321

Function 00007FF653F0D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF653F0D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF653F0D70A
RtlUnwindEx.KERNEL32 ref: 00007FF653F0D764

Strings

csm, xrefs: 00007FF653F0D6F1

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: fcc51319dae6deb60fdba1faac8aff95004aebadc7e16fc9373cbc2e4518dbbe
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 4951AE3AB296028ADB149F19E545A787392EB44F98F588130FE4EA7788DF7CE841C700

Function 00007FF653F0EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF653F0EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF653F0EF83

Strings

RCC, xrefs: 00007FF653F0EF53
MOC, xrefs: 00007FF653F0EF4B

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 0682d56de363388e92362b7980be98b9844ac485552c020bb588f1dbbb6dd0d1
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 4961B332918BC585DB70DB19E4413AAB7A1FB94B84F084235EB9DA3B99CF7CD190CB00

Function 00007FF653F0F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF653F0F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF653F0F398

Strings

csm, xrefs: 00007FF653F0F3EA
csm, xrefs: 00007FF653F0F2D2

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 56941abd2664bd8c31b157f39f677493f2d328344664bd8dc16da2dcd5842a3f
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 3251BD36A2C382D6EB248A29D44666877A2EB54F94F1C4136DE4EB3B85CF3CE650C711

Function 00007FF653F02810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF653F028EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF653F02868
Error, xrefs: 00007FF653F028DD
ERROR, xrefs: 00007FF653F0286F

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 04a999222a70746c0c7d364be8b68df130c8219954e718f899016f246edea655
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 9E21D372728B8192E7109B14F9427EA63A1EB88B84F440136EE8DB7755DE3CE645C740

Function 00007FF653F1C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF653F1C61F
WriteFile.KERNEL32 ref: 00007FF653F1C8E7
WriteFile.KERNEL32 ref: 00007FF653F1C92D
GetLastError.KERNEL32 ref: 00007FF653F1C9E3

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 4763b4581e714bb997b356c2c1174b8526cf1694c4a033573add107dc873d22f
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 1DD117B2B28A8189E710CF65D5412AC37B2FB54B9CB484235DE5EF7B99DE38D406C700

Function 00007FF653F020C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF653F020F4
SetWindowLongPtrW.USER32 ref: 00007FF653F02116
GetWindowLongPtrW.USER32 ref: 00007FF653F02140
InvalidateRect.USER32 ref: 00007FF653F02160

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: f7c74b55f5a312fa4858d00aef6a8de79152446d7af487a6d4b7d8deccb88cb9
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 4511AC21B2C18292F6549B6DEA8667D5253EF84F80F4C4030EF4A77B99CD2DF9958210

Function 00007FF653F25B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF653F21760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F21793

_get_daylight.LIBCMT ref: 00007FF653F25C34
_get_daylight.LIBCMT ref: 00007FF653F25C45

Strings

?, xrefs: 00007FF653F25BC5

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 78f607e3a31b59f4e8b4018db8eadc93b3270aaef731fdc461210d9f416c2e0b
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: BE41F822A286C285FB648725EE03379A653EB80FA4F184235FE5CA7BD5DF3CD4418700

Function 00007FF653F19014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F19046

Part of subcall function 00007FF653F1A948: RtlFreeHeap.NTDLL(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A95E
Part of subcall function 00007FF653F1A948: GetLastError.KERNEL32(?,?,?,00007FF653F22D22,?,?,?,00007FF653F22D5F,?,?,00000000,00007FF653F23225,?,?,?,00007FF653F23157), ref: 00007FF653F1A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF653F0CBA5), ref: 00007FF653F19064

Strings

C:\Users\user\Desktop\user.exe, xrefs: 00007FF653F19052

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\user.exe
API String ID: 3580290477-2783562030
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: f060f8f6f9d511c98753922b0b6eccdbb564bec609832f65209ed6292a8a6819
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: CA419072A28B0286EB55DF21EA420BD67A6EF44FD0B5D4035E94DB7B95DE3CE481C380

Function 00007FF653F1CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF653F1CD4F
GetLastError.KERNEL32 ref: 00007FF653F1CD71

Strings

U, xrefs: 00007FF653F1CCFB

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: e1772d5cc9e71db938bfdf782911552b901ea8390ff76fd54e6dcdd3ad0a1034
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 7041A472B28A8185DB608F65F8453A977A2FB98B88F484135EE4DE7794EF3CD401CB40

Function 00007FF653F1F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF653F1F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF653F1F64A

Strings

:, xrefs: 00007FF653F1F60E

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction ID: ab398b7eae0cce1dd1b79873fdf5dbfbbc2da842efd0c57d20564e5623f47fad
Opcode Fuzzy Hash: 9aa1b1c0966d0181e71a7442aa19fd9d8a3a06258be719e39fc35e3b215e25b0
Instruction Fuzzy Hash: AE21F5B2A3878181EB208B11E45627D73A3FB84F44F494235DA4DB3294CF7CE9458B51

Function 00007FF653F0FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF653F0FD98
RaiseException.KERNEL32 ref: 00007FF653F0FDD9

Strings

csm, xrefs: 00007FF653F0FDC6

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 9eb52d44a8c394d540a7638ef73df33512a39ec4ca0def7851f15f1a344b6103
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: EE112E32629B8182EB618F15E940259B7E5FB88F84F5C4230EF9D67754DF3CD5518740

Function 00007FF653F2073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F2076C
GetDriveTypeW.KERNEL32 ref: 00007FF653F207AC

Strings

:, xrefs: 00007FF653F20795

Memory Dump Source

Source File: 00000000.00000002.2619950203.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000000.00000002.2619853775.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620096190.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620201221.00007FF653F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2620437999.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff653f00000_user.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: e3683457a8b4c84916b4f25a4f7229632d21c6e6b26f0dd13b2b4470ffdd22f5
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: A4018462928643C6F7209F60AD6327E23A1EF84B44F880035E94EF7695DE3CD5048B15

Analysis Process: user.exePID: 7656, Parent PID: 7564COMMON

Executed Functions

Function 00007FF8E6A38A30 Relevance: 591.1, APIs: 57, Strings: 280, Instructions: 1345
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_GetObject.PYTHON313 ref: 00007FF8E6A38A5A
PyLong_AsUnsignedLongMask.PYTHON313 ref: 00007FF8E6A38A68
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A38A75
PyErr_Clear.PYTHON313 ref: 00007FF8E6A38AA1
?PyWinGlobals_Ensure@@YAHXZ.PYWINTYPES313 ref: 00007FF8E6A38ABE
PyModule_Create2.PYTHON313 ref: 00007FF8E6A38AD5
PyModule_GetDict.PYTHON313 ref: 00007FF8E6A38AE6
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38B0E
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38B25
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38B3C
PyType_Ready.PYTHON313 ref: 00007FF8E6A38B4C
PyType_Ready.PYTHON313 ref: 00007FF8E6A38B65
PyType_Ready.PYTHON313 ref: 00007FF8E6A38B7E
PyType_Ready.PYTHON313 ref: 00007FF8E6A38B97
_Py_NewReference.PYTHON313 ref: 00007FF8E6A38BBA
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38BD4
_Py_NewReference.PYTHON313 ref: 00007FF8E6A38BEE
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38C08
_Py_NewReference.PYTHON313 ref: 00007FF8E6A38C22
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38C3C
_Py_NewReference.PYTHON313 ref: 00007FF8E6A38C56
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38C70
PyErr_SetString.PYTHON313 ref: 00007FF8E6A38C96
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38CAE
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38CC9
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38CEB
PyErr_NewException.PYTHON313 ref: 00007FF8E6A38D05
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38D1F
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A38D48
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38D63
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A38D79
PyType_Ready.PYTHON313 ref: 00007FF8E6A38D93
PyType_Ready.PYTHON313 ref: 00007FF8E6A38DA9
PyType_Ready.PYTHON313 ref: 00007FF8E6A38DBF
PyType_Ready.PYTHON313 ref: 00007FF8E6A38DD5
PyType_Ready.PYTHON313 ref: 00007FF8E6A38DEB
PyModule_Create2.PYTHON313 ref: 00007FF8E6A38E06
PyDict_New.PYTHON313 ref: 00007FF8E6A38E18
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38E32
GetModuleHandleW.KERNEL32 ref: 00007FF8E6A38E3F
GetProcAddress.KERNEL32 ref: 00007FF8E6A38E57
GetProcAddress.KERNEL32 ref: 00007FF8E6A38E6E
GetProcAddress.KERNEL32 ref: 00007FF8E6A38E85
GetProcAddress.KERNEL32 ref: 00007FF8E6A38E9C
GetProcAddress.KERNEL32 ref: 00007FF8E6A38EB3
GetModuleHandleW.KERNEL32 ref: 00007FF8E6A38EC7
LoadLibraryExW.KERNEL32 ref: 00007FF8E6A38ED9

Part of subcall function 00007FF8E6A389C0: PyLong_FromLong.PYTHON313 ref: 00007FF8E6A389D8

Part of subcall function 00007FF8E6A389C0: PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A38A02
Part of subcall function 00007FF8E6A389C0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A38A18

Part of subcall function 00007FF8E6A312D0: GetModuleHandleW.KERNEL32 ref: 00007FF8E6A312E6
Part of subcall function 00007FF8E6A312D0: GetProcAddress.KERNEL32 ref: 00007FF8E6A312FB

GetProcAddress.KERNEL32 ref: 00007FF8E6A38EEE
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3A3FB
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A3A411
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3A425
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3A432
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A3A448
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3A45C
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3A469
PyDict_SetItemString.PYTHON313 ref: 00007FF8E6A3A47F
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3A493

Strings

RPC_C_IMP_LEVEL_ANONYMOUS, xrefs: 00007FF8E6A39726
RPC_C_AUTHN_LEVEL_CONNECT, xrefs: 00007FF8E6A396AB
VT_CF, xrefs: 00007FF8E6A3A00B
TKIND_RECORD, xrefs: 00007FF8E6A39BE2
DISPATCH_PROPERTYPUTREF, xrefs: 00007FF8E6A39159
PARAMFLAG_FRETVAL, xrefs: 00007FF8E6A3953A
error, xrefs: 00007FF8E6A38CBF
EOAC_DYNAMIC, xrefs: 00007FF8E6A3992A
STREAM_SEEK_END, xrefs: 00007FF8E6A395A0
VT_R8, xrefs: 00007FF8E6A39D41
RPC_C_IMP_LEVEL_IMPERSONATE, xrefs: 00007FF8E6A39750
fdexPropCannotCall, xrefs: 00007FF8E6A3A2E1
RPC_C_AUTHN_DPA, xrefs: 00007FF8E6A39834
CLSCTX_INPROC_SERVER, xrefs: 00007FF8E6A38F67
TYMED_ENHMF, xrefs: 00007FF8E6A390B4
DISPID_EVALUATE, xrefs: 00007FF8E6A39213
CoInitializeSecurity, xrefs: 00007FF8E6A38EA2
ROTFLAGS_ALLOWANYCLIENT, xrefs: 00007FF8E6A3966F
RPC_C_IMP_LEVEL_IDENTIFY, xrefs: 00007FF8E6A3973B
VT_NULL, xrefs: 00007FF8E6A39CED
EOAC_DEFAULT, xrefs: 00007FF8E6A399BD
EOAC_STATIC_CLOAKING, xrefs: 00007FF8E6A3993F
ArgNotFound, xrefs: 00007FF8E6A38C32
DESCKIND_FUNCDESC, xrefs: 00007FF8E6A3A34A
VT_RECORD, xrefs: 00007FF8E6A39F63
RPC_C_AUTHN_LEVEL_DEFAULT, xrefs: 00007FF8E6A39681
CLSCTX_INPROC_HANDLER, xrefs: 00007FF8E6A38F7C
IMPLTYPEFLAG_FDEFAULT, xrefs: 00007FF8E6A393B4
PARAMFLAG_FOPT, xrefs: 00007FF8E6A3954F
ServerInterfaces, xrefs: 00007FF8E6A38B1B
MSHLFLAGS_TABLESTRONG, xrefs: 00007FF8E6A3A140
VT_USERDEFINED, xrefs: 00007FF8E6A39F24
EOAC_DISABLE_AAA, xrefs: 00007FF8E6A399D2
EOAC_ANY_AUTHORITY, xrefs: 00007FF8E6A39969
FUNCFLAG_FSOURCE, xrefs: 00007FF8E6A392BB
EOAC_MAKE_FULLSIC, xrefs: 00007FF8E6A3997E
fdexPropCanPutRef, xrefs: 00007FF8E6A3A278
fdexNameCaseInsensitive, xrefs: 00007FF8E6A3A20F
CLSCTX_INPROC, xrefs: 00007FF8E6A38F3D
VT_DECIMAL, xrefs: 00007FF8E6A39DFE
MSHCTX_INPROC, xrefs: 00007FF8E6A3A119
RPC_C_AUTHN_LEVEL_PKT, xrefs: 00007FF8E6A396D5
IDLFLAG_FLCID, xrefs: 00007FF8E6A3942F
STDOLE2_MAJORVERNUM, xrefs: 00007FF8E6A39A35
DESCKIND_VARDESC, xrefs: 00007FF8E6A3A35F
DISPATCH_METHOD, xrefs: 00007FF8E6A3916E
VT_BYREF, xrefs: 00007FF8E6A3A074
FUNCFLAG_FRESTRICTED, xrefs: 00007FF8E6A392A6
EOAC_APPID, xrefs: 00007FF8E6A39915
VT_SAFEARRAY, xrefs: 00007FF8E6A39EFA
IMPLTYPEFLAG_FRESTRICTED, xrefs: 00007FF8E6A393DE
VT_UNKNOWN, xrefs: 00007FF8E6A39DE9
MKSYS_ANTIMONIKER, xrefs: 00007FF8E6A39495
can't define ole_error, xrefs: 00007FF8E6A38C8C
RPC_C_AUTHN_LEVEL_PKT_PRIVACY, xrefs: 00007FF8E6A396FF
frozen, xrefs: 00007FF8E6A3A375
TypeIIDs, xrefs: 00007FF8E6A38B04
DVASPECT_CONTENT, xrefs: 00007FF8E6A390DB
REGCLS_MULTIPLEUSE, xrefs: 00007FF8E6A3961B
EOAC_REQUIRE_FULLSIC, xrefs: 00007FF8E6A39993
VT_STORAGE, xrefs: 00007FF8E6A39FB7
TKIND_ENUM, xrefs: 00007FF8E6A39BCD
DISPID_DESTRUCTOR, xrefs: 00007FF8E6A39198
MKSYS_FILEMONIKER, xrefs: 00007FF8E6A39480
CoCreateInstanceEx, xrefs: 00007FF8E6A38E8B
RPC_C_AUTHN_LEVEL_NONE, xrefs: 00007FF8E6A39696
RPC_C_AUTHN_MSN, xrefs: 00007FF8E6A3981F
VT_INT, xrefs: 00007FF8E6A39E91
fdexPropCanConstruct, xrefs: 00007FF8E6A3A2F6
MSHLFLAGS_NORMAL, xrefs: 00007FF8E6A3A12B
INVOKE_PROPERTYPUTREF, xrefs: 00007FF8E6A395F4
VT_ILLEGALMASKED, xrefs: 00007FF8E6A3A0B3
TYMED_ISTREAM, xrefs: 00007FF8E6A39060
REGCLS_SUSPENDED, xrefs: 00007FF8E6A39645
TYPEFLAG_FDISPATCHABLE, xrefs: 00007FF8E6A39BA6
INVOKE_PROPERTYPUT, xrefs: 00007FF8E6A395DF
fdexPropCannotSourceEvents, xrefs: 00007FF8E6A3A335
RPC_C_AUTHN_GSS_KERBEROS, xrefs: 00007FF8E6A3980A
RPC_C_AUTHN_LEVEL_CALL, xrefs: 00007FF8E6A396C0
TYMED_FILE, xrefs: 00007FF8E6A3904B
FMTID_DocSummaryInformation, xrefs: 00007FF8E6A3A401
RPC_C_AUTHN_MQ, xrefs: 00007FF8E6A39849
VT_STREAM, xrefs: 00007FF8E6A39FA2
VT_VOID, xrefs: 00007FF8E6A39EBB
RPC_C_AUTHN_DEC_PUBLIC, xrefs: 00007FF8E6A397B6
RPC_C_AUTHN_DEFAULT, xrefs: 00007FF8E6A3985E
STDOLE_MAJORVERNUM, xrefs: 00007FF8E6A399FC
TYPEFLAG_FCONTROL, xrefs: 00007FF8E6A39B13
VAR_CONST, xrefs: 00007FF8E6A39CB1
VAR_STATIC, xrefs: 00007FF8E6A39C9C
MKSYS_CLASSMONIKER, xrefs: 00007FF8E6A394D4
IDLFLAG_FRETVAL, xrefs: 00007FF8E6A39444
DISPID_CONSTRUCTOR, xrefs: 00007FF8E6A39183
RPC_C_IMP_LEVEL_DELEGATE, xrefs: 00007FF8E6A39765
FUNCFLAG_FDISPLAYBIND, xrefs: 00007FF8E6A392FA
COINIT_DISABLE_OLE1DDE, xrefs: 00007FF8E6A38FE2
VT_I8, xrefs: 00007FF8E6A39E67
TYPEFLAG_FDUAL, xrefs: 00007FF8E6A39B28
VT_STORED_OBJECT, xrefs: 00007FF8E6A39FE1
ROTFLAGS_REGISTRATIONKEEPSALIVE, xrefs: 00007FF8E6A3965A
TKIND_COCLASS, xrefs: 00007FF8E6A39C36
FUNC_NONVIRTUAL, xrefs: 00007FF8E6A39375
VT_VARIANT, xrefs: 00007FF8E6A39DD4
VT_DATE, xrefs: 00007FF8E6A39D6B
DISPATCH_PROPERTYPUT, xrefs: 00007FF8E6A39144
fdexPropNoSideEffects, xrefs: 00007FF8E6A3A2A2
DISPID_VALUE, xrefs: 00007FF8E6A391BF
TKIND_MODULE, xrefs: 00007FF8E6A39BF7
CoGetCancelObject, xrefs: 00007FF8E6A38E74
MKSYS_ITEMMONIKER, xrefs: 00007FF8E6A394AA
VT_LPSTR, xrefs: 00007FF8E6A39F39
pythoncom.internal_error, xrefs: 00007FF8E6A38CFC
RPC_C_AUTHN_WINNT, xrefs: 00007FF8E6A397E0
DISPID_UNKNOWN, xrefs: 00007FF8E6A391D4, 00007FF8E6A3923D
PARAMFLAG_FHASDEFAULT, xrefs: 00007FF8E6A39564
DATADIR_GET, xrefs: 00007FF8E6A3900C
EOAC_AUTO_IMPERSONATE, xrefs: 00007FF8E6A399A8
fdexPropCanPut, xrefs: 00007FF8E6A3A24E
TYPEFLAG_FLICENSED, xrefs: 00007FF8E6A39AD4
fdexNameCaseSensitive, xrefs: 00007FF8E6A3A1D0
TKIND_ALIAS, xrefs: 00007FF8E6A39C4B
VT_UI1, xrefs: 00007FF8E6A39E28
SYS_WIN16, xrefs: 00007FF8E6A39A6B
CoWaitForMultipleHandles, xrefs: 00007FF8E6A38E4D
VT_FILETIME, xrefs: 00007FF8E6A39F78
MSHCTX_NOSHAREDMEM, xrefs: 00007FF8E6A3A0EF
CreateURLMonikerEx, xrefs: 00007FF8E6A38EE4
EOAC_ACCESS_CONTROL, xrefs: 00007FF8E6A39900
ACTIVEOBJECT_STRONG, xrefs: 00007FF8E6A38EFE
FUNCFLAG_FBINDABLE, xrefs: 00007FF8E6A392D0
TKIND_INTERFACE, xrefs: 00007FF8E6A39C0C
RPC_C_IMP_LEVEL_DEFAULT, xrefs: 00007FF8E6A39711
MSHCTX_DIFFERENTMACHINE, xrefs: 00007FF8E6A3A104
IDLFLAG_FOUT, xrefs: 00007FF8E6A3941A
TKIND_UNION, xrefs: 00007FF8E6A39C60
VT_RESERVED, xrefs: 00007FF8E6A3A089
PARAMFLAG_FLCID, xrefs: 00007FF8E6A39525
PARAMFLAG_FIN, xrefs: 00007FF8E6A394FB
FUNC_VIRTUAL, xrefs: 00007FF8E6A3934B
VT_UI2, xrefs: 00007FF8E6A39E3D
VT_UINT, xrefs: 00007FF8E6A39EA6
RPC_C_AUTHZ_NONE, xrefs: 00007FF8E6A39870
REGCLS_MULTI_SEPARATE, xrefs: 00007FF8E6A39630
COINIT_MULTITHREADED, xrefs: 00007FF8E6A38FCD
IDLFLAG_FIN, xrefs: 00007FF8E6A39405
internal_error, xrefs: 00007FF8E6A38D0B
TYPEFLAG_FHIDDEN, xrefs: 00007FF8E6A39AFE
TYPEFLAG_FREVERSEBIND, xrefs: 00007FF8E6A39BBB
MKSYS_GENERICCOMPOSITE, xrefs: 00007FF8E6A3946B
FMTID_SummaryInformation, xrefs: 00007FF8E6A3A438
fdexNameImplicit, xrefs: 00007FF8E6A3A1FA
COWAIT_WAITALL, xrefs: 00007FF8E6A3A1A6
VT_BLOB_OBJECT, xrefs: 00007FF8E6A39FF6
fdexPropCanSourceEvents, xrefs: 00007FF8E6A3A320
TKIND_DISPATCH, xrefs: 00007FF8E6A39C21
TYPEFLAG_FOLEAUTOMATION, xrefs: 00007FF8E6A39B52
Missing, xrefs: 00007FF8E6A38BFE
TYPEFLAG_FRESTRICTED, xrefs: 00007FF8E6A39B67
TYPEFLAG_FREPLACEABLE, xrefs: 00007FF8E6A39B91
urlmon.dll, xrefs: 00007FF8E6A38EC0, 00007FF8E6A38ED2
TYMED_NULL, xrefs: 00007FF8E6A390C6
STDOLE_LCID, xrefs: 00007FF8E6A39A20
_univgw, xrefs: 00007FF8E6A38E21
RPC_C_AUTHN_NONE, xrefs: 00007FF8E6A39777
INVOKE_FUNC, xrefs: 00007FF8E6A395B5
VT_ERROR, xrefs: 00007FF8E6A39DAA
VT_BSTR_BLOB, xrefs: 00007FF8E6A3A035
fdexPropCanCall, xrefs: 00007FF8E6A3A2CC
TYPEFLAG_FAGGREGATABLE, xrefs: 00007FF8E6A39B7C
VT_I1, xrefs: 00007FF8E6A39E13
VT_LPWSTR, xrefs: 00007FF8E6A39F4E
DISPID_COLLECT, xrefs: 00007FF8E6A391AD
FUNC_DISPATCH, xrefs: 00007FF8E6A3939F
TYPEFLAG_FPREDECLID, xrefs: 00007FF8E6A39AE9
DISPID_PROPERTYPUT, xrefs: 00007FF8E6A391E9
InterfaceNames, xrefs: 00007FF8E6A38B32
FUNCFLAG_FUSESGETLASTERROR, xrefs: 00007FF8E6A39339
VT_VECTOR, xrefs: 00007FF8E6A3A04A
VT_BSTR, xrefs: 00007FF8E6A39D80
VT_UI8, xrefs: 00007FF8E6A39E7C
DISPID_STARTENUM, xrefs: 00007FF8E6A39228
VT_CLSID, xrefs: 00007FF8E6A3A020
VT_R4, xrefs: 00007FF8E6A39D2C
VT_PTR, xrefs: 00007FF8E6A39EE5
FUNCFLAG_FREQUESTEDIT, xrefs: 00007FF8E6A392E5
VAR_DISPATCH, xrefs: 00007FF8E6A39CC6
EOAC_NO_CUSTOM_MARSHAL, xrefs: 00007FF8E6A399E7
TYMED_GDI, xrefs: 00007FF8E6A3908A
STREAM_SEEK_SET, xrefs: 00007FF8E6A39576
FUNCFLAG_FDEFAULTBIND, xrefs: 00007FF8E6A3930F
VT_BLOB, xrefs: 00007FF8E6A39F8D
CLSCTX_ALL, xrefs: 00007FF8E6A38F28, 00007FF8E6A3A38C
Empty, xrefs: 00007FF8E6A38BCA
fdexPropCannotPutRef, xrefs: 00007FF8E6A3A28D
SYS_MAC, xrefs: 00007FF8E6A39A95
DVASPECT_THUMBNAIL, xrefs: 00007FF8E6A390F0
COWAIT_ALERTABLE, xrefs: 00007FF8E6A3A1BB
INVOKE_PROPERTYGET, xrefs: 00007FF8E6A395CA
ole32.dll, xrefs: 00007FF8E6A38E38
PARAMFLAG_NONE, xrefs: 00007FF8E6A394E6
MKSYS_NONE, xrefs: 00007FF8E6A39456
Nothing, xrefs: 00007FF8E6A38C66
RPC_C_AUTHN_DCE_PUBLIC, xrefs: 00007FF8E6A397A1
URL_MK_UNIFORM, xrefs: 00007FF8E6A3A17F
DATADIR_SET, xrefs: 00007FF8E6A39021
MKSYS_POINTERMONIKER, xrefs: 00007FF8E6A394BF
VAR_PERINSTANCE, xrefs: 00007FF8E6A39C87
EXTCONN_STRONG, xrefs: 00007FF8E6A39267
EXTCONN_CALLABLE, xrefs: 00007FF8E6A39291
RPC_C_AUTHZ_DEFAULT, xrefs: 00007FF8E6A398AF
STREAM_SEEK_CUR, xrefs: 00007FF8E6A3958B
VT_TYPEMASK, xrefs: 00007FF8E6A3A0C8
EOAC_DYNAMIC_CLOAKING, xrefs: 00007FF8E6A39954
CLSCTX_SERVER, xrefs: 00007FF8E6A38F52, 00007FF8E6A3A3AB, 00007FF8E6A3A3D3
RPC_C_AUTHZ_NAME, xrefs: 00007FF8E6A39885
VT_STREAMED_OBJECT, xrefs: 00007FF8E6A39FCC
TYMED_ISTORAGE, xrefs: 00007FF8E6A39075
DISPID_THIS, xrefs: 00007FF8E6A39252
fdexPropCannotPut, xrefs: 00007FF8E6A3A263
REGCLS_SINGLEUSE, xrefs: 00007FF8E6A39606
DVASPECT_DOCPRINT, xrefs: 00007FF8E6A3911A
PARAMFLAG_FOUT, xrefs: 00007FF8E6A39510
VT_I2, xrefs: 00007FF8E6A39D02
fdexPropDynamicType, xrefs: 00007FF8E6A3A2B7
CLSCTX_REMOTE_SERVER, xrefs: 00007FF8E6A38FA6
fdexNameEnsure, xrefs: 00007FF8E6A3A1E5
STDOLE_MINORVERNUM, xrefs: 00007FF8E6A39A0E
ACTIVEOBJECT_WEAK, xrefs: 00007FF8E6A38F13
EOAC_NONE, xrefs: 00007FF8E6A398C1
SYS_WIN32, xrefs: 00007FF8E6A39A80
TYPEFLAG_FAPPOBJECT, xrefs: 00007FF8E6A39AAA
RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, xrefs: 00007FF8E6A396EA
CLSCTX_LOCAL_SERVER, xrefs: 00007FF8E6A38F91
VT_CARRAY, xrefs: 00007FF8E6A39F0F
RPC_C_AUTHN_GSS_SCHANNEL, xrefs: 00007FF8E6A397F5
VT_ILLEGAL, xrefs: 00007FF8E6A3A09E
STDOLE2_LCID, xrefs: 00007FF8E6A39A59
fdexPropCannotConstruct, xrefs: 00007FF8E6A3A30B
RPC_C_AUTHN_GSS_NEGOTIATE, xrefs: 00007FF8E6A397CB
IMPLTYPEFLAG_FSOURCE, xrefs: 00007FF8E6A393C9
VARFLAG_FREADONLY, xrefs: 00007FF8E6A39C75
VT_I4, xrefs: 00007FF8E6A39D17
ole_error, xrefs: 00007FF8E6A38CA4
EXTCONN_WEAK, xrefs: 00007FF8E6A3927C
VT_CY, xrefs: 00007FF8E6A39D56
TYMED_HGLOBAL, xrefs: 00007FF8E6A39036
URL_MK_LEGACY, xrefs: 00007FF8E6A3A191
MSHLFLAGS_NOPING, xrefs: 00007FF8E6A3A16A
RPC_C_AUTHN_DCE_PRIVATE, xrefs: 00007FF8E6A3978C
EOAC_SECURE_REFS, xrefs: 00007FF8E6A398EB
FUNCFLAG_FHIDDEN, xrefs: 00007FF8E6A39324
TYPEFLAG_FCANCREATE, xrefs: 00007FF8E6A39ABF
dcom, xrefs: 00007FF8E6A3A3E5
VT_ARRAY, xrefs: 00007FF8E6A3A05F
fdexPropCanGet, xrefs: 00007FF8E6A3A224
FUNC_STATIC, xrefs: 00007FF8E6A3938A
STDOLE2_MINORVERNUM, xrefs: 00007FF8E6A39A47
DVASPECT_ICON, xrefs: 00007FF8E6A39105
VT_HRESULT, xrefs: 00007FF8E6A39ED0
COINIT_APARTMENTTHREADED, xrefs: 00007FF8E6A38FBB
MSHLFLAGS_TABLEWEAK, xrefs: 00007FF8E6A3A155
VT_EMPTY, xrefs: 00007FF8E6A39CD8
com_error, xrefs: 00007FF8E6A38CDE
DISPATCH_PROPERTYGET, xrefs: 00007FF8E6A3912F
EOAC_MUTUAL_AUTH, xrefs: 00007FF8E6A398D6
VT_DISPATCH, xrefs: 00007FF8E6A39D95
TYMED_MFPICT, xrefs: 00007FF8E6A3909F
MSHCTX_LOCAL, xrefs: 00007FF8E6A3A0DA
VT_UI4, xrefs: 00007FF8E6A39E52
FMTID_UserDefinedProperties, xrefs: 00007FF8E6A3A46F
COINIT_SPEED_OVER_MEMORY, xrefs: 00007FF8E6A38FF7
TYPEFLAG_FNONEXTENSIBLE, xrefs: 00007FF8E6A39B3D
RPC_C_AUTHZ_DCE, xrefs: 00007FF8E6A3989A
VT_BOOL, xrefs: 00007FF8E6A39DBF
DISPID_NEWENUM, xrefs: 00007FF8E6A391FE
IDLFLAG_NONE, xrefs: 00007FF8E6A393F0
fdexPropCannotGet, xrefs: 00007FF8E6A3A239
coinit_flags, xrefs: 00007FF8E6A38A4E
CoGetObjectContext, xrefs: 00007FF8E6A38E5D
FUNC_PUREVIRTUAL, xrefs: 00007FF8E6A39360

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dict_String$Item$ReadyType_$AddressProc$DeallocFrom$D@@@Err_Object_ReferenceU_object@@$HandleModuleModule_$Create2LongLong_$ClearDictEnsure@@ExceptionGlobals_LibraryLoadMaskObjectOccurredSys_Unsigned
String ID: ACTIVEOBJECT_STRONG$ACTIVEOBJECT_WEAK$ArgNotFound$CLSCTX_ALL$CLSCTX_INPROC$CLSCTX_INPROC_HANDLER$CLSCTX_INPROC_SERVER$CLSCTX_LOCAL_SERVER$CLSCTX_REMOTE_SERVER$CLSCTX_SERVER$COINIT_APARTMENTTHREADED$COINIT_DISABLE_OLE1DDE$COINIT_MULTITHREADED$COINIT_SPEED_OVER_MEMORY$COWAIT_ALERTABLE$COWAIT_WAITALL$CoCreateInstanceEx$CoGetCancelObject$CoGetObjectContext$CoInitializeSecurity$CoWaitForMultipleHandles$CreateURLMonikerEx$DATADIR_GET$DATADIR_SET$DESCKIND_FUNCDESC$DESCKIND_VARDESC$DISPATCH_METHOD$DISPATCH_PROPERTYGET$DISPATCH_PROPERTYPUT$DISPATCH_PROPERTYPUTREF$DISPID_COLLECT$DISPID_CONSTRUCTOR$DISPID_DESTRUCTOR$DISPID_EVALUATE$DISPID_NEWENUM$DISPID_PROPERTYPUT$DISPID_STARTENUM$DISPID_THIS$DISPID_UNKNOWN$DISPID_VALUE$DVASPECT_CONTENT$DVASPECT_DOCPRINT$DVASPECT_ICON$DVASPECT_THUMBNAIL$EOAC_ACCESS_CONTROL$EOAC_ANY_AUTHORITY$EOAC_APPID$EOAC_AUTO_IMPERSONATE$EOAC_DEFAULT$EOAC_DISABLE_AAA$EOAC_DYNAMIC$EOAC_DYNAMIC_CLOAKING$EOAC_MAKE_FULLSIC$EOAC_MUTUAL_AUTH$EOAC_NONE$EOAC_NO_CUSTOM_MARSHAL$EOAC_REQUIRE_FULLSIC$EOAC_SECURE_REFS$EOAC_STATIC_CLOAKING$EXTCONN_CALLABLE$EXTCONN_STRONG$EXTCONN_WEAK$Empty$FMTID_DocSummaryInformation$FMTID_SummaryInformation$FMTID_UserDefinedProperties$FUNCFLAG_FBINDABLE$FUNCFLAG_FDEFAULTBIND$FUNCFLAG_FDISPLAYBIND$FUNCFLAG_FHIDDEN$FUNCFLAG_FREQUESTEDIT$FUNCFLAG_FRESTRICTED$FUNCFLAG_FSOURCE$FUNCFLAG_FUSESGETLASTERROR$FUNC_DISPATCH$FUNC_NONVIRTUAL$FUNC_PUREVIRTUAL$FUNC_STATIC$FUNC_VIRTUAL$IDLFLAG_FIN$IDLFLAG_FLCID$IDLFLAG_FOUT$IDLFLAG_FRETVAL$IDLFLAG_NONE$IMPLTYPEFLAG_FDEFAULT$IMPLTYPEFLAG_FRESTRICTED$IMPLTYPEFLAG_FSOURCE$INVOKE_FUNC$INVOKE_PROPERTYGET$INVOKE_PROPERTYPUT$INVOKE_PROPERTYPUTREF$InterfaceNames$MKSYS_ANTIMONIKER$MKSYS_CLASSMONIKER$MKSYS_FILEMONIKER$MKSYS_GENERICCOMPOSITE$MKSYS_ITEMMONIKER$MKSYS_NONE$MKSYS_POINTERMONIKER$MSHCTX_DIFFERENTMACHINE$MSHCTX_INPROC$MSHCTX_LOCAL$MSHCTX_NOSHAREDMEM$MSHLFLAGS_NOPING$MSHLFLAGS_NORMAL$MSHLFLAGS_TABLESTRONG$MSHLFLAGS_TABLEWEAK$Missing$Nothing$PARAMFLAG_FHASDEFAULT$PARAMFLAG_FIN$PARAMFLAG_FLCID$PARAMFLAG_FOPT$PARAMFLAG_FOUT$PARAMFLAG_FRETVAL$PARAMFLAG_NONE$REGCLS_MULTIPLEUSE$REGCLS_MULTI_SEPARATE$REGCLS_SINGLEUSE$REGCLS_SUSPENDED$ROTFLAGS_ALLOWANYCLIENT$ROTFLAGS_REGISTRATIONKEEPSALIVE$RPC_C_AUTHN_DCE_PRIVATE$RPC_C_AUTHN_DCE_PUBLIC$RPC_C_AUTHN_DEC_PUBLIC$RPC_C_AUTHN_DEFAULT$RPC_C_AUTHN_DPA$RPC_C_AUTHN_GSS_KERBEROS$RPC_C_AUTHN_GSS_NEGOTIATE$RPC_C_AUTHN_GSS_SCHANNEL$RPC_C_AUTHN_LEVEL_CALL$RPC_C_AUTHN_LEVEL_CONNECT$RPC_C_AUTHN_LEVEL_DEFAULT$RPC_C_AUTHN_LEVEL_NONE$RPC_C_AUTHN_LEVEL_PKT$RPC_C_AUTHN_LEVEL_PKT_INTEGRITY$RPC_C_AUTHN_LEVEL_PKT_PRIVACY$RPC_C_AUTHN_MQ$RPC_C_AUTHN_MSN$RPC_C_AUTHN_NONE$RPC_C_AUTHN_WINNT$RPC_C_AUTHZ_DCE$RPC_C_AUTHZ_DEFAULT$RPC_C_AUTHZ_NAME$RPC_C_AUTHZ_NONE$RPC_C_IMP_LEVEL_ANONYMOUS$RPC_C_IMP_LEVEL_DEFAULT$RPC_C_IMP_LEVEL_DELEGATE$RPC_C_IMP_LEVEL_IDENTIFY$RPC_C_IMP_LEVEL_IMPERSONATE$STDOLE2_LCID$STDOLE2_MAJORVERNUM$STDOLE2_MINORVERNUM$STDOLE_LCID$STDOLE_MAJORVERNUM$STDOLE_MINORVERNUM$STREAM_SEEK_CUR$STREAM_SEEK_END$STREAM_SEEK_SET$SYS_MAC$SYS_WIN16$SYS_WIN32$ServerInterfaces$TKIND_ALIAS$TKIND_COCLASS$TKIND_DISPATCH$TKIND_ENUM$TKIND_INTERFACE$TKIND_MODULE$TKIND_RECORD$TKIND_UNION$TYMED_ENHMF$TYMED_FILE$TYMED_GDI$TYMED_HGLOBAL$TYMED_ISTORAGE$TYMED_ISTREAM$TYMED_MFPICT$TYMED_NULL$TYPEFLAG_FAGGREGATABLE$TYPEFLAG_FAPPOBJECT$TYPEFLAG_FCANCREATE$TYPEFLAG_FCONTROL$TYPEFLAG_FDISPATCHABLE$TYPEFLAG_FDUAL$TYPEFLAG_FHIDDEN$TYPEFLAG_FLICENSED$TYPEFLAG_FNONEXTENSIBLE$TYPEFLAG_FOLEAUTOMATION$TYPEFLAG_FPREDECLID$TYPEFLAG_FREPLACEABLE$TYPEFLAG_FRESTRICTED$TYPEFLAG_FREVERSEBIND$TypeIIDs$URL_MK_LEGACY$URL_MK_UNIFORM$VARFLAG_FREADONLY$VAR_CONST$VAR_DISPATCH$VAR_PERINSTANCE$VAR_STATIC$VT_ARRAY$VT_BLOB$VT_BLOB_OBJECT$VT_BOOL$VT_BSTR$VT_BSTR_BLOB$VT_BYREF$VT_CARRAY$VT_CF$VT_CLSID$VT_CY$VT_DATE$VT_DECIMAL$VT_DISPATCH$VT_EMPTY$VT_ERROR$VT_FILETIME$VT_HRESULT$VT_I1$VT_I2$VT_I4$VT_I8$VT_ILLEGAL$VT_ILLEGALMASKED$VT_INT$VT_LPSTR$VT_LPWSTR$VT_NULL$VT_PTR$VT_R4$VT_R8$VT_RECORD$VT_RESERVED$VT_SAFEARRAY$VT_STORAGE$VT_STORED_OBJECT$VT_STREAM$VT_STREAMED_OBJECT$VT_TYPEMASK$VT_UI1$VT_UI2$VT_UI4$VT_UI8$VT_UINT$VT_UNKNOWN$VT_USERDEFINED$VT_VARIANT$VT_VECTOR$VT_VOID$_univgw$can't define ole_error$coinit_flags$com_error$dcom$error$fdexNameCaseInsensitive$fdexNameCaseSensitive$fdexNameEnsure$fdexNameImplicit$fdexPropCanCall$fdexPropCanConstruct$fdexPropCanGet$fdexPropCanPut$fdexPropCanPutRef$fdexPropCanSourceEvents$fdexPropCannotCall$fdexPropCannotConstruct$fdexPropCannotGet$fdexPropCannotPut$fdexPropCannotPutRef$fdexPropCannotSourceEvents$fdexPropDynamicType$fdexPropNoSideEffects$frozen$internal_error$ole32.dll$ole_error$pythoncom.internal_error$urlmon.dll
API String ID: 1000972437-3953899047
Opcode ID: 50b178b6dc7987ebe6360e7943940d86408c5d0eb80b93197e5c57d2a6e1887f
Instruction ID: d35c292896db314b6dfa86b9770e9931c92ed6fd4959ec357605868fe7860e85
Opcode Fuzzy Hash: 50b178b6dc7987ebe6360e7943940d86408c5d0eb80b93197e5c57d2a6e1887f
Instruction Fuzzy Hash: F7D21764F7C61340FA14AB96E6973BC1322AF46BE0F815435DC4D0BBA69F6EE2058743

Function 00007FF8E69FEFE0 Relevance: 306.6, APIs: 93, Strings: 82, Instructions: 391
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?PyWinGlobals_Ensure@@YAHXZ.PYWINTYPES313 ref: 00007FF8E69FEFEA
PyModule_Create2.PYTHON313 ref: 00007FF8E69FF005
PyModule_GetDict.PYTHON313 ref: 00007FF8E69FF01A
PyDict_SetItemString.PYTHON313 ref: 00007FF8E69FF040
PyLong_FromLong.PYTHON313 ref: 00007FF8E69FF04B
PyDict_SetItemString.PYTHON313 ref: 00007FF8E69FF05E
PyLong_FromLong.PYTHON313 ref: 00007FF8E69FF069
PyDict_SetItemString.PYTHON313 ref: 00007FF8E69FF07C
PyLong_FromLong.PYTHON313 ref: 00007FF8E69FF087
PyDict_SetItemString.PYTHON313 ref: 00007FF8E69FF09A
PyType_Ready.PYTHON313 ref: 00007FF8E69FF0A7
PyDict_SetItemString.PYTHON313 ref: 00007FF8E69FF0C7
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF0E3
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF0F9
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF10F
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF125
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF13B
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF151
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF167
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF17D
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF193
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF1A9
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF1BF
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF1D5
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF1EB
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF201
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF217
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF22D
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF243
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF259
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF26F
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF285
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF29B
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF2AE
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF2C4
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF2DA
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF2F0
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF306
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF31C
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF32F
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF345
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF35B
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF371
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF387
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF39D
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF3B3
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF3C9
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF3DF
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF3F5
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF40B
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF421
PyModule_AddIntConstant.PYTHON313 ref: 00007FF8E69FF437
GetModuleHandleW.KERNEL32 ref: 00007FF8E69FF444
LoadLibraryExW.KERNEL32 ref: 00007FF8E69FF459
GetProcAddressForCaller.KERNELBASE ref: 00007FF8E69FF471
GetProcAddress.KERNEL32 ref: 00007FF8E69FF488
GetModuleHandleW.KERNEL32 ref: 00007FF8E69FF49C
LoadLibraryW.KERNEL32 ref: 00007FF8E69FF4B1
GetProcAddress.KERNEL32 ref: 00007FF8E69FF4CD
GetProcAddress.KERNEL32 ref: 00007FF8E69FF4E4
GetProcAddress.KERNEL32 ref: 00007FF8E69FF4F4
GetProcAddress.KERNEL32 ref: 00007FF8E69FF50B
GetProcAddress.KERNEL32 ref: 00007FF8E69FF522
GetProcAddress.KERNEL32 ref: 00007FF8E69FF539
GetProcAddress.KERNEL32 ref: 00007FF8E69FF550
GetProcAddress.KERNEL32 ref: 00007FF8E69FF567
GetProcAddress.KERNEL32 ref: 00007FF8E69FF57E
GetProcAddress.KERNEL32 ref: 00007FF8E69FF595
GetProcAddress.KERNEL32 ref: 00007FF8E69FF5AC
GetProcAddress.KERNEL32 ref: 00007FF8E69FF5C3
GetModuleHandleW.KERNEL32 ref: 00007FF8E69FF5D7
LoadLibraryW.KERNEL32 ref: 00007FF8E69FF5EC
GetProcAddress.KERNEL32 ref: 00007FF8E69FF608
GetProcAddress.KERNEL32 ref: 00007FF8E69FF61F
GetProcAddress.KERNEL32 ref: 00007FF8E69FF636
GetProcAddress.KERNEL32 ref: 00007FF8E69FF64D
GetProcAddress.KERNEL32 ref: 00007FF8E69FF664
GetProcAddress.KERNEL32 ref: 00007FF8E69FF67B
GetProcAddress.KERNEL32 ref: 00007FF8E69FF692
GetProcAddress.KERNEL32 ref: 00007FF8E69FF6A9
GetProcAddress.KERNEL32 ref: 00007FF8E69FF6C0
GetModuleHandleW.KERNEL32 ref: 00007FF8E69FF6D4
LoadLibraryW.KERNEL32 ref: 00007FF8E69FF6E9
GetProcAddress.KERNEL32 ref: 00007FF8E69FF705
GetProcAddress.KERNEL32 ref: 00007FF8E69FF71C
GetProcAddress.KERNEL32 ref: 00007FF8E69FF733
GetProcAddress.KERNEL32 ref: 00007FF8E69FF74A
GetProcAddress.KERNEL32 ref: 00007FF8E69FF761
GetProcAddress.KERNEL32 ref: 00007FF8E69FF778
GetProcAddress.KERNEL32 ref: 00007FF8E69FF78F
GetProcAddress.KERNEL32 ref: 00007FF8E69FF7A6
GetProcAddress.KERNEL32 ref: 00007FF8E69FF7BD
GetProcAddress.KERNEL32 ref: 00007FF8E69FF7D4

Strings

VOS__PM16, xrefs: 00007FF8E69FF27B
GetSystemFileCacheSize, xrefs: 00007FF8E69FF53F
MonitorFromPoint, xrefs: 00007FF8E69FF66A
kernel32.dll, xrefs: 00007FF8E69FF495, 00007FF8E69FF4AA
EnumDisplaySettingsExW, xrefs: 00007FF8E69FF698
VFT_UNKNOWN, xrefs: 00007FF8E69FF325
NameUniqueId, xrefs: 00007FF8E69FF131
RegDeleteTreeW, xrefs: 00007FF8E69FF795
VOS_DOS_WINDOWS16, xrefs: 00007FF8E69FF2BA
VS_FF_PRIVATEBUILD, xrefs: 00007FF8E69FF417
SetSystemFileCacheSize, xrefs: 00007FF8E69FF556
REG_NOTIFY_CHANGE_NAME, xrefs: 00007FF8E69FF19F
GetComputerNameExW, xrefs: 00007FF8E69FF4C3
PyDISPLAY_DEVICEType, xrefs: 00007FF8E69FF0C0
VS_FF_INFOINFERRED, xrefs: 00007FF8E69FF3D5
VOS_OS232, xrefs: 00007FF8E69FF265
NameServicePrincipal, xrefs: 00007FF8E69FF189
GetNativeSystemInfo, xrefs: 00007FF8E69FF5B2
MonitorFromWindow, xrefs: 00007FF8E69FF63C
EnumDisplayDevicesW, xrefs: 00007FF8E69FF60E
VOS_DOS_WINDOWS32, xrefs: 00007FF8E69FF2D0
VS_FF_SPECIALBUILD, xrefs: 00007FF8E69FF42D
VS_FF_DEBUG, xrefs: 00007FF8E69FF3BF
VOS_NT, xrefs: 00007FF8E69FF20D
VFT_DRV, xrefs: 00007FF8E69FF367
RegOpenCurrentUser, xrefs: 00007FF8E69FF7AC
SetHandleInformation, xrefs: 00007FF8E69FF511
REG_NOTIFY_CHANGE_LAST_SET, xrefs: 00007FF8E69FF1CB
REG_NOTIFY_CHANGE_ATTRIBUTES, xrefs: 00007FF8E69FF1B5
GetMonitorInfoW, xrefs: 00007FF8E69FF681
VFT_STATIC_LIB, xrefs: 00007FF8E69FF3A9
VOS_NT_WINDOWS32, xrefs: 00007FF8E69FF2E6
VOS__WINDOWS32, xrefs: 00007FF8E69FF239
VFT_VXD, xrefs: 00007FF8E69FF393
RegCreateKeyTransactedW, xrefs: 00007FF8E69FF722
Advapi32.dll, xrefs: 00007FF8E69FF6CD, 00007FF8E69FF6E2
VOS_OS216, xrefs: 00007FF8E69FF24F
SetDllDirectoryW, xrefs: 00007FF8E69FF584
VOS_OS216_PM16, xrefs: 00007FF8E69FF2FC
RegCopyTreeW, xrefs: 00007FF8E69FF77E
SetSystemPowerState, xrefs: 00007FF8E69FF59B
user32.dll, xrefs: 00007FF8E69FF5D0, 00007FF8E69FF5E5
GetLastInputInfo, xrefs: 00007FF8E69FF6AF
VOS_OS232_PM32, xrefs: 00007FF8E69FF312
NameCanonicalEx, xrefs: 00007FF8E69FF173
RegRestoreKeyW, xrefs: 00007FF8E69FF6FB
EnumDisplayMonitors, xrefs: 00007FF8E69FF5FE
secur32.dll, xrefs: 00007FF8E69FF43D, 00007FF8E69FF452
NameFullyQualifiedDN, xrefs: 00007FF8E69FF0EF
NameUnknown, xrefs: 00007FF8E69FF0D9
GetHandleInformation, xrefs: 00007FF8E69FF4FA
NameSamCompatible, xrefs: 00007FF8E69FF105
STD_OUTPUT_HANDLE, xrefs: 00007FF8E69FF06F
VOS_UNKNOWN, xrefs: 00007FF8E69FF2A4
GetUserNameExW, xrefs: 00007FF8E69FF467
GetDllDirectoryW, xrefs: 00007FF8E69FF56D
STD_ERROR_HANDLE, xrefs: 00007FF8E69FF08D
VFT_DLL, xrefs: 00007FF8E69FF351
VS_FF_PATCHED, xrefs: 00007FF8E69FF3EB
REG_NOTIFY_CHANGE_SECURITY, xrefs: 00007FF8E69FF1E1
NameUserPrincipal, xrefs: 00007FF8E69FF15D
STD_INPUT_HANDLE, xrefs: 00007FF8E69FF051
VOS_DOS, xrefs: 00007FF8E69FF1F7
RegDeleteKeyTransactedW, xrefs: 00007FF8E69FF767
RegDeleteKeyExW, xrefs: 00007FF8E69FF750
RegOpenKeyTransactedW, xrefs: 00007FF8E69FF739
RegSaveKeyExW, xrefs: 00007FF8E69FF70B
GlobalMemoryStatusEx, xrefs: 00007FF8E69FF528
GetComputerObjectNameW, xrefs: 00007FF8E69FF477
MonitorFromRect, xrefs: 00007FF8E69FF653
NameDisplay, xrefs: 00007FF8E69FF11B
VFT_FONT, xrefs: 00007FF8E69FF37D
GetLongPathNameA, xrefs: 00007FF8E69FF4D3
VOS__PM32, xrefs: 00007FF8E69FF291
error, xrefs: 00007FF8E69FF033
VOS__WINDOWS16, xrefs: 00007FF8E69FF223
NameCanonical, xrefs: 00007FF8E69FF147
VS_FF_PRERELEASE, xrefs: 00007FF8E69FF401
ChangeDisplaySettingsExW, xrefs: 00007FF8E69FF625
VFT_APP, xrefs: 00007FF8E69FF33B
GetLongPathNameW, xrefs: 00007FF8E69FF4EA
RegOverridePredefKey, xrefs: 00007FF8E69FF7C3

Memory Dump Source

Source File: 00000002.00000002.2625919470.00007FF8E69F1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E69F0000, based on PE: true

Associated: 00000002.00000002.2625872770.00007FF8E69F0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.2625975165.00007FF8E6A03000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.2626024195.00007FF8E6A0E000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.2626091431.00007FF8E6A11000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e69f0000_user.jbxd

Similarity

API ID: Module_$Constant$AddressProc$Dict_ItemString$HandleLibraryLoadModule$FromLongLong_$CallerCreate2DictEnsure@@Globals_ReadyType_
String ID: Advapi32.dll$ChangeDisplaySettingsExW$EnumDisplayDevicesW$EnumDisplayMonitors$EnumDisplaySettingsExW$GetComputerNameExW$GetComputerObjectNameW$GetDllDirectoryW$GetHandleInformation$GetLastInputInfo$GetLongPathNameA$GetLongPathNameW$GetMonitorInfoW$GetNativeSystemInfo$GetSystemFileCacheSize$GetUserNameExW$GlobalMemoryStatusEx$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$NameCanonical$NameCanonicalEx$NameDisplay$NameFullyQualifiedDN$NameSamCompatible$NameServicePrincipal$NameUniqueId$NameUnknown$NameUserPrincipal$PyDISPLAY_DEVICEType$REG_NOTIFY_CHANGE_ATTRIBUTES$REG_NOTIFY_CHANGE_LAST_SET$REG_NOTIFY_CHANGE_NAME$REG_NOTIFY_CHANGE_SECURITY$RegCopyTreeW$RegCreateKeyTransactedW$RegDeleteKeyExW$RegDeleteKeyTransactedW$RegDeleteTreeW$RegOpenCurrentUser$RegOpenKeyTransactedW$RegOverridePredefKey$RegRestoreKeyW$RegSaveKeyExW$STD_ERROR_HANDLE$STD_INPUT_HANDLE$STD_OUTPUT_HANDLE$SetDllDirectoryW$SetHandleInformation$SetSystemFileCacheSize$SetSystemPowerState$VFT_APP$VFT_DLL$VFT_DRV$VFT_FONT$VFT_STATIC_LIB$VFT_UNKNOWN$VFT_VXD$VOS_DOS$VOS_DOS_WINDOWS16$VOS_DOS_WINDOWS32$VOS_NT$VOS_NT_WINDOWS32$VOS_OS216$VOS_OS216_PM16$VOS_OS232$VOS_OS232_PM32$VOS_UNKNOWN$VOS__PM16$VOS__PM32$VOS__WINDOWS16$VOS__WINDOWS32$VS_FF_DEBUG$VS_FF_INFOINFERRED$VS_FF_PATCHED$VS_FF_PRERELEASE$VS_FF_PRIVATEBUILD$VS_FF_SPECIALBUILD$error$kernel32.dll$secur32.dll$user32.dll
API String ID: 1655756704-685172649
Opcode ID: a7487b2dee23a116e8347555e7407e29fd53b6a731b5dd2c7359c43d764bff69
Instruction ID: 7856379488970614fe69515d86eb39ebdab581d62b2b2d19482d7ac509bc6842
Opcode Fuzzy Hash: a7487b2dee23a116e8347555e7407e29fd53b6a731b5dd2c7359c43d764bff69
Instruction Fuzzy Hash: 4422F464F29B0391EA849B95E99A3743BA1FF5ABD0F845035C80E47760AF7DE189C343

Function 00007FF8E6A31330 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 260
threadcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3137C
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A31394
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A313AC
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A313DE
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A313F3
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3140F
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A31556
PyErr_Format.PYTHON313 ref: 00007FF8E6A31579
PyErr_SetString.PYTHON313 ref: 00007FF8E6A315A2
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A315AC
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A315CF
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A31607
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A3161A
CoCreateInstance.COMBASE ref: 00007FF8E6A31641
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3165C
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A316AD
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A316C5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A316DC
PyErr_Clear.PYTHON313 ref: 00007FF8E6A316E7
PyErr_SetString.PYTHON313 ref: 00007FF8E6A316FE
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A31704
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A31719
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A31731

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A31750
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A31405
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A3173B
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A314FF
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A3144C, 00007FF8E6A31564
_oleobj_, xrefs: 00007FF8E6A314DA
OOiO:CoCreateInstance, xrefs: 00007FF8E6A31375
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A316ED

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Eval_Object_Thread$D@@@InstanceRestoreSaveStringU_object@@$Dealloc$Arg_ClearCreateDict_FormatFromItemOccurredParseSubclassTuple
String ID: OOiO:CoCreateInstance$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 490376945-835438780
Opcode ID: e0db31c0a3172582a73f09f7ddf91617fb67f09ea01f749cd19af58f17944bb1
Instruction ID: 1198dfe1b54649b5c17e2586614596680139e234056b2402a3863f1369ee6e7d
Opcode Fuzzy Hash: e0db31c0a3172582a73f09f7ddf91617fb67f09ea01f749cd19af58f17944bb1
Instruction Fuzzy Hash: FCC11865F68A43C2EA109BA5E85A37973A1FF88BD5F484436CE5E47664DF3CF8048702

Function 00007FF653F01000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF653F03882, 00007FF653F038AF
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF653F03A0B, 00007FF653F03CD4, 00007FF653F03F6B
Py_GIL_DISABLED, xrefs: 00007FF653F03AF4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF653F03A17, 00007FF653F03A2F, 00007FF653F03A9B
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF653F039DE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF653F03EA6
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF653F03971
VCRUNTIME140.dll, xrefs: 00007FF653F03DB1
Failed to convert DLL search path!, xrefs: 00007FF653F03DDC
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF653F03EBB
Failed to load splash screen resources!, xrefs: 00007FF653F03E85
_PYI_ARCHIVE_FILE, xrefs: 00007FF653F038D2, 00007FF653F039FF
pyi-contents-directory, xrefs: 00007FF653F03B8D
MEI, xrefs: 00007FF653F03933
Could not create temporary directory!, xrefs: 00007FF653F03CBF
pyi-runtime-tmpdir, xrefs: 00007FF653F03B68
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF653F03B32
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF653F03BE8
_PYI_SPLASH_IPC, xrefs: 00007FF653F03A23, 00007FF653F03EF5
pyi-python-flag, xrefs: 00007FF653F03AD6
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF653F03D35
pkg, xrefs: 00007FF653F039BE
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF653F03D12
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF653F03C61
pyi-disable-windowed-traceback, xrefs: 00007FF653F03BB2
Failed to start splash screen!, xrefs: 00007FF653F03ED4
Failed to remove temporary directory: %s, xrefs: 00007FF653F03FCF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF653F03E0A

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction ID: 6f1148d2599242c5b2dfd5bd3867833bb3dda389e09b1707573d3dbd7b3c30f2
Opcode Fuzzy Hash: d52c1960cc45de78c26c9f57622ace5a14626686e839aa839f1fc42fe00fc1f1
Instruction Fuzzy Hash: 59327121A2C68291FB15DB69D9573B966A3AF44F44F8C4032DA5EF32D6EF2CE558C300

Function 00007FF653F26964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F266D9
Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F26757
Part of subcall function 00007FF653F26698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF653F267A8

CreateFileW.KERNEL32 ref: 00007FF653F26A6A
CreateFileW.KERNEL32 ref: 00007FF653F26ABA
GetLastError.KERNEL32 ref: 00007FF653F26AEA
GetFileType.KERNEL32 ref: 00007FF653F26AFF
GetLastError.KERNEL32 ref: 00007FF653F26B09
CloseHandle.KERNEL32 ref: 00007FF653F26B3C
CloseHandle.KERNEL32 ref: 00007FF653F26C9F
CreateFileW.KERNEL32 ref: 00007FF653F26CD4
GetLastError.KERNEL32 ref: 00007FF653F26CE3

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: c0df3d7ab4698e2bc700680b1ac1df8c4526abcf32db50eed6dd3cc41c0dc4ea
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 0EC1A036B28A86C5EB10CFA5D9926AC3762F749F98B094235EE1EB7794CF38D451C700

Function 00007FF653F09280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF653F092B3
FindClose.KERNEL32 ref: 00007FF653F092C2

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 25c36eecb776269812dfb5f67d1a7147d46a34bf3760cb8077b9a7a8e6296dde
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 63F0CD22A2C74187F7A08B54B8967667351AB44B24F080335D96E736D4DF3CD058CA00

Function 00007FF8E6A2B360 Relevance: 93.5, APIs: 47, Strings: 6, Instructions: 727COMMON

Download Yara Rule

APIs

PyErr_Clear.PYTHON313 ref: 00007FF8E6A2B393
PyObject_Size.PYTHON313 ref: 00007FF8E6A2B39C
PyErr_Format.PYTHON313 ref: 00007FF8E6A2B3C4
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A2B3D3
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A2B3E1
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A2B3EF
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A2B409
PyObject_Size.PYTHON313 ref: 00007FF8E6A2B41B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2B531
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2BDA0

Strings

not enough arguments (at least 5 needed), xrefs: 00007FF8E6A2B3B3
Allocating ArgHelpers array, xrefs: 00007FF8E6A2B520
The array of argument types must be a tuple whose size is <= to the number of arguments., xrefs: 00007FF8E6A2BE4C
The Python object is invalid, xrefs: 00007FF8E6A2B738
The return type information could not be parsed, xrefs: 00007FF8E6A2BD00
value, xrefs: 00007FF8E6A2BB8E, 00007FF8E6A2BC63

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$LongLong_$Object_Size$ClearDeallocFormatOccurredString
String ID: Allocating ArgHelpers array$The Python object is invalid$The array of argument types must be a tuple whose size is <= to the number of arguments.$The return type information could not be parsed$not enough arguments (at least 5 needed)$value
API String ID: 2033694642-4244552354
Opcode ID: eec55bf21228184a5226df997738aaa74b7416cdae626d13d11f0294432222ce
Instruction ID: 84d999f1ca7668f69a8e91cd33fd96b5c44b6c1f41129ca58b91bf598404efc5
Opcode Fuzzy Hash: eec55bf21228184a5226df997738aaa74b7416cdae626d13d11f0294432222ce
Instruction Fuzzy Hash: 82627932F28A428AEB148FA5D8467B867A4FB45BD8F544236DE1E63B94DF3CE444C701

Function 00007FF8E6A32950 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 126
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A32972
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3298A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A329AE
GetActiveObject.OLEAUT32 ref: 00007FF8E6A329C3
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A329CE
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A329F1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A32A21
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A32A44
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A32A5C
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A32A72
PyErr_Clear.PYTHON313 ref: 00007FF8E6A32A7D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A32A94
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A32A9A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A32AAF
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A32AC1

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A32AE0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A32ACB
O:Connect, xrefs: 00007FF8E6A3296B
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A32A83

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Object_RestoreSave$D@@@Err_U_object@@$ActiveArg_ClearDeallocDict_FromItemObjectParseStringSubclassTuple
String ID: O:Connect$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3189202653-685158464
Opcode ID: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction ID: a061e5e3ce141effc02278a9d7770818addb18fe51b027dcf62f67b09d729834
Opcode Fuzzy Hash: fb32afdec469271614cca1a4a8ef09c28be4a29631b2a3156b5743866c1a9132
Instruction Fuzzy Hash: D2511721F28B4382EA249FA6E85627963A1FF88BD4F484036DE5E47765DF3CE5058702

Function 00007FF8E6AE5ED0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyUnicode_AsWideCharString.PYTHON313 ref: 00007FF8E6AE5F22
PyErr_SetString.PYTHON313 ref: 00007FF8E6AE5F56
PyMem_Free.PYTHON313 ref: 00007FF8E6AE5F6A
PyErr_Clear.PYTHON313 ref: 00007FF8E6AE6037
PyErr_SetString.PYTHON313 ref: 00007FF8E6AE604E

Strings

Objects of type '%s' can not be converted to Unicode., xrefs: 00007FF8E6AE6027
None is not a valid string in this context, xrefs: 00007FF8E6AE5FFC
value is larger than a DWORD, xrefs: 00007FF8E6AE5F4C
Only strings and iids can be converted to a CLSID., xrefs: 00007FF8E6AE6044
<NULL!!>, xrefs: 00007FF8E6AE6019

Memory Dump Source

Source File: 00000002.00000002.2626564641.00007FF8E6AE1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8E6AE0000, based on PE: true

Associated: 00000002.00000002.2626533701.00007FF8E6AE0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2626615099.00007FF8E6AF1000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2626664675.00007FF8E6AFF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2626712654.00007FF8E6B02000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6ae0000_user.jbxd

Similarity

API ID: Err_String$CharClearFreeMem_Unicode_Wide
String ID: <NULL!!>$None is not a valid string in this context$Objects of type '%s' can not be converted to Unicode.$Only strings and iids can be converted to a CLSID.$value is larger than a DWORD
API String ID: 443722841-2914159855
Opcode ID: 37b0708b124ef805f6eafb4413cb45e7aa50632965b2a1696fc48efc4bb87208
Instruction ID: cfac28127ec5740e2e583132123146bb708bdaa20267a05c4eea158d9737c7eb
Opcode Fuzzy Hash: 37b0708b124ef805f6eafb4413cb45e7aa50632965b2a1696fc48efc4bb87208
Instruction Fuzzy Hash: 33415D71F2CA4282EE508B96F45A37963A0FF88BD4F489135D90E47765DF6DE8898303

Function 00007FF8E6A71010 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 178
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON313(?,?,?,?,?,?,?,?,?,00007FF8E6A70F55), ref: 00007FF8E6A71026
LHashValOfNameSys.OLEAUT32 ref: 00007FF8E6A7103C
PyEval_RestoreThread.PYTHON313(?,?,?,?,?,?,?,?,?,00007FF8E6A70F55), ref: 00007FF8E6A7107C
PyTuple_New.PYTHON313(?,?,?,?,?,?,?,?,?,00007FF8E6A70F55), ref: 00007FF8E6A710E4
PyTuple_New.PYTHON313(?,?,?,?,?,?,?,?,?,00007FF8E6A70F55), ref: 00007FF8E6A71282
PyLong_FromLong.PYTHON313(?,?,?,?,?,?,?,?,?,00007FF8E6A70F55), ref: 00007FF8E6A71294

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A711E4
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A711CF
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A711A2

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocFromTuple_$BuildErr_ErrorHashInfoLongLong_NameObjectObject_U_object@@Value
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3698739723-49823770
Opcode ID: 5804f62f2bd91cdc706f36869b61dbd82ed5bf92c8980cc4d7a103c0c7ca2645
Instruction ID: adf38ebdd699dc96feb142c5b2a32dc9edd32b11238aebd12ac05c74acaea6ab
Opcode Fuzzy Hash: 5804f62f2bd91cdc706f36869b61dbd82ed5bf92c8980cc4d7a103c0c7ca2645
Instruction Fuzzy Hash: 5A714F22F19A4282EA549BA5E85A37963E0FF99FE4F484035CE5D47B94DF3CF8448702

Function 00007FF8E6A2BE90 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A2BEBF
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2BEDC
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2BF0C
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2BF32
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A2BF9E
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A2BFB6
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2BFCC
PyErr_Clear.PYTHON313 ref: 00007FF8E6A2BFD7
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2BFEE
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2BFF4
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2C009

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A2C04C
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A2C037
The Python object is invalid, xrefs: 00007FF8E6A2BECE
|ii:GetTypeInfo, xrefs: 00007FF8E6A2BEB8
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A2BFDD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSaveString$Arg_ClearD@@@DeallocDict_FromItemObject_ParseTupleU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|ii:GetTypeInfo
API String ID: 2945167311-1333789200
Opcode ID: c12a8f3d87f37f9b06d4fb00c08d740b5285eb880e27b4f63054bd0b6c6bdd9d
Instruction ID: 09368ef91ecc2858e63ccdbcc35d533636437bcdcd548d0612185e17c9d45af9
Opcode Fuzzy Hash: c12a8f3d87f37f9b06d4fb00c08d740b5285eb880e27b4f63054bd0b6c6bdd9d
Instruction Fuzzy Hash: 90517B76F68B4282EA509F96F8026A963A4FF88BE4F484035DE5E07754DF3CE445C702

Function 00007FF8E6BC4760 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON313 ref: 00007FF8E6BC4791
PyObject_GetAttr.PYTHON313 ref: 00007FF8E6BC47DD
PyUnicode_FromFormat.PYTHON313 ref: 00007FF8E6BC47FD
PyObject_GetItem.PYTHON313 ref: 00007FF8E6BC4815
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC482C
PyDict_SetItem.PYTHON313 ref: 00007FF8E6BC484D
PyObject_SetItem.PYTHON313 ref: 00007FF8E6BC4855
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC486B
PyErr_Clear.PYTHON313 ref: 00007FF8E6BC489B
PyModule_GetFilenameObject.PYTHON313 ref: 00007FF8E6BC48A4
PyUnicode_FromFormat.PYTHON313 ref: 00007FF8E6BC48C2
PyErr_SetImportError.PYTHON313 ref: 00007FF8E6BC48D9
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC48ED
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC4901
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC4915

Strings

%U.%U, xrefs: 00007FF8E6BC47F3
cannot import name %R from %R (%S), xrefs: 00007FF8E6BC48B2

Memory Dump Source

Source File: 00000002.00000002.2627236177.00007FF8E6BC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FF8E6BC0000, based on PE: true

Associated: 00000002.00000002.2627204687.00007FF8E6BC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627311785.00007FF8E6BD5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627361439.00007FF8E6BDB000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627390508.00007FF8E6BDF000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6bc0000_user.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction ID: 4c4d5f41ef8108bff92cdc12481fb4b69303c2c3ddd592ce7996c068abaf0b25
Opcode Fuzzy Hash: aea79ed82b41080dcdede2459c0bc734a1ab5dbcbebbb0792b6c7292410103bd
Instruction Fuzzy Hash: 09518032A28A9295EB148FA2A94477A77A0BB89FD5F444430CE4D4BB55DF3CE245C342

Function 00007FF653F01950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF653F07F90: _fread_nolock.LIBCMT ref: 00007FF653F0803A

_fread_nolock.LIBCMT ref: 00007FF653F01A1B

Part of subcall function 00007FF653F02910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF653F01B6A), ref: 00007FF653F0295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF653F019EE
Failed to read cookie!, xrefs: 00007FF653F01A2B
Could not read full TOC!, xrefs: 00007FF653F01B55
Could not allocate memory for archive structure!, xrefs: 00007FF653F01A61
Could not allocate buffer for TOC!, xrefs: 00007FF653F01B1B
malloc, xrefs: 00007FF653F01B22
fread, xrefs: 00007FF653F01A32, 00007FF653F01B5C
calloc, xrefs: 00007FF653F01A68
Error on file., xrefs: 00007FF653F01B8D
MEI, xrefs: 00007FF653F01991
fseek, xrefs: 00007FF653F019F5

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
Instruction ID: 029d99e68dd487bbcfacb5923a1cb7f62739487c84acfd97c446f2610257d53b
Opcode Fuzzy Hash: ee3080450604db9b79bcaf6ea9780d01564dfb64de786eed8711188a6f6cabc7
Instruction Fuzzy Hash: 8A819475A2868686EB20DB18E5436F933A2EF84F44F488435ED8EF7785DE3CE5458740

Function 00007FF8E6BC9263 Relevance: 19.6, APIs: 13, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8E6BC42E0: PyUnicode_FromStringAndSize.PYTHON313 ref: 00007FF8E6BC43E9
Part of subcall function 00007FF8E6BC42E0: PyUnicode_InternInPlace.PYTHON313 ref: 00007FF8E6BC4402

_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC92CB
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9300
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9318
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC933B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC935E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9381
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC93A4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC93C7
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC93EA
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC940D
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9430
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9453
_Py_Dealloc.PYTHON313 ref: 00007FF8E6BC9476

Memory Dump Source

Source File: 00000002.00000002.2627236177.00007FF8E6BC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FF8E6BC0000, based on PE: true

Associated: 00000002.00000002.2627204687.00007FF8E6BC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627311785.00007FF8E6BD5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627361439.00007FF8E6BDB000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627390508.00007FF8E6BDF000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6bc0000_user.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction ID: dfc2bc85a9be817f67ff99946cb1d05ea028ae7a8a62cc1d304f1fbaa43d7be2
Opcode Fuzzy Hash: e3abe80e124aa434e129e5a5323edaca9fc8b80d125148bed174b3bde365830c
Instruction Fuzzy Hash: 2B710736D6AA0395FA65AFE4AD4433533A4BFC0BD5F144930C52D8A6A1DF3EA242C313

Function 00007FF8E6A440B0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 54
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?PyWin_AcquireGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FF8E6A34322), ref: 00007FF8E6A440BF
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6A440CF
GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF8E6A34322), ref: 00007FF8E6A440E8
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF8E6A34322), ref: 00007FF8E6A44104
?PyWin_ReleaseGlobalLock@@YAXXZ.PYWINTYPES313(?,?,?,?,?,00007FF8E6A34322), ref: 00007FF8E6A44160

Strings

CoInitializeEx failed (0x%08lx), xrefs: 00007FF8E6A4412D
CoInitializeEx, xrefs: 00007FF8E6A440FA
ole32.dll, xrefs: 00007FF8E6A440E1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: GlobalLock@@Win_$AcquireAddressCurrentHandleModuleProcReleaseThread
String ID: CoInitializeEx$CoInitializeEx failed (0x%08lx)$ole32.dll
API String ID: 2699693448-4213856137
Opcode ID: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction ID: f6055452a1369a1b162a1d61f2474e7dc50ef65e9e3ec353261d73a794788198
Opcode Fuzzy Hash: 8a952fc43bd525437a0d6f348abac8e58cc68f4b7ebf1dc6150318704ae46fdd
Instruction Fuzzy Hash: 26215E20F2C20786F7909BE9FC4637A2692FF697D5F14403DC90D862A1EEBDB4948613

Function 00007FF653F01470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF653F014DE
malloc, xrefs: 00007FF653F0151F
fread, xrefs: 00007FF653F015E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF653F0149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF653F015DF
fseek, xrefs: 00007FF653F014E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF653F01518

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 3b379cfcfb123380b7207fe9b70de138e86c6d94a3f87720caf8569e0a5fbbd0
Instruction ID: aa7f794fe0d3abc7bcc3e9fb26c8ac8328d9bb5245cb7d0909fb0e5117feb772
Opcode Fuzzy Hash: 3b379cfcfb123380b7207fe9b70de138e86c6d94a3f87720caf8569e0a5fbbd0
Instruction Fuzzy Hash: 0941B235A2868286EB10DB65E9425B96392FF44F84F4C4432ED4EBBB95DF3CE542C700

Function 00007FF653F01210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF653F012C1, 00007FF653F012F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF653F012BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF653F012EF
1.3.1, xrefs: 00007FF653F01249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF653F0141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF653F01276

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 9b2da8e32cee601306ebcebf5d16e93c03482fa50eddd1a53150bf2cf71a648a
Instruction ID: 101883517acd0e3675cfaf44fbdc243f9aff0ce228241cdac421b969071278d0
Opcode Fuzzy Hash: 9b2da8e32cee601306ebcebf5d16e93c03482fa50eddd1a53150bf2cf71a648a
Instruction Fuzzy Hash: F2512866A2868281EA209B19E8423BA6293FF85F94F4C4131ED4EF77D5EF3CE445C700

Function 00007FF653F036B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF653F03804), ref: 00007FF653F036E1
GetLastError.KERNEL32(?,00007FF653F03804), ref: 00007FF653F036EB

Part of subcall function 00007FF653F02C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02C9E
Part of subcall function 00007FF653F02C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF653F03706,?,00007FF653F03804), ref: 00007FF653F02D63
Part of subcall function 00007FF653F02C50: MessageBoxW.USER32 ref: 00007FF653F02D99

Strings

\\?\, xrefs: 00007FF653F0375A
Failed to convert executable path to UTF-8., xrefs: 00007FF653F03790
Failed to resolve full path to executable %ls., xrefs: 00007FF653F03739
Failed to obtain executable path., xrefs: 00007FF653F036F3
GetModuleFileNameW, xrefs: 00007FF653F036FA

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 7c9025d879be53a4a17c58ea6e91d9bad98bb5d8c12ec42be0f2074c83987bdc
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 8A218361B3C68291FA20D728ED523BA6292BF88B54F484132E65FF75E5EE2CE504C740

Function 00007FF653F1BA5C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1BE89

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 8d8e2ca3f0ded474f2a51296c36356b5f9816522e6992a25c36b39252dae521c
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: F4C1DFB2A2C686D1E6648B15E4422BE3B62FBC1F90F5D4131EA4EB3791CF7DE8558700

Function 00007FF653F06360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

ucrtbase.dll, xrefs: 00007FF653F063DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF653F06456
LoadLibrary, xrefs: 00007FF653F064AE
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF653F06407
Failed to load Python DLL '%ls'., xrefs: 00007FF653F064A7
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF653F063C7

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: ba9e228f831235ea05b0c7ec56d340b2d1b9b4ff490d714e99797dd8626da206
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 8B41A331A28AC7D1EA21DB29E9161ED6353FF44B44F880132EA5EB3295EF3CE509C740

Function 00007FF8E6A70EA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A70ECA
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A70EE8
PyErr_SetString.PYTHON313 ref: 00007FF8E6A70F40
?PyWinObject_FreeBstr@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A70F5D

Strings

The Python object is invalid, xrefs: 00007FF8E6A70F32
O|i:Bind, xrefs: 00007FF8E6A70EBC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Bstr@@Object_$Arg_Err_FreeParseStringTupleU_object@@
String ID: O|i:Bind$The Python object is invalid
API String ID: 3061223275-2584696442
Opcode ID: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction ID: 8abe1de3094e4265ecc2f1fca0cbd36687d48185b72fc2e980cd3e0e620ec2eb
Opcode Fuzzy Hash: 0d960c27681c90812c89b8f24a092050a8bec021980732a51c3a71dcb4ad7379
Instruction Fuzzy Hash: 41214266F2874282EF548F96F44526AA3A0FF88BE4B480436EE5D07B58DF7CE445C701

Function 00007FF653F15628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F15655
CreateFileW.KERNEL32 ref: 00007FF653F15694
CloseHandle.KERNEL32 ref: 00007FF653F156C9

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: d109240ed295eec31f2791edf69e3a9853b065d7dfd2f001f253aecc1c0b7376
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 4841A4B2D3878283E7148B20E5123797261FB94BA4F148335EA9C63AD1DF7CE4E08740

Function 00007FF653F0CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF653F0CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF653F0CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF653F0CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF653F0CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF653F0CD21

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: b704c9a3671d367279017fa028cb42cf0648f3a74309811f7e3e3c77ad31361d
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: A0313C25E2914781FA14AB69E9533BA16C39F41F88F4C5034E95FFB2D7DE2CF9048281

Function 00007FF8E6BD2BDD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF8E6BD2BE9

Strings

<module>, xrefs: 00007FF8E6BD3EFB

Memory Dump Source

Source File: 00000002.00000002.2627236177.00007FF8E6BC1000.00000020.00000001.01000000.00000017.sdmp, Offset: 00007FF8E6BC0000, based on PE: true

Associated: 00000002.00000002.2627204687.00007FF8E6BC0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627311785.00007FF8E6BD5000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627361439.00007FF8E6BDB000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000002.00000002.2627390508.00007FF8E6BDF000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6bc0000_user.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction ID: a15859fe2096d30e8afe8aff77a7334385d2af488c89ab707a42309d07bd3192
Opcode Fuzzy Hash: 38ba6ef64a3c4e3da176dcc799c31920718849fe8b93e96334157dff539b19ff
Instruction Fuzzy Hash: CBF03AA5E2AA4741FA119BD5AC003B536107FC1BD5F400432D91D4A2A1DD3CF5828312

Function 00007FF653F1013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10277

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 4bfa3a8946d0c955afd483b899b88bb92e27290810ed1a801af087e63324fd86
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 98510BB1B2928386FB649A26E40267A6693BF84FA4F1C4735ED7DB77D5CE3CD4018600

Function 00007FF653F1C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF653F1C2CD), ref: 00007FF653F1C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF653F1C2CD), ref: 00007FF653F1C18A

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 823fe7ce4ec10ae09a58a95c9b71f79767512926ac736367d5f1e1dcc399faec
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 341104B2A28A8181DA608B25F8110696362AB41FF4F580331EEBDB77E9CE7CD4108700

Function 00007FF653F1AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF653F1A9D5,?,?,00000000,00007FF653F1AA8A), ref: 00007FF653F1ABC6
GetLastError.KERNEL32(?,?,?,00007FF653F1A9D5,?,?,00000000,00007FF653F1AA8A), ref: 00007FF653F1ABD0

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 94550033bc6b0540cfba2566c8ce62b84250361bb12b75558da3388e6ead4e20
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: 7E216FB1B3878241EEA597A5F59227A16939F84FA4F0C4239EA2EF77D1CE6CE4414310

Function 00007FF653F1BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1BED4

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: d150eacb5ea3484084e236b680b552bf3ce24a9003247ae6d8707ca38795b510
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 3041D672928245C7EA349B99F54227973A2EB95F91F180131D68EF36D1CF2CE802DB51

Function 00007FF653F07F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF653F0803A

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 09e0edd5bfc77bffd2ce204413b85077ed061b6568614956a0855b02b1706b89
Instruction ID: 4e28151d87e3ad88121e8f35d686c8ca4d698455f3a1798c91082761c69b3219
Opcode Fuzzy Hash: 09e0edd5bfc77bffd2ce204413b85077ed061b6568614956a0855b02b1706b89
Instruction Fuzzy Hash: AE21D621B2879246FA119A26BA063FA9652BF45FD4F8C4430EE4EB7786CE7DE041C300

Function 00007FF653F1B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F1B9C2

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 592ac17fe1b118f7583fd9ae5d37af1e7b7b359723c94ae59786525fd8c1c559
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: 193150B2A3861285E6115B55E44237C2AA2AFC0FA4F890135E95DB73D2CF7CE8528711

Function 00007FF653F15F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F15EF9

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: d1fcebdb9db8a72b157d3af17a6c033c196c74a93570645305f170760865c1a6
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 2F1163B1A3C64181EA609F11F40217DA266BF85F84F4C4431EA4CF7B96CF7DD4109710

Function 00007FF653F26354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F26377

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 8febc2df9162f2e693ba1f5cad775494dad32bba61baa145e95e42b7a7656f67
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: F421D772628A81C6EB618F18E94177976A2FB84F54F184234FA9DE77D9DF7CD8018B00

Function 00007FF653F103BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF653F10410

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 65b6a90bd5481facd2b20c52bae4deeee30543804b42c0832896245a9005e014
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 960188B1A2874681E904DF52E942579A696BF85FE0F4C4631EE5CB7BD6CE3CE4119300

Function 00007FF653F08E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF653F09390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF653F045F4,00000000,00007FF653F01985), ref: 00007FF653F093C9

LoadLibraryExW.KERNEL32(?,00007FF653F06476,?,00007FF653F0336E), ref: 00007FF653F08EA2

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 5767a5ed603dc2f3fc38c0e7700b13ac3d86e8561c2043cb07cfc7b0cb48e388
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: F7D08C11B3828542EA48A76BBA4763A5252AB89FC0F8C8035EE0D67B5AEC3CC0514B00

Function 00007FF653F1D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF653F10C90,?,?,?,00007FF653F122FA,?,?,?,?,?,00007FF653F13AE9), ref: 00007FF653F1D63A

Memory Dump Source

Source File: 00000002.00000002.2625625066.00007FF653F01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF653F00000, based on PE: true

Associated: 00000002.00000002.2625581474.00007FF653F00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625680575.00007FF653F2B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625729004.00007FF653F41000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2625820472.00007FF653F44000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff653f00000_user.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 96cde7c94b1af91993bee0578af45a171717d17f6710c11b98fa48e2ec77c821
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 5DF0F8A0F39A4785FE6567B1A94367522A65FD4FA0F0C0730ED2EF72C2DE2CE4909650

Non-executed Functions

Function 00007FF8E6A28550 Relevance: 68.7, APIs: 36, Strings: 3, Instructions: 407threadCOMMON

Download Yara Rule

APIs

PyNumber_Check.PYTHON313 ref: 00007FF8E6A285B4
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A285C1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A285D7
PySequence_Check.PYTHON313 ref: 00007FF8E6A285E4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A285FB
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A28623
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A28638
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2864E
PyObject_Size.PYTHON313 ref: 00007FF8E6A28657
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A28672
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A28687
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2869E
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A286B2
PyTuple_Size.PYTHON313 ref: 00007FF8E6A286E9
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A28703
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A28736
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A287B2
PyTuple_GetItem.PYTHON313 ref: 00007FF8E6A2880D
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2887C
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A28897
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A288D9
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A288EF
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A288FE
VariantClear.OLEAUT32 ref: 00007FF8E6A2890B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A28922

Part of subcall function 00007FF8E6A75CB0: _Py_Dealloc.PYTHON313(?,?,00000000,00007FF8E6A74DFF), ref: 00007FF8E6A75CD1
Part of subcall function 00007FF8E6A75CB0: PyEval_SaveThread.PYTHON313(?,?,00000000,00007FF8E6A74DFF), ref: 00007FF8E6A75D12

PyErr_Occurred.PYTHON313 ref: 00007FF8E6A289FD
SysFreeString.OLEAUT32 ref: 00007FF8E6A28A5D
SysFreeString.OLEAUT32 ref: 00007FF8E6A28A74
SysFreeString.OLEAUT32 ref: 00007FF8E6A28A8B
SysFreeString.OLEAUT32 ref: 00007FF8E6A28AB6
SysFreeString.OLEAUT32 ref: 00007FF8E6A28AC9
SysFreeString.OLEAUT32 ref: 00007FF8E6A28AE0
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A28AFC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A28B18
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A28B31

Strings

Python error invoking COM method., xrefs: 00007FF8E6A28A1E
The Python function did not return the correct type, xrefs: 00007FF8E6A28601
Too many results supplied - %d supplied, but only %d can be set, xrefs: 00007FF8E6A28967

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$FreeString$Eval_ItemSequence_Thread$LongLong_Save$CheckRestoreSizeTuple_$ClearErr_Number_Object_OccurredVariantmalloc
String ID: Python error invoking COM method.$The Python function did not return the correct type$Too many results supplied - %d supplied, but only %d can be set
API String ID: 2419934528-3825184329
Opcode ID: 784f2b335ed5301804b88cb7e9238594253a6a8f08a317e24b2561b96a163a7f
Instruction ID: 54ceee1e3aab6df7f7ec0bf4663ad46352e0104ab0b32114928e438f57d414d9
Opcode Fuzzy Hash: 784f2b335ed5301804b88cb7e9238594253a6a8f08a317e24b2561b96a163a7f
Instruction Fuzzy Hash: 08027A32F2964286EB649FE1D95677823A0FF54BE8F048535EA1E47B94DF3CA4588302

Function 00007FF8E6A4A880 Relevance: 68.5, APIs: 24, Strings: 15, Instructions: 237threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4A905
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A4A923
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A4A936
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4A952
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A4A97B
PyErr_Format.PYTHON313 ref: 00007FF8E6A4A99E
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4A9C2
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4A9CF
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4A9F5
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A4AA2A
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4AA38
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4AB3E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4ABBE
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A4ABED
Py_BuildValue.PYTHON313 ref: 00007FF8E6A4AC89
CoTaskMemFree.OLE32 ref: 00007FF8E6A4AC9A

Strings

ImpLevel, xrefs: 00007FF8E6A4AC43
AuthnSvc, xrefs: 00007FF8E6A4AC09
Capabilities, xrefs: 00007FF8E6A4AC14
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A4AA3E
AuthInfo, xrefs: 00007FF8E6A4AC2C
AuthzSvc, xrefs: 00007FF8E6A4ABFA
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A4A989, 00007FF8E6A4AA89
O:QueryBlanket, xrefs: 00007FF8E6A4A8C8
{s:k, s:k, s:N, s:k, s:k, s:O, s:k}, xrefs: 00007FF8E6A4AC66
AuthnLevel, xrefs: 00007FF8E6A4AC5A
ServerPrincipalName, xrefs: 00007FF8E6A4AC72
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A4A941
The Python object is invalid, xrefs: 00007FF8E6A4A89B
None is not a valid interface object in this context, xrefs: 00007FF8E6A4A8EC, 00007FF8E6A4A968, 00007FF8E6A4AA5A
_oleobj_, xrefs: 00007FF8E6A4AA20

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Eval_Object_StringThread$InstanceRestoreSave$AttrBuildClearFormatFreeFromOccurredTaskU_object@@Value
String ID: AuthInfo$AuthnLevel$AuthnSvc$AuthzSvc$Capabilities$ImpLevel$None is not a valid interface object in this context$O:QueryBlanket$ServerPrincipalName$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)${s:k, s:k, s:N, s:k, s:k, s:O, s:k}
API String ID: 524826855-701739339
Opcode ID: 08d822bdeb83b6d7e03afaa67bfe1e0f3924da3af12c117e9b466ecddb885818
Instruction ID: 40b6a58320c303d2f6da19b641b9a77bd154df7060ef4bf6468a50deeec858f8
Opcode Fuzzy Hash: 08d822bdeb83b6d7e03afaa67bfe1e0f3924da3af12c117e9b466ecddb885818
Instruction Fuzzy Hash: 71C11A75F28A4281EA609F91E8963B963A1FF88BE4F444036CE5E47764DF3CE449C702

Function 00007FF8E6A5F690 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 207COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5F6AE
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5F6CB
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5F6F3

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A5F763
The Python object is invalid, xrefs: 00007FF8E6A5F6C4
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A5F85D
None is not a valid interface object in this context, xrefs: 00007FF8E6A5F714, 00007FF8E6A5F78A, 00007FF8E6A5F879
O:IsEqual, xrefs: 00007FF8E6A5F6A4
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A5F7AB, 00007FF8E6A5F8A8
_oleobj_, xrefs: 00007FF8E6A5F83F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String$Arg_ParseTuple
String ID: None is not a valid interface object in this context$O:IsEqual$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 2640384126-1638673459
Opcode ID: b7e7e14fc5bcd2fb467ee23a68d74d9a172593a71272839c4cc64f2f02c923f0
Instruction ID: 4c88e71ef870aae1e1cb31931a2ed6d19346ecc5d543217fd43d39ef0790cbf3
Opcode Fuzzy Hash: b7e7e14fc5bcd2fb467ee23a68d74d9a172593a71272839c4cc64f2f02c923f0
Instruction Fuzzy Hash: 67911A65F28A4382FA10DFE1E85637923A1BF44BE8F445436CE2D47260DE7CF4498702

Function 00007FF8E6A53780 Relevance: 51.0, APIs: 23, Strings: 6, Instructions: 215threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5379F
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A537ED
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5381E
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A53831
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5384D
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A53881
PyErr_Format.PYTHON313 ref: 00007FF8E6A538A4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A538C8
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A5392A
PyErr_Clear.PYTHON313 ref: 00007FF8E6A53938
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5394F
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A53A5A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A53A68
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A53AB3
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A53ADB

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A53843
The Python object is invalid, xrefs: 00007FF8E6A53791
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A53945
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A5388F, 00007FF8E6A53995
_oleobj_, xrefs: 00007FF8E6A53920
OlOi:Drop, xrefs: 00007FF8E6A537E6

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$String$Object_$Arg_Eval_InstanceParseThreadTuple$AttrClearFormatFromLongLong_OccurredRestoreSave
String ID: OlOi:Drop$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 1455900791-214966965
Opcode ID: c4fb685ef935b50b2db5dab5586fa5a81f673176cb595eac6aa8e891b41aef89
Instruction ID: 3c2f0656f87188e8b1a5e850ffd06c661f1e87b3495d73c7812bbaf5fdaa7194
Opcode Fuzzy Hash: c4fb685ef935b50b2db5dab5586fa5a81f673176cb595eac6aa8e891b41aef89
Instruction Fuzzy Hash: DEA11865F28A4281FA50DFE1E8963B923A1FF94BE4F544036DE5E47664EE3CE449C302

Function 00007FF8E6A385E0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 184threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A38622
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A38874
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3888D

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

O:CoSetCancelObject, xrefs: 00007FF8E6A38613
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A38679
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A38775
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A386C2, 00007FF8E6A387C8
_oleobj_, xrefs: 00007FF8E6A38750

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Dealloc$Arg_BuildErr_ErrorFromInfoObjectObject_ParseTupleU_object@@Value
String ID: O:CoSetCancelObject$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 1214226025-3744512049
Opcode ID: 99551560bec47f49f8949582e3964fc8d28ddab8a2585b8c1c240c7836be62f0
Instruction ID: 755f2f60aa7b5495e1796424420a411af56695e80719b69562269dd40e340c4a
Opcode Fuzzy Hash: 99551560bec47f49f8949582e3964fc8d28ddab8a2585b8c1c240c7836be62f0
Instruction Fuzzy Hash: 5A91E865F68A4381EA509FE6E89637D63A1FF88BE8F444436CA1D47664DF3CF4488302

Function 00007FF8E6A34620 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3463B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A3465C
CreateBindCtx.OLE32 ref: 00007FF8E6A3466E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A34679

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A34786
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A34771
|l:CreateBindCtx, xrefs: 00007FF8E6A34630
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A34754

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_BindCreateParseRestoreSaveTuple
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|l:CreateBindCtx
API String ID: 1301558003-347671153
Opcode ID: f1340e5cf0c8b3c0029515f29edd17b2f74a9bd619c162866b54bf19a6aef238
Instruction ID: a51e55f8fc4eb05281d6768ef78f810a1366ddc2d29fe4965a35cfa67bd03410
Opcode Fuzzy Hash: f1340e5cf0c8b3c0029515f29edd17b2f74a9bd619c162866b54bf19a6aef238
Instruction Fuzzy Hash: 04513926F28B4282EA109FA5F84627D63A0FF89BE4F484435CE6D07768DF3CE4458702

Function 00007FF8E6A5E7E0 Relevance: 77.3, APIs: 34, Strings: 10, Instructions: 311threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5E825
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5E842
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5E8AF
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A5E8C4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5E8E0
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5E909
PyErr_Format.PYTHON313 ref: 00007FF8E6A5E92C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5E950
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5E95D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5E97F
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A5E9B4
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5E9C2
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5E9FA
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5EA11
PyErr_Format.PYTHON313 ref: 00007FF8E6A5EA34
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5EA55
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5EA5F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5EA82

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5EAB4
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5EAF5
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5EB0B
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5EB1E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5EB28
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5EB4D
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5EB5C
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5EBA3
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5EBF3
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A5EC0B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5EC22
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5EC2D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5EC44
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5EC4A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5EC5F
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A5EC77

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A5EC96
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A5EC81
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A5E8CF
The Python object is invalid, xrefs: 00007FF8E6A5E834
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A5E9CF
None is not a valid interface object in this context, xrefs: 00007FF8E6A5E893, 00007FF8E6A5E8F6, 00007FF8E6A5E9F0
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A5E917, 00007FF8E6A5EA1F
_oleobj_, xrefs: 00007FF8E6A5E9AA
OOO:BindToStorage, xrefs: 00007FF8E6A5E81E
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A5EC33

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSave$Object_$String$Dealloc$InstanceU_object@@$ClearD@@@FormatFrom$Arg_AttrBuildDict_ErrorInfoItemObjectOccurredParseSubclassTupleValue
String ID: None is not a valid interface object in this context$OOO:BindToStorage$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 857649759-3492286254
Opcode ID: 2a1410167870d82d36e467dec608afb18f3d0cd4aaca4f1149c7ba6930d6cf38
Instruction ID: 1e513832a0d4cfab8107c82918d21d46988d41ff6eba7a5c6293cd698b9178b2
Opcode Fuzzy Hash: 2a1410167870d82d36e467dec608afb18f3d0cd4aaca4f1149c7ba6930d6cf38
Instruction Fuzzy Hash: C2E1F766F28A1281FA10DBA6E85637933A2BF48BD9F444436CE2E57754DF3CE4458302

Function 00007FF8E6A776E0 Relevance: 72.0, APIs: 32, Strings: 9, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A77714
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A77731
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A77747
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A77760
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A7777A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A777AD
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A777C9
PyObject_Size.PYTHON313 ref: 00007FF8E6A777DA
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A777F7
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A77826
VirtualAlloc.KERNEL32 ref: 00007FF8E6A77889
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A778A4
PyErr_NoMemory.PYTHON313 ref: 00007FF8E6A778AA
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A778DD
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A77971
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A77989
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7799E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A779B4
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A779BF
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A779D1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A779E7
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A779F2
VirtualAlloc.KERNEL32 ref: 00007FF8E6A77A12
VirtualProtect.KERNEL32 ref: 00007FF8E6A77AA2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A77ACC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A77AE3
VirtualProtect.KERNEL32 ref: 00007FF8E6A77AFA
PyErr_SetString.PYTHON313 ref: 00007FF8E6A77B34
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A77B48
PyErr_NoMemory.PYTHON313 ref: 00007FF8E6A77B90
PyCapsule_New.PYTHON313 ref: 00007FF8E6A77BA6

Strings

dispatch, xrefs: 00007FF8E6A778BD
vtbl_argsizes, xrefs: 00007FF8E6A777BF
win32com universal gateway, xrefs: 00007FF8E6A77B9F
tear-off not allowed for IUnknown, xrefs: 00007FF8E6A7779C
value is larger than a DWORD, xrefs: 00007FF8E6A7780E
O|i:CreateVTable, xrefs: 00007FF8E6A77703
vtbl_argcounts, xrefs: 00007FF8E6A7781C
iid, xrefs: 00007FF8E6A77727
failed to set memory attributes to executable, xrefs: 00007FF8E6A77B2A

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Err_Object_$Virtual$CallMethodString$AllocItemLongLong_MemoryOccurredProtectSequence_$Arg_AttrCapsule_D@@@ParseSizeTupleU_object@@
String ID: O|i:CreateVTable$dispatch$failed to set memory attributes to executable$iid$tear-off not allowed for IUnknown$value is larger than a DWORD$vtbl_argcounts$vtbl_argsizes$win32com universal gateway
API String ID: 1860013509-2529987451
Opcode ID: cb413da0f7b6b6980bd4e9bf06c1b678990568758aa5dbf22cf65747a2ac85ac
Instruction ID: 11d35571ec8a8bc53488f73975a02387ca765187bf37f33f9517636f454edb2f
Opcode Fuzzy Hash: cb413da0f7b6b6980bd4e9bf06c1b678990568758aa5dbf22cf65747a2ac85ac
Instruction Fuzzy Hash: 41E16732F29A4281EA618BA1E8563797BA5FF84BE4F444135CE5E467A0EF3CF544C302

Function 00007FF8E6A687C0 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 278threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A687E0
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6883E
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A6885B
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A68870
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6888C
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A688B5
PyErr_Format.PYTHON313 ref: 00007FF8E6A688D8
PyErr_SetString.PYTHON313 ref: 00007FF8E6A688FC
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A68909
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6892C
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A68A72
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A68AA0
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A68B00
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A68B18
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A68B2F
PyErr_Clear.PYTHON313 ref: 00007FF8E6A68B3A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A68B51
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A68B57
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A68B6C
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A68B8A

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A68BA9
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A68B94
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A6887B
The Python object is invalid, xrefs: 00007FF8E6A687F6
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A68975
None is not a valid interface object in this context, xrefs: 00007FF8E6A68828, 00007FF8E6A688A2, 00007FF8E6A68993
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A688C3, 00007FF8E6A689C2
O:GetObject, xrefs: 00007FF8E6A687D6
_oleobj_, xrefs: 00007FF8E6A68957
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A68B40

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Eval_Thread$Object_String$RestoreSave$Instance$Arg_ClearD@@@DeallocDict_FormatFromItemOccurredParseSubclassTupleU_object@@
String ID: None is not a valid interface object in this context$O:GetObject$The Python IID map is invalid - the value is not an interface type object$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 2139325478-3498757485
Opcode ID: 0e7df7a90289c1aa33a49be608aa132a8d610be56a736b997e8764bdb576cb59
Instruction ID: ea5788bdfbd8dc7fdd730f5eb430745b0396321a589e14d615578e54eb1c1b34
Opcode Fuzzy Hash: 0e7df7a90289c1aa33a49be608aa132a8d610be56a736b997e8764bdb576cb59
Instruction Fuzzy Hash: 0EC11B66F29A4282FA119FD5E85637823A4BF94BE5F484432CE2E077A5DE3CF445C312

Function 00007FF8E6A49390 Relevance: 63.3, APIs: 28, Strings: 8, Instructions: 270threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A493D3
PyErr_SetString.PYTHON313 ref: 00007FF8E6A493F0
PySequence_Check.PYTHON313 ref: 00007FF8E6A4945A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A49475
PySequence_Size.PYTHON313 ref: 00007FF8E6A49487
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A494B9
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A494D5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A494F2
PySequence_Check.PYTHON313 ref: 00007FF8E6A4952A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A49549
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A495AE
PyErr_SetString.PYTHON313 ref: 00007FF8E6A495C5
PySequence_Size.PYTHON313 ref: 00007FF8E6A495DC
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A49619
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A49635
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4964C
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4965E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A49694
PyErr_SetString.PYTHON313 ref: 00007FF8E6A496CD
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A496E5
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4972F
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A49747
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4975D
PyErr_Clear.PYTHON313 ref: 00007FF8E6A49768
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4977F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A49785
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4979A
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A497B2

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A497D1
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A497BC
The Python object is invalid, xrefs: 00007FF8E6A493E2
One of the GUID's in the required list is invalid, xrefs: 00007FF8E6A496C3
|OO:EnumClassesOfCategories, xrefs: 00007FF8E6A493CC
Only None or lists are supported for the params., xrefs: 00007FF8E6A4946B, 00007FF8E6A4953F
One of the GUID's in the list is invalid, xrefs: 00007FF8E6A495BB
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4976E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Sequence_String$Dealloc$Eval_Object_Thread$D@@@ItemU_object@@$CheckRestoreSaveSize$Arg_ClearDict_FromParseSubclassTuple
String ID: One of the GUID's in the list is invalid$One of the GUID's in the required list is invalid$Only None or lists are supported for the params.$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|OO:EnumClassesOfCategories
API String ID: 2230229366-796148116
Opcode ID: 8743fe0d8f47da5325a5878640d18d0f332c97d8731b52bbcf46aeaea04124e8
Instruction ID: f958ede19b5a5fc52ba4429e335cee676fb3fee80c21aa1d100548f485ecb71e
Opcode Fuzzy Hash: 8743fe0d8f47da5325a5878640d18d0f332c97d8731b52bbcf46aeaea04124e8
Instruction Fuzzy Hash: 87C14A26F29A4281EA709FA6E85637963A0FF88BE5F440435DD6E477A4DE3CF414C302

Function 00007FF8E6A707E0 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 212threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A7080E
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A70862
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A70885
PyErr_SetString.PYTHON313 ref: 00007FF8E6A708B2
SysFreeString.OLEAUT32 ref: 00007FF8E6A70B21
SysFreeString.OLEAUT32 ref: 00007FF8E6A70B31
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A70B42
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A70B5C

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A708E5
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A709DC
None is not a valid interface object in this context, xrefs: 00007FF8E6A708A1, 00007FF8E6A7090C, 00007FF8E6A709F8
OO|O:RegisterTypeLib, xrefs: 00007FF8E6A70802
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A7092D, 00007FF8E6A70A25
_oleobj_, xrefs: 00007FF8E6A709BE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: String$Bstr@@Eval_FreeObject_ThreadU_object@@$Arg_Err_ParseRestoreSaveTuple
String ID: None is not a valid interface object in this context$OO|O:RegisterTypeLib$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 1484531722-329016545
Opcode ID: 94f4dfae61b9118f7a0d4a33fb961363dbd93f1f50520b89a72220a43a081ed3
Instruction ID: 7db2b949273b712256414d86e4a4df72dd95cecde5c0bce9a8cc56913662c962
Opcode Fuzzy Hash: 94f4dfae61b9118f7a0d4a33fb961363dbd93f1f50520b89a72220a43a081ed3
Instruction Fuzzy Hash: 98B107A6F28B4281EA509FA1E85637963A0FF84BE4F445036DE5E47664DF7CF508C302

Function 00007FF8E6A51680 Relevance: 52.7, APIs: 22, Strings: 8, Instructions: 218threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5174C
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A51789
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A5179C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A517BC
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A519AB
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A519E5
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A51A28

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A517B2
The Python object is invalid, xrefs: 00007FF8E6A5169C
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A518AA
OlO:DAdvise, xrefs: 00007FF8E6A516DE
td must be None, xrefs: 00007FF8E6A51742
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A517FA, 00007FF8E6A518E9
_oleobj_, xrefs: 00007FF8E6A51885
HOiii:FORMATETC, xrefs: 00007FF8E6A51717

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Eval_StringThread$FromInstanceLongLong_Object_OccurredRestoreSave
String ID: HOiii:FORMATETC$OlO:DAdvise$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$The Python object is invalid$_oleobj_$argument is not a COM object (got type=%s)$td must be None
API String ID: 1283264418-4244773898
Opcode ID: 6c6012b5ff3f8fd9771e09d10c41c0513f7b46269cf0830c30963abe0ffb2e24
Instruction ID: adf5ae1262f42107d65a596281d3fb017bd1b737eb65324c2c43ca1df0161de4
Opcode Fuzzy Hash: 6c6012b5ff3f8fd9771e09d10c41c0513f7b46269cf0830c30963abe0ffb2e24
Instruction Fuzzy Hash: 33B15966F28A42C1FA60DB95E84A3B963A2FF84BD4F544036CE5D47664DF3CE849C702

Function 00007FF8E6A305D0 Relevance: 50.9, APIs: 23, Strings: 6, Instructions: 189COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A30621
??0PyWin_AutoFreeBstr@@QEAA@PEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A30638
?SetBstr@PyWin_AutoFreeBstr@@QEAAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A30671
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A30680
PyErr_SetString.PYTHON313 ref: 00007FF8E6A306A0
??1PyWin_AutoFreeBstr@@QEAA@XZ.PYWINTYPES313 ref: 00007FF8E6A308A7

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A3088C
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A3068F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A30877
OOi|Oi:StgOpenStorage, xrefs: 00007FF8E6A30617
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A3073C
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A3082F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: AutoBstr@@FreeWin_$Err_$Arg_Bstr@OccurredParseStringTuple
String ID: OOi|Oi:StgOpenStorage$The Python IID map is invalid - the value is not an interface type object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$argument is not a COM object (got type=%s)
API String ID: 2915875948-1305722908
Opcode ID: 3c43b0d80d8ddee1a4a659751ef55d66f2b29d27b717398d707ce0c395afcbe2
Instruction ID: 4841d1dc8af92d5f553f1700cc5be25c48dea5bf405e6a4f07d29799faa0976c
Opcode Fuzzy Hash: 3c43b0d80d8ddee1a4a659751ef55d66f2b29d27b717398d707ce0c395afcbe2
Instruction Fuzzy Hash: 48910526F68A1385FB509FA1E8563BC23A0BB88BE8F444436DD5E57A64DF3CE445C342

Function 00007FF8E6A357D0 Relevance: 50.9, APIs: 22, Strings: 7, Instructions: 170COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A35805
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3582E
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A3584B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3587D

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A35A2C
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A3585A
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A35A17
None is not a valid interface object in this context, xrefs: 00007FF8E6A3586C
OO:CoUnmarshalInterface, xrefs: 00007FF8E6A357EF
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A358A0
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A359FA

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Arg_D@@@Object_OccurredParseStringTupleU_object@@
String ID: None is not a valid interface object in this context$OO:CoUnmarshalInterface$The Python IID map is invalid - the value is not an interface type object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$argument is not a COM object (got type=%s)
API String ID: 656544938-3037632617
Opcode ID: 769527044b3ff73e3d87d1c196b22d4bf10cf8d2f1d938f52019310975ead038
Instruction ID: 141966edcf91ac9047711a96b414c4f21debc0f62a80117ccb68c097bec862ca
Opcode Fuzzy Hash: 769527044b3ff73e3d87d1c196b22d4bf10cf8d2f1d938f52019310975ead038
Instruction Fuzzy Hash: B3811861F68A4381EA64AFA5E85637963A0FF88BE4F484032DE5E47765DF3CE404D302

Function 00007FF8E6A2E5A0 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

?PyWinCoreString_FromString@@YAPEAU_object@@PEB_W_J@Z.PYWINTYPES313 ref: 00007FF8E6A2E607
?PyWinCoreString_FromString@@YAPEAU_object@@PEB_W_J@Z.PYWINTYPES313 ref: 00007FF8E6A2E61B
?PyWinCoreString_FromString@@YAPEAU_object@@PEB_W_J@Z.PYWINTYPES313 ref: 00007FF8E6A2E62F
?PyWinCoreString_FromString@@YAPEAU_object@@PEB_W_J@Z.PYWINTYPES313 ref: 00007FF8E6A2E64B
?PyWinCoreString_FromString@@YAPEAU_object@@PEB_W_J@Z.PYWINTYPES313 ref: 00007FF8E6A2E6A5
PyUnicode_Concat.PYTHON313 ref: 00007FF8E6A2E6C2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E6D9
PyUnicode_Concat.PYTHON313 ref: 00007FF8E6A2E6F1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E708
PyUnicode_Concat.PYTHON313 ref: 00007FF8E6A2E720
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E737
PyObject_Repr.PYTHON313 ref: 00007FF8E6A2E765

Strings

com_struct(, xrefs: 00007FF8E6A2E641

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: CoreFromString@@String_U_object@@$ConcatDeallocUnicode_$Object_Repr
String ID: com_struct(
API String ID: 1348223521-96509600
Opcode ID: 35da03879ab85424f4d57d1c8b54b1f0a117784aceae82a6ae9e7b623466e164
Instruction ID: 529bfbd4d8db6800f7458ba2709c656a3a853b50c23ebc00c3067aa3a87f05b7
Opcode Fuzzy Hash: 35da03879ab85424f4d57d1c8b54b1f0a117784aceae82a6ae9e7b623466e164
Instruction Fuzzy Hash: 35A15232F6968281EAA58FA1D54A77973A5FF55BE4F084030CE6E06B95DF3CE484C302

Function 00007FF8E6A347E0 Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 176threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A34820
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A34838
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A34878
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A3488B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A34988
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A34A4B
RegisterActiveObject.OLEAUT32 ref: 00007FF8E6A34A68
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A34A7E
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A34ABF

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A3489A
The Python instance can not be converted to a COM object, xrefs: 00007FF8E6A34977
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A348D1, 00007FF8E6A349BE
_oleobj_, xrefs: 00007FF8E6A34959
OOi:RegisterActiveObject, xrefs: 00007FF8E6A34815

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Eval_Object_Thread$ActiveArg_D@@@FromInstanceLongLong_ObjectOccurredParseRegisterRestoreSaveStringTupleU_object@@
String ID: OOi:RegisterActiveObject$The Python instance can not be converted to a COM object$The Python object is NULL and no error occurred$_oleobj_$argument is not a COM object (got type=%s)
API String ID: 3800057418-2099300522
Opcode ID: 16427a8c9fba988c45b28cbd6ef40f2783dc78f2044718523deeb9f8e8af8a16
Instruction ID: 40cb1f0c0aedceb42117bf1e56a363e6897a8d994b5a1ae72553abdf0b7f9b49
Opcode Fuzzy Hash: 16427a8c9fba988c45b28cbd6ef40f2783dc78f2044718523deeb9f8e8af8a16
Instruction Fuzzy Hash: 0A812665F28A4382EA509BA1E84637D63A1FF88BE4F44503ADE5E47764DF3CF4048702

Function 00007FF8E6A33820 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 175threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A33839
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A3384D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A33869
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A33898
PyErr_Format.PYTHON313 ref: 00007FF8E6A338BB
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A338E7
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3390A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A33931
CreatePointerMoniker.OLE32 ref: 00007FF8E6A33944
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3395A

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A33A90
The Python object is NULL and no error occurred, xrefs: 00007FF8E6A33858
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A33A7B
None is not a valid interface object in this context, xrefs: 00007FF8E6A33885
O:CreatePointerMoniker, xrefs: 00007FF8E6A33832
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A338A6
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A33A23

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_$Arg_BuildCreateErrorFormatFromInfoInstanceMonikerObjectOccurredParsePointerStringTupleU_object@@Value
String ID: None is not a valid interface object in this context$O:CreatePointerMoniker$The Python IID map is invalid - the value is not an interface type object$The Python object is NULL and no error occurred$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$argument is not a COM object (got type=%s)
API String ID: 3065001159-2729590346
Opcode ID: 4899727da42816ca55ef1e7d036be33c2d3628a6623b9210bc7f6a9c6f565c34
Instruction ID: 880bc9a3102bbce1304ac3f9c5e19b55d824b85ccc2180e57ff16e799606ae59
Opcode Fuzzy Hash: 4899727da42816ca55ef1e7d036be33c2d3628a6623b9210bc7f6a9c6f565c34
Instruction Fuzzy Hash: DB711965F2CA4381EA449FA6F85627963A1FF99FE8F484436CE2D47764DF2CE4448302

Function 00007FF8E6A566A0 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 208threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A566C3
PyErr_SetString.PYTHON313 ref: 00007FF8E6A566E0
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5673F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A56763
PyTuple_New.PYTHON313 ref: 00007FF8E6A567BA
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5682B
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A56847
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5685E
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A56877
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A568BC
Py_BuildValue.PYTHON313 ref: 00007FF8E6A568D3
PyErr_SetString.PYTHON313 ref: 00007FF8E6A56900
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A56906
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5691B
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5692F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5693E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A56953
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5696B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5699D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A569B2

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A568EF
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A56926
The Python object is invalid, xrefs: 00007FF8E6A566D2
|l:Next, xrefs: 00007FF8E6A566BC
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A56935
NkN, xrefs: 00007FF8E6A568C6

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_Object_$D@@@DeallocFromStringU_object@@$Arg_BuildClearDict_ItemParseSubclassTupleTuple_Value
String ID: NkN$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|l:Next
API String ID: 800545042-842389129
Opcode ID: c7538cf5906b5fccd9bceabd730ecef40ca55a2468380bbd030d210c334895b1
Instruction ID: 046d982eb34df2eee2cb74a474e35a29c4e54b22a860e4ba361ce877901086c1
Opcode Fuzzy Hash: c7538cf5906b5fccd9bceabd730ecef40ca55a2468380bbd030d210c334895b1
Instruction Fuzzy Hash: 0B914765F29A0282EA14DFA1E90637963A2FF49BE0F485535DE6E077A4DF3CE444C702

Function 00007FF8E6A31770 Relevance: 42.3, APIs: 19, Strings: 5, Instructions: 305COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3185E

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

OOiOO:CoCreateInstanceEx, xrefs: 00007FF8E6A3184F
authinfo in the SERVERINFO must be None, xrefs: 00007FF8E6A31949
The SERVERINFO is not in the correct format, xrefs: 00007FF8E6A31917
Allocating MULTIQI array, xrefs: 00007FF8E6A31A3C
O|Oii, xrefs: 00007FF8E6A318F8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Dealloc$Arg_BuildErr_ErrorFromInfoObjectObject_ParseTupleU_object@@Value
String ID: Allocating MULTIQI array$OOiOO:CoCreateInstanceEx$O|Oii$The SERVERINFO is not in the correct format$authinfo in the SERVERINFO must be None
API String ID: 1214226025-1504097500
Opcode ID: 8ac117d4ccb9136820111e6e18c6ab1189ef24eed1adb841d9e04c8bb89fd779
Instruction ID: 31832bf372ddc8ea1eac438151c4765bd76e968c2bac6e41fa5915658052f51f
Opcode Fuzzy Hash: 8ac117d4ccb9136820111e6e18c6ab1189ef24eed1adb841d9e04c8bb89fd779
Instruction Fuzzy Hash: 4802F932A1CB82C6E760DB95E48536EB3A0FB85794F504136DA8D47BA8DF7CE844CB41

Function 00007FF8E6A308D0 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 198threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8E6A30926
GetProcAddress.KERNEL32 ref: 00007FF8E6A3094B
PyErr_Format.PYTHON313 ref: 00007FF8E6A3097D
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FF8E6A309F3
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A30A0F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A30A5A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A30A9D
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A30AFC
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A30B0A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A30B1F
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A30B34
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A30B4B
PyErr_Clear.PYTHON313 ref: 00007FF8E6A30B56
PyErr_SetString.PYTHON313 ref: 00007FF8E6A30B6D
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A30B7F
PyMem_Free.PYTHON313 ref: 00007FF8E6A30BD4

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A30B9E
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A30B89
Ole32.dll, xrefs: 00007FF8E6A3091F
StgOpenStorageEx not supported by this version of Windows, xrefs: 00007FF8E6A3096C
StgOpenStorageEx, xrefs: 00007FF8E6A30941
OiiiO&|O:StgOpenStorageEx, xrefs: 00007FF8E6A309E6
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A30B5C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_Object_$RestoreSaveU_object@@$AddressArg_ClearD@@@DeallocDict_FormatFreeFromHandleItemKeywordsMem_ModuleParseProcStringSubclassTuple
String ID: OiiiO&|O:StgOpenStorageEx$Ole32.dll$StgOpenStorageEx$StgOpenStorageEx not supported by this version of Windows$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1531689404-2224397758
Opcode ID: 8e0d85b12df33b9e38501e22eb155c57a48eccc4e7e82178f20167b50863586b
Instruction ID: c88c912fd601c05ebc9d0fa2f89c94032f7df5caa403813f3c27997d37e8c9d6
Opcode Fuzzy Hash: 8e0d85b12df33b9e38501e22eb155c57a48eccc4e7e82178f20167b50863586b
Instruction Fuzzy Hash: A0A11432F69A4286EA50DFA1E8523AD23A0BB48BE8F444535DE5E577A4DF3CE505C302

Function 00007FF8E6A36530 Relevance: 40.4, APIs: 19, Strings: 4, Instructions: 172threadcomCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3654E
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A36562
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3657E
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A365AD
PyErr_Format.PYTHON313 ref: 00007FF8E6A365D0
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A365FC
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3661F
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A36650
PyErr_SetString.PYTHON313 ref: 00007FF8E6A36670
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A36697
PyErr_Format.PYTHON313 ref: 00007FF8E6A366BA
PyErr_SetString.PYTHON313 ref: 00007FF8E6A366D9
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A3672A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A36741
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A36754
OleSaveToStream.OLE32 ref: 00007FF8E6A36767
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3678D

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A3656D, 00007FF8E6A3665F
None is not a valid interface object in this context, xrefs: 00007FF8E6A3659A, 00007FF8E6A36684
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A365BB, 00007FF8E6A366A5
OO:OleSaveToStream, xrefs: 00007FF8E6A36542

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Eval_Thread$Save$RestoreString$FormatInstanceObject_Occurred$Arg_ParseStreamTuple
String ID: None is not a valid interface object in this context$OO:OleSaveToStream$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 104505675-2248625336
Opcode ID: 56ea71e791e72cfd76da5e82f14687eda5da52c0a84affbd7ce09b35444f47e5
Instruction ID: 42fea1d000a50c1ae2e181a8e042e78b9aada8a5a141b631dcb3243d11a23df7
Opcode Fuzzy Hash: 56ea71e791e72cfd76da5e82f14687eda5da52c0a84affbd7ce09b35444f47e5
Instruction Fuzzy Hash: 4A810865F28A4381EB44DFA5E85637963A1FF88BE8F485436CE2D47665DF3CE4488302

Function 00007FF8E6A446B0 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A446E1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A446FE
PyErr_NoMemory.PYTHON313 ref: 00007FF8E6A44709
PyErr_SetString.PYTHON313 ref: 00007FF8E6A44755

Strings

ELEMDESCArray must be a sequence of ELEMDESCs, xrefs: 00007FF8E6A447EA
SCODE array must be a sequence of integers!, xrefs: 00007FF8E6A448F0, 00007FF8E6A44973
FUNCDESC, xrefs: 00007FF8E6A4474B
The object is not a PyFUNCDESC, xrefs: 00007FF8E6A446D7

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$String$Memorymalloc
String ID: ELEMDESCArray must be a sequence of ELEMDESCs$FUNCDESC$SCODE array must be a sequence of integers!$The object is not a PyFUNCDESC
API String ID: 329545144-3413657444
Opcode ID: d1ae8bc5980f7c0c72ce9e2be9f77067840cd2467ee6cfe995b66a2247f8e245
Instruction ID: 66b3d36ec35427cf3c94917bc4b03d64542b0a7ac41ca1d8494e44c2b250bf07
Opcode Fuzzy Hash: d1ae8bc5980f7c0c72ce9e2be9f77067840cd2467ee6cfe995b66a2247f8e245
Instruction Fuzzy Hash: CA915A26F29B8282EA54DFA1E90227873A5FF48BE4B058439CE5D47B54EF3CE451C342

Function 00007FF8E6A6A760 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 158COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6A782
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6A7B1

Strings

The 'reserved' parameter (param 2) must be None, xrefs: 00007FF8E6A6A81E
The type does not declare a PyCom constructor, xrefs: 00007FF8E6A6A99D
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A6A988
The Python object is invalid, xrefs: 00007FF8E6A6A774
OOi|i:OpenStream, xrefs: 00007FF8E6A6A7F9
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6A95B

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: OOi|i:OpenStream$The 'reserved' parameter (param 2) must be None$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-2618051897
Opcode ID: 96904040cdf6b1573a3c5d4f1615fe410f570b750407c8018cb5961c03e18c3e
Instruction ID: c082abe97d52bbc3dc72bd777a1d682b75a298a0dceebeec3cab6bffd5291e00
Opcode Fuzzy Hash: 96904040cdf6b1573a3c5d4f1615fe410f570b750407c8018cb5961c03e18c3e
Instruction Fuzzy Hash: 45611826F28A4285EB609FA5E85637973A0FF88BD8F544431CE6E477A4DF2CE445C702

Function 00007FF8E6A24870 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A248A6
PyErr_Fetch.PYTHON313 ref: 00007FF8E6A248D8

Part of subcall function 00007FF8E6A21D20: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8E6A21D63

PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A2490C
PyErr_Clear.PYTHON313 ref: 00007FF8E6A2491A
PyImport_ImportModule.PYTHON313 ref: 00007FF8E6A24927
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A2493F
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A24956
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A24973
PyErr_Restore.PYTHON313 ref: 00007FF8E6A2498B
PyErr_Restore.PYTHON313 ref: 00007FF8E6A249A2
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8E6A24A00
PyErr_Fetch.PYTHON313 ref: 00007FF8E6A24A3C
PyErr_NormalizeException.PYTHON313 ref: 00007FF8E6A24A5B
?GetPythonTraceback@@YAPEA_WPEAU_object@@00@Z.PYWINTYPES313 ref: 00007FF8E6A24A7C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A24A90
PyErr_Restore.PYTHON313 ref: 00007FF8E6A24AA5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A24ABE
PyGILState_Release.PYTHON313 ref: 00007FF8E6A24AC7

Strings

_GetLogger_, xrefs: 00007FF8E6A24902
pythoncom %hs: , xrefs: 00007FF8E6A248E4
logger, xrefs: 00007FF8E6A24935
win32com, xrefs: 00007FF8E6A24920

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$DeallocRestore$FetchObject_State___stdio_common_vswprintf$AttrCallClearEnsureExceptionImportImport_MethodModuleNormalizePythonReleaseStringTraceback@@U_object@@00@free
String ID: _GetLogger_$logger$pythoncom %hs: $win32com
API String ID: 1729153949-4284417512
Opcode ID: 8f497a61296da6ed75c4f8688cd41eb60f8be8e53836b21e125204271b273203
Instruction ID: 5b253a2d594a9cc3f8574308b1469b4fb5b354981e69b62b281c42b3deccf1ec
Opcode Fuzzy Hash: 8f497a61296da6ed75c4f8688cd41eb60f8be8e53836b21e125204271b273203
Instruction Fuzzy Hash: 5F613D36F28A42C1EB409B91F9467BAA3A0FB85BE5F441035EE5E03668DF3CE455C702

Function 00007FF8E6A6C580 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A6C5B6
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A6C65B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6C6C1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6C6E2
PyArg_Parse.PYTHON313 ref: 00007FF8E6A6C701
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A6C723
PyGILState_Release.PYTHON313 ref: 00007FF8E6A6C827

Strings

OOizi, xrefs: 00007FF8E6A6C668
The type does not declare a PyCom constructor, xrefs: 00007FF8E6A6C761
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A6C749
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A6C799, 00007FF8E6A6C7F8
OpenStorage, xrefs: 00007FF8E6A6C67C, 00007FF8E6A6C790, 00007FF8E6A6C7EF
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6C63F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocState_$Arg_EnsureErr_FromObject_OccurredParseReleaseU_object@@
String ID: OOizi$OpenStorage$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$Unexpected exception in gateway method '%hs'
API String ID: 2511297912-945543564
Opcode ID: b1459725fdbbbfc93cae37e5eaf5b763160eccd130f84c335b6f24072bb8028e
Instruction ID: 4a35fa50733b0068e4275ceaefdc8091004a2248c049814da8f98dce721e2ca4
Opcode Fuzzy Hash: b1459725fdbbbfc93cae37e5eaf5b763160eccd130f84c335b6f24072bb8028e
Instruction Fuzzy Hash: EF815D36F29A4381EA559BA1E84637973A0BF88BD4F445036DD6E477A4EF3CE405C342

Function 00007FF8E6A37800 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 171threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3782B
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A3783F
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3785B
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A3788A
PyErr_Format.PYTHON313 ref: 00007FF8E6A378AD
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A378D9
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A378FC
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A3792D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3794D
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A37987
PyErr_Format.PYTHON313 ref: 00007FF8E6A379AA
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A379E4
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A37A07
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A37A41
DoDragDrop.OLE32 ref: 00007FF8E6A37A5E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A37A69
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A37A91

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A3784A, 00007FF8E6A3793C
None is not a valid interface object in this context, xrefs: 00007FF8E6A37877, 00007FF8E6A37974
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A37898, 00007FF8E6A37995
OOl:DoDragDrop, xrefs: 00007FF8E6A37824

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$RestoreSave$Object_$DeallocFormatFromInstanceOccurredString$Arg_BuildDragDropErrorInfoLongLong_ObjectParseTupleU_object@@Value
String ID: None is not a valid interface object in this context$OOl:DoDragDrop$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 4113370609-1225370506
Opcode ID: cfcf55015f3f9e4f3267150bf2ccfb7e7b5ebb81ebddf47be08607445d6e7552
Instruction ID: 16a18d33b7fdbe79c34b5a548b91fdb535dd1b395b7937dcfd557f22f06bfa6e
Opcode Fuzzy Hash: cfcf55015f3f9e4f3267150bf2ccfb7e7b5ebb81ebddf47be08607445d6e7552
Instruction Fuzzy Hash: 6081F876F28A4282EB40DFA6E45627963A1FB88FE4F544432DE6E47764DE3CE444C702

Function 00007FF8E6A52570 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 155COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A525A4
Py_BuildValue.PYTHON313 ref: 00007FF8E6A525D0
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A525F4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A526A4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A526EC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A52705
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A52714
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5272D
PyGILState_Release.PYTHON313 ref: 00007FF8E6A52738
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A52768

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A5278A
Hziii, xrefs: 00007FF8E6A525AE
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A52772
OlO, xrefs: 00007FF8E6A526B9
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A5260F
DAdvise, xrefs: 00007FF8E6A52606, 00007FF8E6A526CA
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A52693

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Err_State_$BuildEnsureLongLong_Object_OccurredReleaseStringSubclassValue
String ID: DAdvise$Hziii$OlO$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$Unexpected exception in gateway method '%hs'
API String ID: 2824385799-3352993437
Opcode ID: 3f746099ed3b6ac0c62d76d8bcca7d8a62772928c212643b2f74fab37b10fd52
Instruction ID: a0a295193d8a79918480c8703ae2c6c827e3c98adf99f4f536adb8706e6f2063
Opcode Fuzzy Hash: 3f746099ed3b6ac0c62d76d8bcca7d8a62772928c212643b2f74fab37b10fd52
Instruction Fuzzy Hash: 68615626F29A0282EA54DBE5E85637863A2FF58BE8F444435DE0E03764EF3CE405C702

Function 00007FF8E6A6A500 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 152COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6A522
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6A551

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A6A721
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A6A70C
Oi|ii:CreateStream, xrefs: 00007FF8E6A6A5A0
The Python object is invalid, xrefs: 00007FF8E6A6A514
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6A6DF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: Oi|ii:CreateStream$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-2745708741
Opcode ID: b989ae51c8758499c7d9be28124672b01cba27811aec47f6e2c764abc6dc44fb
Instruction ID: 3ea4b11a9b94a9b995c5d3a7d32a6e341b141badf815a492475fd838f99d4bf5
Opcode Fuzzy Hash: b989ae51c8758499c7d9be28124672b01cba27811aec47f6e2c764abc6dc44fb
Instruction Fuzzy Hash: 75613C26F28A4285EA609FA5E4463B973A0FF88BD4F444031CE6E87754DF3CE445C702

Function 00007FF8E6A483F0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4840D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A48433

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A484B1
The Python object is invalid, xrefs: 00007FF8E6A48406
None is not a valid interface object in this context, xrefs: 00007FF8E6A484C3
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A484F7
OO:RegisterObjectParam, xrefs: 00007FF8E6A48453

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: None is not a valid interface object in this context$OO:RegisterObjectParam$The Python object is NULL and no error occurred$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 1450464846-488781711
Opcode ID: 932e8bc1541f4a57b9f8d019d224cf0b72de324ff838107bd98672a256f49077
Instruction ID: 4ab314aa1c9e0faf5eb1807df5b82826720efec08f7dd3a3b28153ee1a7c0502
Opcode Fuzzy Hash: 932e8bc1541f4a57b9f8d019d224cf0b72de324ff838107bd98672a256f49077
Instruction Fuzzy Hash: 5D510866F28A46C2EA50AFA5F8562B923A0FF84BE4F444432DE5E47764DF3CE445C702

Function 00007FF8E6A54780 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 137threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5479A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A547B7
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A547E8
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A54805
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5486E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5487C
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A54891

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A54912
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A548FD
The Python object is invalid, xrefs: 00007FF8E6A547A9
:Clone, xrefs: 00007FF8E6A54793
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A548E0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Arg_D@@@Err_FromObject_ParseStringTupleU_object@@
String ID: :Clone$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 4085574066-175512089
Opcode ID: b36eac7297a6a26ec4338721e727bbe6325d34e46f5a02e79c31ccdf52d653f6
Instruction ID: b7a8a21c568b5a0b4a5c3ba64d285e68274a70b8137d412b47ce23528e6e93d4
Opcode Fuzzy Hash: b36eac7297a6a26ec4338721e727bbe6325d34e46f5a02e79c31ccdf52d653f6
Instruction Fuzzy Hash: FC514B26F29B4281EA54EF96F84626963A1FF89FE4F085036DE5E07764DF2CE4458302

Function 00007FF8E6A48710 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 136threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4872D
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A48764
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4877E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A48792
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A487B4
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A487BF
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4882B
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A48843
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A48859
PyErr_Clear.PYTHON313 ref: 00007FF8E6A48864
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4887B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A48881
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A48896

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A488D9
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A488C4
The Python object is invalid, xrefs: 00007FF8E6A4871F
O:GetObjectParam, xrefs: 00007FF8E6A48755
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4886A

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_Object_$RestoreSaveStringU_object@@$Arg_ClearD@@@DeallocDict_FreeFromItemParseTuple
String ID: O:GetObjectParam$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 982989513-2285593136
Opcode ID: 0c6aaa147ddc43ffcc2bdb254241aff334adc611c78cee1718f5bb1e547f805f
Instruction ID: 17b861c99915f868d4beddd51a4c5ca5f8e0ac1ad24bb2b147c8b5543ff19f1b
Opcode Fuzzy Hash: 0c6aaa147ddc43ffcc2bdb254241aff334adc611c78cee1718f5bb1e547f805f
Instruction Fuzzy Hash: E3515B26F28A4281EA54AF9AF8563B963A0FF88BE4F484431DE5D07764DF3CE445C302

Function 00007FF8E6A2F7E0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 135threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A2F81A
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FF8E6A2F832
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2F84A
CreateStreamOnHGlobal.OLE32 ref: 00007FF8E6A2F861
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2F86C

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A2F979
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A2F964
|Ol:CreateStreamOnHGlobal, xrefs: 00007FF8E6A2F804
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A2F947

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocObject_U_object@@$Arg_BuildCreateErr_ErrorFromGlobalInfoObjectParseStreamTupleValue
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|Ol:CreateStreamOnHGlobal
API String ID: 1037806259-2736307125
Opcode ID: 4ea39f093166fbabd46ce18d5c69cc844c6f91f26552b085ead3aebf3fd760c4
Instruction ID: a8b84f3d2eea6f4e7e37466b1e72482014191f28944c4b040969b8889fbf322e
Opcode Fuzzy Hash: 4ea39f093166fbabd46ce18d5c69cc844c6f91f26552b085ead3aebf3fd760c4
Instruction Fuzzy Hash: BE515D72F68B4282EB509F96F84526963A0FB89BE4F485032DE5E07768DF3CE455C702

Function 00007FF8E6A59590 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A595A6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A595C3
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A595E8
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A59605
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5965D
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5966B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A59680
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A596A2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A596B9
PyErr_Clear.PYTHON313 ref: 00007FF8E6A596C4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A596DB
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A596E1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A596F6
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A59718

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A59737
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A59722
The Python object is invalid, xrefs: 00007FF8E6A595B5
:Clone, xrefs: 00007FF8E6A5959F
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A596CA

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSave$Object_String$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :Clone$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1062860496-175512089
Opcode ID: 6079005cdee7c78722a1383d23de0921af49950048b54dda79b094197a43af5a
Instruction ID: d615d3557d4c11ad751fd91f8fb4ebe3ed9be58fbce1aef7217070ff3869f047
Opcode Fuzzy Hash: 6079005cdee7c78722a1383d23de0921af49950048b54dda79b094197a43af5a
Instruction Fuzzy Hash: 3A515161F28B4282EE55DB95F95637923A1FF48BD0F445035DE2E0B764DF2CE4548302

Function 00007FF8E6A705C0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A70606
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A7061E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A70639
LoadRegTypeLib.OLEAUT32 ref: 00007FF8E6A70661
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A7066C

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A706CF
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A706DD
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A706F2
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A7070E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A70725
PyErr_Clear.PYTHON313 ref: 00007FF8E6A70730
PyErr_SetString.PYTHON313 ref: 00007FF8E6A70747
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A7074D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A70762
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A70781

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A707A0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A7078B
Oii|i:LoadRegTypeLib, xrefs: 00007FF8E6A705FF
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A70736

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Object_$DeallocErr_U_object@@$D@@@From$Arg_BuildClearDict_ErrorInfoItemLoadObjectParseStringSubclassTupleTypeValue
String ID: Oii|i:LoadRegTypeLib$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3138176419-3647057581
Opcode ID: ec829c726a1b92acef0e3b1af064ff5085d7a0be5fe0ea18b45d43c6d7c71660
Instruction ID: d49fc3c85c0df1eeb67f2035eb5e3e30d304f41e29d2dfd2f0afc82e1552df79
Opcode Fuzzy Hash: ec829c726a1b92acef0e3b1af064ff5085d7a0be5fe0ea18b45d43c6d7c71660
Instruction Fuzzy Hash: 86516A76F29A4282EA109BA1E85637A63A1FF88BE4F440031DE5E47764DF3CF505CB02

Function 00007FF8E6A5B6C0 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5B6D6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5B6F3
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B718
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B735
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5B78D
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B79B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B7B0
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A5B7D2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5B7E9
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5B7F4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5B80B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B811
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B826
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A5B848

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A5B867
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A5B852
The Python object is invalid, xrefs: 00007FF8E6A5B6E5
:Clone, xrefs: 00007FF8E6A5B6CF
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A5B7FA

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSave$Object_String$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :Clone$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1062860496-175512089
Opcode ID: 060d249caad6cc55ff2383f3c8f2a20ac39b2e0ab31acbdef53b5fdd11222669
Instruction ID: b37bb8ee2a988f80513cba0225694120cff46ab05bf36a5422830ce0fcf6a6e9
Opcode Fuzzy Hash: 060d249caad6cc55ff2383f3c8f2a20ac39b2e0ab31acbdef53b5fdd11222669
Instruction Fuzzy Hash: 11515E65F29A0282EA45DBA6F95637923A1FF88BE5F485035DE2E07764DF2CF4448302

Function 00007FF8E6A32760 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 122threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A32782
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3279A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A327BE
GetActiveObject.OLEAUT32 ref: 00007FF8E6A327D3
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A327DE

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3284A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A32858
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3286D
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A32887
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3289D
PyErr_Clear.PYTHON313 ref: 00007FF8E6A328A8
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A328C1
PyErr_SetString.PYTHON313 ref: 00007FF8E6A328F1
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A328F7
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3290C

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A328E0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A328CB
O:GetActiveObject, xrefs: 00007FF8E6A3277B
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A328AE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Object_$DeallocErr_U_object@@$D@@@FromObject$ActiveArg_BuildClearDict_ErrorInfoItemParseStringSubclassTupleValue
String ID: O:GetActiveObject$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 666477944-865906367
Opcode ID: 160be30c11b648129135dc9bdd92db614aee84006a076e4b5ee0b0f26b69ce7f
Instruction ID: ccf6b8190d67c6f7581d360dcd77e3fc1d6671a795f5d3565fced2151e30aa41
Opcode Fuzzy Hash: 160be30c11b648129135dc9bdd92db614aee84006a076e4b5ee0b0f26b69ce7f
Instruction Fuzzy Hash: CC512525F68B4382EA119FA6E81627963A2FF89BD4F484032DE5E47764DF3CF5058702

Function 00007FF8E6A4C740 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 122threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4C76E
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4C782
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C79F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4C7C0
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4C7E2
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C803
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4C863
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A4C87B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4C892
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4C89D
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C8B4
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4C8BA
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4C8CF
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A4C8E6

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A4C905
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A4C8F0
The Python object is invalid, xrefs: 00007FF8E6A4C791
O:FindConnectionPoint, xrefs: 00007FF8E6A4C764
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4C8A3

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Eval_Thread$Object_String$D@@@RestoreSaveU_object@@$Arg_ClearDeallocDict_FromItemParseSubclassTuple
String ID: O:FindConnectionPoint$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 2944609815-947799321
Opcode ID: 8f363603b0d846cdd7370066f66abd9dea7c91245c72ace473625aa626d59478
Instruction ID: 227610b6d93ab3eb000f2043632d1f777102c3711c1b02a4baeece8f80cda805
Opcode Fuzzy Hash: 8f363603b0d846cdd7370066f66abd9dea7c91245c72ace473625aa626d59478
Instruction Fuzzy Hash: 4D510725F2DA4282FA559BA5E85637923A1FF88FE4F484436CD5E07764DF2CF4058702

Function 00007FF8E6A69650 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 100COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6966F
PyErr_SetString.PYTHON313 ref: 00007FF8E6A69697

Strings

ImpLevel, xrefs: 00007FF8E6A697D6
AuthnSvc, xrefs: 00007FF8E6A697A3
AuthnLevel, xrefs: 00007FF8E6A697ED
ServerPrincipalName, xrefs: 00007FF8E6A69805
Capabilities, xrefs: 00007FF8E6A697AE
The Python object is invalid, xrefs: 00007FF8E6A69668
|k:QueryBlanket, xrefs: 00007FF8E6A696BB
AuthzSvc, xrefs: 00007FF8E6A69794
ClientName, xrefs: 00007FF8E6A697BA
{s:k, s:k, s:N, s:k, s:k, s:N, s:k}, xrefs: 00007FF8E6A697F9

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: AuthnLevel$AuthnSvc$AuthzSvc$Capabilities$ClientName$ImpLevel$ServerPrincipalName$The Python object is invalid${s:k, s:k, s:N, s:k, s:k, s:N, s:k}$|k:QueryBlanket
API String ID: 1450464846-3683017349
Opcode ID: 8d5648f3a53b37f8b704c62a7fed6cad063a06f48179c54d5d934a325d674f60
Instruction ID: 761d413d8b353a6c359d0de7520ef327d312c157e959392ce06cfd2e2fa80846
Opcode Fuzzy Hash: 8d5648f3a53b37f8b704c62a7fed6cad063a06f48179c54d5d934a325d674f60
Instruction Fuzzy Hash: CE51CA75F28B8281DB609B91F8453AAB3A4FB887E0F404136DA9D47B58DF3CE149CB41

Function 00007FF8E6A4B7A0 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 159COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A4B7C8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4B89D
PyArg_Parse.PYTHON313 ref: 00007FF8E6A4B8BC
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A4B8E0
PyGILState_Release.PYTHON313 ref: 00007FF8E6A4B9E9

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A4B91E
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A4B906
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A4B956, 00007FF8E6A4B9BA
CopyProxy, xrefs: 00007FF8E6A4B877, 00007FF8E6A4B94D, 00007FF8E6A4B9B1
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4B849

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$Arg_DeallocEnsureErr_OccurredParseRelease
String ID: CopyProxy$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$Unexpected exception in gateway method '%hs'
API String ID: 2493174349-996941837
Opcode ID: 5383e767052a61d8738e0192ca9f9f067efcd2ac7f2d98322a038dc462136b28
Instruction ID: 5a84f3dfae745b34ddd893634e7c99b43034ce5bf64fdb9733a3e2711641e8b3
Opcode Fuzzy Hash: 5383e767052a61d8738e0192ca9f9f067efcd2ac7f2d98322a038dc462136b28
Instruction Fuzzy Hash: D2614A32F2DA4781EA559BA5EC5A3B923A1FF54BD8F444035DE1E872A5DF3CE4058302

Function 00007FF8E6A6B6E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 134COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B6FD
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B723

Strings

|izi:EnumElements, xrefs: 00007FF8E6A6B754
The type does not declare a PyCom constructor, xrefs: 00007FF8E6A6B8A3
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A6B88E
The Python object is invalid, xrefs: 00007FF8E6A6B6F6
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6B846

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$|izi:EnumElements
API String ID: 1450464846-3979406166
Opcode ID: 8eb9f69e3a10fdd29bfa279f6bfee57f96b6deed7f3ebab9d1048adfa48e4b67
Instruction ID: 5dba1744c5b5de0f9155450dbe59886b99851aa8db01ee64711876f5e4005bfc
Opcode Fuzzy Hash: 8eb9f69e3a10fdd29bfa279f6bfee57f96b6deed7f3ebab9d1048adfa48e4b67
Instruction Fuzzy Hash: 59513966F28B02C6EA51AFA5F8162A933A0FB84BD4F444031DE6D47764DF3CE455C702

Function 00007FF8E6A4C560 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4C57A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C597
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4C5C1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4C5DE
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C5FF
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4C660
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A4C678
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4C68F
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4C69A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4C6B1
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4C6B7
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4C6CC
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A4C6EE

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A4C70D
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A4C6F8
The Python object is invalid, xrefs: 00007FF8E6A4C589
:EnumConnectionPoints, xrefs: 00007FF8E6A4C573
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4C6A0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Eval_Thread$String$Object_RestoreSave$Arg_ClearD@@@DeallocDict_FromItemParseSubclassTupleU_object@@
String ID: :EnumConnectionPoints$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1575696441-1443830432
Opcode ID: 0712ce87178bfadcc5ff79b18fb1ae64d632417acd71ef3a6a0978a4ee91af76
Instruction ID: ebd6d6137877d3ff542dc8555498e6386a47eb2a5e1e8f0debbcf52c57eba656
Opcode Fuzzy Hash: 0712ce87178bfadcc5ff79b18fb1ae64d632417acd71ef3a6a0978a4ee91af76
Instruction Fuzzy Hash: 7B515121F29A4282EA559B96F84637963A0FF48FD4F446435DD2E07764DF2CF445C302

Function 00007FF8E6A63600 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6361C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A63641

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A637A6
:Enum, xrefs: 00007FF8E6A6364F
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A63791
The Python object is invalid, xrefs: 00007FF8E6A63615
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A63739

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :Enum$The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 1450464846-189679734
Opcode ID: 4446e3cef71df92bc008aa19c3383b66e5144dc8c268a0179df0e4bf6ee6715c
Instruction ID: 3f646daf294d55093e6d76aead3e0f7a6b4b658d3d119cf0bed0a909128aed39
Opcode Fuzzy Hash: 4446e3cef71df92bc008aa19c3383b66e5144dc8c268a0179df0e4bf6ee6715c
Instruction Fuzzy Hash: 00518E65F28A02C2EE449BA6F95627923A0FF58FD4F446031CE2E07764DF2CE4428342

Function 00007FF8E6A5C770 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 122threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5C7A3
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5C7D6
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5C7EA
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5C801
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5C827
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A5C892
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A5C8AA
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5C8C0
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5C8CB
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5C8E2
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5C8E8
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5C8FD
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A5C915

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A5C934
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A5C91F
The Python object is invalid, xrefs: 00007FF8E6A5C795
lO:GetInterfaceFromGlobal, xrefs: 00007FF8E6A5C7CF
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A5C8D1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_Object_$D@@@RestoreSaveStringU_object@@$Arg_ClearDeallocDict_FromItemParseSubclassTuple
String ID: The Python IID map is invalid - the value is not an interface type object$The Python object is invalid$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$lO:GetInterfaceFromGlobal
API String ID: 1851801493-2228798530
Opcode ID: 2b643db9d93c435829e43fcdd8038dd61e6c0fb15544c07019dadf1f13470b9d
Instruction ID: a76a94009768c3c1969dee7f4dff567f1023a76793e37729b6ae546a5856f53d
Opcode Fuzzy Hash: 2b643db9d93c435829e43fcdd8038dd61e6c0fb15544c07019dadf1f13470b9d
Instruction Fuzzy Hash: AC512925F29A4681EA51DFA6E84637923A1FF88BD4F44443ADD5E477A8DF3CF4058302

Function 00007FF8E6A32530 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 109threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A32552
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A3256A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A32582

Part of subcall function 00007FF8E6A79E90: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A22343), ref: 00007FF8E6A79EAA

PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A325C1
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A325CE
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A325DC
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A325F1
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A32624
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3263B
PyErr_Clear.PYTHON313 ref: 00007FF8E6A32646
PyErr_SetString.PYTHON313 ref: 00007FF8E6A3265D
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A32663
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A32678

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A326CA
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A326B5
O:MakePyFactory, xrefs: 00007FF8E6A3254B
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A3264C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$D@@@Err_Object_U_object@@$Arg_ClearDeallocDict_FromItemParseStringTuplemalloc
String ID: O:MakePyFactory$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 4274529425-2898015554
Opcode ID: 973c2a3323ff8601e7fdd29c61675eb4e50f8db31c21d36deea80f50adbc2b51
Instruction ID: 52507cfe219b2a3a5774865259e37cd1d4728a30329aefaa2041feb77fc747f0
Opcode Fuzzy Hash: 973c2a3323ff8601e7fdd29c61675eb4e50f8db31c21d36deea80f50adbc2b51
Instruction Fuzzy Hash: 74513725F29B4282EA109BA2E85637963A1FF89BD5F444035DE5E07755EF2CF0158702

Function 00007FF8E6A4B5A0 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 132COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A4B5C8
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4B609
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A4B621
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4B638
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4B647
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4B65E
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A4B66E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4B6E5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4B6FE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4B712
PyGILState_Release.PYTHON313 ref: 00007FF8E6A4B71B
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A4B74B

Strings

SetBlanket, xrefs: 00007FF8E6A4B6AE
The type does not declare a PyCom constructor, xrefs: 00007FF8E6A4B76D
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A4B755
OkkOkkOk, xrefs: 00007FF8E6A4B682
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4B64D

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Object_$Err_FromState_U_object@@$ClearD@@@Dict_EnsureItemReleaseStringSubclass
String ID: OkkOkkOk$SetBlanket$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 262247152-3502604421
Opcode ID: 69e1550c865143f93abc2c5dbe027a21671af431d72e09b17e609e6c516d3e25
Instruction ID: b3750d6d8286e8066376dacdf2a960590dcfe7852d7a425972e91e754575feed
Opcode Fuzzy Hash: 69e1550c865143f93abc2c5dbe027a21671af431d72e09b17e609e6c516d3e25
Instruction Fuzzy Hash: 1351F432F29A4286EB549F95E856369A3A4FF48BD4F088031DE5E86764DF3CE445C702

Function 00007FF8E6A367E0 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A36800
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A36830
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A36843
CreateTypeLib.OLEAUT32 ref: 00007FF8E6A3685A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A36865
PyMem_Free.PYTHON313 ref: 00007FF8E6A3697B

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A3695A
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A36945
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A36918

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_CreateFreeMem_Object_ParseRestoreSaveTupleTypeU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 3090418528-49823770
Opcode ID: 72342bdb87ee1a3938aa2a56cf8c1cc8f4f5ee2aceda1ef5b2974d6841ec6fc6
Instruction ID: 3cd17bc61ebcbd7cd2552307ab377458e239368d39a2fb28d5d78fc446efb1fb
Opcode Fuzzy Hash: 72342bdb87ee1a3938aa2a56cf8c1cc8f4f5ee2aceda1ef5b2974d6841ec6fc6
Instruction Fuzzy Hash: AC513822F68A0382FA159FA5E8563BD63A0FF88BE4F085031DE5E47764DE2CE5448702

Function 00007FF8E6A59760 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A59779
PySequence_Check.PYTHON313 ref: 00007FF8E6A597CF
PyObject_Size.PYTHON313 ref: 00007FF8E6A597E2
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A59838
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A59870
?PyWinObject_AsTaskAllocatedWCHAR@@YAHPEAU_object@@PEAPEA_WH@Z.PYWINTYPES313 ref: 00007FF8E6A59888
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A598A0
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A598C5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A598E7
CoTaskMemFree.OLE32 ref: 00007FF8E6A598FA
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A59923
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5992B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A59941
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5996F

Strings

OkH, xrefs: 00007FF8E6A59856
Next, xrefs: 00007FF8E6A5979C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Object_Sequence_State_Task$AllocatedArg_CheckClearEnsureErr_FreeItemParseReleaseSizeTupleU_object@@
String ID: Next$OkH
API String ID: 3476162252-3238013965
Opcode ID: 9d7feb38b72c6db611414d0762a001691cc7bdf130ddb0bbc7c76efc5698532a
Instruction ID: 203703c40826046cd7e69f078cc63402e4a6496983c2a6a4b91daf918285d391
Opcode Fuzzy Hash: 9d7feb38b72c6db611414d0762a001691cc7bdf130ddb0bbc7c76efc5698532a
Instruction Fuzzy Hash: F3516F32F28A82C6EA609FA1E90537963A5FF45BE4F044531DE5E4A7A8DF3CE445C702

Function 00007FF8E6A6C850 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A6C877
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A6C882
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A6C8B8
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A6C8D0
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6C8E7
PyErr_Clear.PYTHON313 ref: 00007FF8E6A6C8F6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6C90D
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6C961
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6C97A
PyGILState_Release.PYTHON313 ref: 00007FF8E6A6C982
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A6C9B3

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A6C9D5
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A6C9BD
CopyTo, xrefs: 00007FF8E6A6C932
iOzO, xrefs: 00007FF8E6A6C922
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6C8FC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocObject_$D@@@Err_FromState_U_object@@$ClearDict_EnsureItemReleaseStringSubclass
String ID: CopyTo$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID$iOzO
API String ID: 2765662280-1985235689
Opcode ID: 60ff1881b0c57343388ae6595d991673e102030a17b8193bdfeaad21ca51439b
Instruction ID: 09378bb71e2fcff456187d699e81609a9e463e25dbedde8c549177af783f2e3f
Opcode Fuzzy Hash: 60ff1881b0c57343388ae6595d991673e102030a17b8193bdfeaad21ca51439b
Instruction Fuzzy Hash: A941F532F29B4281EB559BA6E84636973A0BF89BD8F084435CE6E47764DF3CE5048702

Function 00007FF8E6A718F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON313 ref: 00007FF8E6A71920
PySequence_Check.PYTHON313 ref: 00007FF8E6A71932
PySequence_Size.PYTHON313 ref: 00007FF8E6A71943
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A7195D
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A7196E
PyErr_SetString.PYTHON313 ref: 00007FF8E6A71998
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A71A42
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A71A60

Strings

SAFEARRAY descriptions are not yet supported, xrefs: 00007FF8E6A719F4
The first sequence item must be an integer, xrefs: 00007FF8E6A71987
The object is not an TYPEDESC, xrefs: 00007FF8E6A71A71
If the TYPEDESC is of type VT_USERDEFINED, the object must be an integer, xrefs: 00007FF8E6A719D7

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Sequence_$DeallocItem$CheckErr_LongLong_SizeString
String ID: If the TYPEDESC is of type VT_USERDEFINED, the object must be an integer$SAFEARRAY descriptions are not yet supported$The first sequence item must be an integer$The object is not an TYPEDESC
API String ID: 3972667259-4167263409
Opcode ID: 0d4a7940860b962bc09089243b53c8da471959ed3848b1469a49f9e544ca58e9
Instruction ID: 90e88d008324649c336a5db7c8a07a566907d3b8b9894044934682afde22684a
Opcode Fuzzy Hash: 0d4a7940860b962bc09089243b53c8da471959ed3848b1469a49f9e544ca58e9
Instruction Fuzzy Hash: 8B413731F28A4285EA549FA6E85A37923E0FF44BE4F585031DE5E476A4DF3CF8498302

Function 00007FF8E6A65580 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A655AE
PyErr_SetString.PYTHON313 ref: 00007FF8E6A655D8

Strings

The Python object is invalid, xrefs: 00007FF8E6A655A7
The parameters must be sequences of the same size, xrefs: 00007FF8E6A6575B
OO|l:WriteMultiple, xrefs: 00007FF8E6A65610

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: OO|l:WriteMultiple$The Python object is invalid$The parameters must be sequences of the same size
API String ID: 1450464846-1693612115
Opcode ID: 1711b2138d753c9d91289bf25f30c13331635ed8d0b8214f6a2ba1be5570125a
Instruction ID: 0bee1fa88610d5e56693e9ccad90241cd8ca77a79a7fad8042f38e596a29e4cc
Opcode Fuzzy Hash: 1711b2138d753c9d91289bf25f30c13331635ed8d0b8214f6a2ba1be5570125a
Instruction Fuzzy Hash: CC819132F2868286EA609BA1E40237E73A0FF84BE4F544535DE6D47B96DE3CE445C741

Function 00007FF8E6A297F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 137COMMON

Download Yara Rule

APIs

Py_VaBuildValue.PYTHON313 ref: 00007FF8E6A29844
PyTuple_New.PYTHON313 ref: 00007FF8E6A2984E
PyTuple_New.PYTHON313 ref: 00007FF8E6A2987A
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A29892
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A298B6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A298D1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A298E4
PyObject_CallFunction.PYTHON313 ref: 00007FF8E6A2991D
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A29935
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A29948
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A29968
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A299B7

Strings

_InvokeEx_, xrefs: 00007FF8E6A298A7
siiOOO, xrefs: 00007FF8E6A298F6
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A29976

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Err_Object_StringTuple_$AttrBuildCallFunctionOccurredValue
String ID: Unexpected exception in gateway method '%hs'$_InvokeEx_$siiOOO
API String ID: 1082011530-3980730698
Opcode ID: 0062d2ca4f67903a05944ad0af091d179b4596e12a77eef2f1ac959c56440191
Instruction ID: 9f4075967ff8dab2e6239fd51b74756d60c2a8a8536c12f315de4cc61f61f771
Opcode Fuzzy Hash: 0062d2ca4f67903a05944ad0af091d179b4596e12a77eef2f1ac959c56440191
Instruction Fuzzy Hash: 72514932F69A4286EA659BA2E85677863A4BF48FE4F084835DD5D07764DE3CE410C342

Function 00007FF8E6A235D0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A235FD
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07

Strings

iNOO, xrefs: 00007FF8E6A24DC5
The Python object is invalid, xrefs: 00007FF8E6A235DD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$BuildDeallocErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python object is invalid$iNOO
API String ID: 2748234538-3084246592
Opcode ID: 0835efe054a6d96b3a2d3fc7bec2faa361a97bc142c4265c499df6e4c731c32b
Instruction ID: ae1991f056905ec15b5750481dd941674160b332dcd2599062e45133b1178216
Opcode Fuzzy Hash: 0835efe054a6d96b3a2d3fc7bec2faa361a97bc142c4265c499df6e4c731c32b
Instruction Fuzzy Hash: B0514662F28A4282EB549FA6E8567B963A1FF88BD9F044435DE1E47764DF3CE4048302

Function 00007FF8E6A233B0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A233DD
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07

Strings

iNOO, xrefs: 00007FF8E6A24DC5
The Python object is invalid, xrefs: 00007FF8E6A233BD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$BuildDeallocErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python object is invalid$iNOO
API String ID: 2748234538-3084246592
Opcode ID: 25e05c2f87cc9bcecb6d0c1a7ce6f763572b7691bff139c446e08e1cf84807c3
Instruction ID: e5c9ca3ece089b59e204ecf5cd99e3aaf06c4dfa379e166ca4b95e9539343b44
Opcode Fuzzy Hash: 25e05c2f87cc9bcecb6d0c1a7ce6f763572b7691bff139c446e08e1cf84807c3
Instruction Fuzzy Hash: 13515872F28A4282EB549FA1E8567B963A1FF88BD9F044435DE1E47764DF3CE4048302

Function 00007FF8E6A6E530 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6E56B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6E57F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6E5B7
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A6E5E8
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A6E5F6
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A6E604
Py_BuildValue.PYTHON313 ref: 00007FF8E6A6E624
SysFreeString.OLEAUT32 ref: 00007FF8E6A6E632
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6E64B
SysFreeString.OLEAUT32 ref: 00007FF8E6A6E656
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6E66F
SysFreeString.OLEAUT32 ref: 00007FF8E6A6E67A
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6E693

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is invalid, xrefs: 00007FF8E6A6E54B
(OOiO), xrefs: 00007FF8E6A6E60F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Dealloc$FromObject_RestoreSaveStringU_object@@$Free$BuildErr_Value$ErrorInfoObject
String ID: (OOiO)$The Python object is invalid
API String ID: 1273995065-2415557319
Opcode ID: cc195dd4ff7a3e967068ac241a3ea1160ad51fb0976b3b33c1f21a12ccd8400d
Instruction ID: 1935eda1a075097f5052eb4ab24e38776268a65d0eccc2da3912d8296798f5e4
Opcode Fuzzy Hash: cc195dd4ff7a3e967068ac241a3ea1160ad51fb0976b3b33c1f21a12ccd8400d
Instruction Fuzzy Hash: 88412736F29B4286EA119FA1F94626973A0FB84BE4F084032DE6D47B64DF3CE4458702

Function 00007FF8E6A375C0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 100threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A375DE
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FF8E6A375F2
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A37606
PyErr_SetString.PYTHON313 ref: 00007FF8E6A37622
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A37651
PyErr_Format.PYTHON313 ref: 00007FF8E6A37674
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A376A0
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A376C3
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A376EA
RegisterDragDrop.OLE32 ref: 00007FF8E6A376FD
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A37708

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A37611
None is not a valid interface object in this context, xrefs: 00007FF8E6A3763E
OO:RegisterDragDrop, xrefs: 00007FF8E6A375D2
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A3765F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$Object_RestoreSave$Arg_DragDropFormatInstanceOccurredParseRegisterStringTupleU_object@@
String ID: None is not a valid interface object in this context$OO:RegisterDragDrop$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 3607397969-3968654099
Opcode ID: 62696f03a00dcb5980d92ca68c852815950309e67918f24be5b2cc809bec748d
Instruction ID: 86b98ebcee2cfa88f89735f1cfea109cea8554d4bd34cb1d86275f4adcdbc6f8
Opcode Fuzzy Hash: 62696f03a00dcb5980d92ca68c852815950309e67918f24be5b2cc809bec748d
Instruction Fuzzy Hash: 6B41FA66F28A4381EB409FA9F85627963A0FF88BE4B484436DE6D47764DF3CE4448702

Function 00007FF8E6A2F640 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 100threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A2F66D
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A2F681
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A2F695
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2F6B1
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A2F6ED
PyErr_Format.PYTHON313 ref: 00007FF8E6A2F710
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2F731
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2F754
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2F773
WriteClassStm.OLE32 ref: 00007FF8E6A2F786
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2F79C

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A2F6A0
None is not a valid interface object in this context, xrefs: 00007FF8E6A2F6DA
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A2F6FB
OO:WriteClassStm, xrefs: 00007FF8E6A2F661

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_$Object_RestoreSave$Arg_ClassD@@@FormatInstanceOccurredParseStringTupleU_object@@Write
String ID: None is not a valid interface object in this context$OO:WriteClassStm$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 1895405897-3112024477
Opcode ID: efdbcf2b1b2f6c4f06ad91ce148d3f1cd4097674158dd83aaeba6cbdc7bf415e
Instruction ID: 90a520fae94ec66aa2835cc2072a17395f1b1362a2e7c178baf36b3cb5135a7a
Opcode Fuzzy Hash: efdbcf2b1b2f6c4f06ad91ce148d3f1cd4097674158dd83aaeba6cbdc7bf415e
Instruction Fuzzy Hash: 84414862FA8A4681EA109FA5E89677923A1FF89BE8F445036DD1E57764DF3CF404C302

Function 00007FF8E6A4E770 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 123threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4E793
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4E7CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A4E7DE
PyErr_NoMemory.PYTHON313 ref: 00007FF8E6A4E7E9
VariantClear.OLEAUT32 ref: 00007FF8E6A4E83D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A4E846
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A4E857
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4E872
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4E890
VariantClear.OLEAUT32 ref: 00007FF8E6A4E8AD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A4E8B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A4E8C7

Strings

O:SetTypeDescAlias, xrefs: 00007FF8E6A4E7C3
The Python object is invalid, xrefs: 00007FF8E6A4E785

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: free$ClearErr_Eval_ThreadVariant$Arg_MemoryParseRestoreSaveStringTuplemalloc
String ID: O:SetTypeDescAlias$The Python object is invalid
API String ID: 3750051116-4177356974
Opcode ID: b8cff7fe84e144c80ac6717f38dacabc48e24d30e2b1aa69d3c9b33cfa31064b
Instruction ID: f490b63906fedb5f7b66f3f9ff4d5e2a6bb2b2d2a57c7c27277a17152fb2882a
Opcode Fuzzy Hash: b8cff7fe84e144c80ac6717f38dacabc48e24d30e2b1aa69d3c9b33cfa31064b
Instruction Fuzzy Hash: A8414C26F28A4282EF559F96E84637963A0FF48FE4F094435CE2D47795DE3CE8468302

Function 00007FF8E6A66550 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A66577

Part of subcall function 00007FF8E6A641A0: PyTuple_New.PYTHON313 ref: 00007FF8E6A641C2
Part of subcall function 00007FF8E6A641A0: PyLong_FromUnsignedLong.PYTHON313 ref: 00007FF8E6A641EA

PyErr_Occurred.PYTHON313 ref: 00007FF8E6A665A9
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6660E
?PyWinSequence_Tuple@@YAPEAU_object@@PEAU1@PEAK@Z.PYWINTYPES313 ref: 00007FF8E6A66626
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6664B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6665F
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A6667B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A666E1
PyGILState_Release.PYTHON313 ref: 00007FF8E6A666EA

Strings

Sequence not of required length, xrefs: 00007FF8E6A66641
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A665C4, 00007FF8E6A666BB
ReadMultiple, xrefs: 00007FF8E6A665BB, 00007FF8E6A665F0, 00007FF8E6A666B2
(O), xrefs: 00007FF8E6A665DF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_$OccurredState_$EnsureFromLongLong_ReleaseSequence_StringTuple@@Tuple_U_object@@Unsigned
String ID: (O)$ReadMultiple$Sequence not of required length$Unexpected exception in gateway method '%hs'
API String ID: 593918470-667573635
Opcode ID: df32c234d093a31be483a56cb4a80ff0bbce1182497ea2cfb331fcd07c18992d
Instruction ID: b7c07a892297129cc7db5ef43d10cb8ae7f6802985dc0aa00447b4a26bf240ce
Opcode Fuzzy Hash: df32c234d093a31be483a56cb4a80ff0bbce1182497ea2cfb331fcd07c18992d
Instruction Fuzzy Hash: B0515AB6F29A4282EA599BA1F81637D73A0BF84BD4F455035ED2E47295DE3CE844C303

Function 00007FF8E6A617E0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 118threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6182F
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A61843
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6185F
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A61893
PyErr_Format.PYTHON313 ref: 00007FF8E6A618B6
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A618DB
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A618FE
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6192A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A61953

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A6184E
The Python object is invalid, xrefs: 00007FF8E6A617FE
None is not a valid interface object in this context, xrefs: 00007FF8E6A61880
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A618A1
O:Load, xrefs: 00007FF8E6A61828

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_$Arg_BuildErrorFormatFromInfoInstanceObjectOccurredParseStringTupleU_object@@Value
String ID: None is not a valid interface object in this context$O:Load$The Python object is NULL and no error occurred$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 21361869-1147340033
Opcode ID: eea6403336c8b20c2181ecfe285304b0c38c2489a850f52a3d672f099405650e
Instruction ID: 63d161556f9a698af41482da00cec9d6d773a347aa36800bd856c1a69bbf963f
Opcode Fuzzy Hash: eea6403336c8b20c2181ecfe285304b0c38c2489a850f52a3d672f099405650e
Instruction Fuzzy Hash: B5515D26F28A4281EB54DF9AF44627927A0FF88FD8B445032DE2D57764DF3CE8448342

Function 00007FF8E6A74630 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7468A
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A746A5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A746B9
VariantInit.OLEAUT32 ref: 00007FF8E6A74724
VariantCopyInd.OLEAUT32 ref: 00007FF8E6A74732
VariantChangeType.OLEAUT32 ref: 00007FF8E6A74AC6
wsprintfW.USER32 ref: 00007FF8E6A74AE0
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A74AEB
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A74B06
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A74B19
VariantClear.OLEAUT32 ref: 00007FF8E6A74B36

Strings

Can't convert vectors!, xrefs: 00007FF8E6A74683
The Variant type (0x%x) is not supported, and it can not be converted to a string, xrefs: 00007FF8E6A74AD4

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Variant$DeallocErr_FromObjectObject_U_object@@$ChangeClearCopyInitTypewsprintf
String ID: Can't convert vectors!$The Variant type (0x%x) is not supported, and it can not be converted to a string
API String ID: 2333812007-248213727
Opcode ID: 3c3ecbe4457ca067b2642cb0f2cff094b4f70ceb9cbf193675c5d1e9bcd4e375
Instruction ID: eb7087e062a22185b10bc6ab0dab111f377b121f5091c50167f58b44056dbbb5
Opcode Fuzzy Hash: 3c3ecbe4457ca067b2642cb0f2cff094b4f70ceb9cbf193675c5d1e9bcd4e375
Instruction Fuzzy Hash: C451A132F28A4281EA249B95E85637963A1FF88BE8F444435DE5E876A4DF3CF554C302

Function 00007FF8E6A61610 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 118threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6165F
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A61673
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6168F
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A616C3
PyErr_Format.PYTHON313 ref: 00007FF8E6A616E6
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6170B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6172E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6175A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A61783

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A6167E
The Python object is invalid, xrefs: 00007FF8E6A6162E
None is not a valid interface object in this context, xrefs: 00007FF8E6A616B0
O:InitNew, xrefs: 00007FF8E6A61658
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A616D1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Err_$DeallocObject_$Arg_BuildErrorFormatFromInfoInstanceObjectOccurredParseStringTupleU_object@@Value
String ID: None is not a valid interface object in this context$O:InitNew$The Python object is NULL and no error occurred$The Python object is invalid$argument is not a COM object (got type=%s)
API String ID: 21361869-4090857235
Opcode ID: 1e8b6f9860eb3b4ab8c6028b39c653b85af26cd9a4c121a1f94cfb9c1066d278
Instruction ID: d223a282902c8e4ac2279dc5fb7f5125ef9c08945f5ef7c6944217c80e2a4336
Opcode Fuzzy Hash: 1e8b6f9860eb3b4ab8c6028b39c653b85af26cd9a4c121a1f94cfb9c1066d278
Instruction Fuzzy Hash: 91514F79F28A4281EB54DF9AF44627927A0FB48FD8B484432DE2E57764DF3CE8448702

Function 00007FF8E6A26750 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A267AE
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FF8E6A267BC
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FF8E6A267CA
?PyWinObject_FromFILETIME@@YAPEAU_object@@AEBU_FILETIME@@@Z.PYWINTYPES313 ref: 00007FF8E6A267D8
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A267E6
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A267F3
Py_BuildValue.PYTHON313 ref: 00007FF8E6A26846
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A26863
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A26882
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A268A2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A268C3
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A268E4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A26905

Strings

OiOOOOiiOii, xrefs: 00007FF8E6A26830

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocFromObject_U_object@@$E@@@$BuildD@@@R@@@Value
String ID: OiOOOOiiOii
API String ID: 34604411-2542124187
Opcode ID: 01da27dbc9b3834a4f26d2a800d9d047a6da26ea56720c153e2ef0e9147bd391
Instruction ID: 5b6ac6fdd468b8743ce4b47ec553e781cbb03fd53cb027a3f4afe3d8a2319a21
Opcode Fuzzy Hash: 01da27dbc9b3834a4f26d2a800d9d047a6da26ea56720c153e2ef0e9147bd391
Instruction Fuzzy Hash: AF512632F2AB4286EA689F91E449B6973A4FB46BD4F045039DE9D43B94DF3CE444CB01

Function 00007FF8E6A57710 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 112threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A57722
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5775E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5777B
CreateErrorInfo.OLEAUT32 ref: 00007FF8E6A57786
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A577B1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A577D6
SetErrorInfo.OLEAUT32 ref: 00007FF8E6A577E7
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5782D
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5783D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5785E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A57874
PyGILState_Release.PYTHON313 ref: 00007FF8E6A57893

Strings

Clone, xrefs: 00007FF8E6A57738
Could not convert the result from Next()/Clone() into the required COM interface, xrefs: 00007FF8E6A5787A

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Dealloc$ErrorInfoRestoreSaveState_$CreateEnsureInstanceObject_Release
String ID: Clone$Could not convert the result from Next()/Clone() into the required COM interface
API String ID: 1840915814-380556627
Opcode ID: cdf16ca84849ec4929f73966866a357999e830762465b363b5972940b674a09c
Instruction ID: d1a666ea5097779a0c5f8d47ae8e5f91022842dd6a6a2232e67292d2d422ca7f
Opcode Fuzzy Hash: cdf16ca84849ec4929f73966866a357999e830762465b363b5972940b674a09c
Instruction Fuzzy Hash: 23414D36F28A4282EB00DFA9E84527967A1FF84BE9F144431DE1E93764DE3DE445C702

Function 00007FF8E6A785F0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A78619
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A78631
PyLong_AsVoidPtr.PYTHON313 ref: 00007FF8E6A78644
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A78652
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A78699

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A78755
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A78740
OO:interface, xrefs: 00007FF8E6A7860D
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A786F6

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: D@@@Object_U_object@@$Arg_Err_FromLong_OccurredParseTupleVoid
String ID: OO:interface$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 2720818191-2917659827
Opcode ID: 203365e1fb73e54ed11148d8af82675ea2f01e149807c097d02a3177eb9438e4
Instruction ID: 3449f5864002932855c49ba69c77348d5118f58b7c09236779e435bfca084ff1
Opcode Fuzzy Hash: 203365e1fb73e54ed11148d8af82675ea2f01e149807c097d02a3177eb9438e4
Instruction Fuzzy Hash: 8B417C32F29A4682FA509BA5E45637963A1FF89BE8F444035DE1E07764EF2CF501C702

Function 00007FF8E6A637D0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 154COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A63801
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A63826
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A6384A
PyGILState_Release.PYTHON313 ref: 00007FF8E6A639F5

Strings

Create, xrefs: 00007FF8E6A6385C, 00007FF8E6A638CE, 00007FF8E6A6392D, 00007FF8E6A639B8
OOkk, xrefs: 00007FF8E6A63918
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A63865, 00007FF8E6A638D7, 00007FF8E6A639C1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$D@@@EnsureErr_FromObject_OccurredReleaseU_object@@
String ID: Create$OOkk$Unexpected exception in gateway method '%hs'
API String ID: 2785446524-1760439019
Opcode ID: 494efaa52a05e6433ae5abe11b8bdeab3002ac92e59e3c794385f55662933602
Instruction ID: 8cadcfec41a05f0f0812d58e421d0519c75a4d70fadd44c6ca8aed088ec2f845
Opcode Fuzzy Hash: 494efaa52a05e6433ae5abe11b8bdeab3002ac92e59e3c794385f55662933602
Instruction Fuzzy Hash: E3616B32F29A4381EA558BA1E8163BD73A0BF94BD8F445035DE6E47764DE3CE406CB42

Function 00007FF8E6A45700 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 111threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A45712
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A4574E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4576B
CreateErrorInfo.OLEAUT32 ref: 00007FF8E6A45776
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A457A1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A457C6
SetErrorInfo.OLEAUT32 ref: 00007FF8E6A457D7
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4581A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A45827
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A45848
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4585E
PyGILState_Release.PYTHON313 ref: 00007FF8E6A45879

Strings

Clone, xrefs: 00007FF8E6A45728

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Dealloc$ErrorInfoRestoreSaveState_$CreateEnsureInstanceObject_Release
String ID: Clone
API String ID: 1840915814-766296796
Opcode ID: 909109a676974ca5c0b65825404e38c8476b1a38b6b20eb16df2f45408d6e7e5
Instruction ID: 86d0f6eea8f625cdbb6ccd1aa8bf5b5fcdbb32e9bc6aa9896b7d018ebf3219d9
Opcode Fuzzy Hash: 909109a676974ca5c0b65825404e38c8476b1a38b6b20eb16df2f45408d6e7e5
Instruction Fuzzy Hash: 12413D36F28A42C2EB049FA5E84526963A1FF88FE5F144031DE0E87765DE3DE445C702

Function 00007FF8E6A55510 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 111threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A55522
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5555E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5557B
CreateErrorInfo.OLEAUT32 ref: 00007FF8E6A55586
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A555B1
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A555D6
SetErrorInfo.OLEAUT32 ref: 00007FF8E6A555E7
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5562A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A55637
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A55658
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5566E
PyGILState_Release.PYTHON313 ref: 00007FF8E6A55689

Strings

Clone, xrefs: 00007FF8E6A55538

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Dealloc$ErrorInfoRestoreSaveState_$CreateEnsureInstanceObject_Release
String ID: Clone
API String ID: 1840915814-766296796
Opcode ID: 9a8e1870d0b0de3aea17637ca6d30a07277ba3c55849ffd086a404bf67c098b9
Instruction ID: 73eaae645025f7dc45159627f2bda2a5688f7ec8a108cbb60d22261ab12069fc
Opcode Fuzzy Hash: 9a8e1870d0b0de3aea17637ca6d30a07277ba3c55849ffd086a404bf67c098b9
Instruction Fuzzy Hash: 63413036F28B4282EB04DFA5D84526963A2FF84BE9F154031CE1D47B65DE3DE445C702

Function 00007FF8E6A5A560 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 111threadCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5A572
PyObject_IsInstance.PYTHON313 ref: 00007FF8E6A5A5AE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5A5CB
CreateErrorInfo.OLEAUT32 ref: 00007FF8E6A5A5D6
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5A601
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5A626
SetErrorInfo.OLEAUT32 ref: 00007FF8E6A5A637
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5A67A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5A687
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5A6A8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5A6BE
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5A6D9

Strings

Clone, xrefs: 00007FF8E6A5A588

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Dealloc$ErrorInfoRestoreSaveState_$CreateEnsureInstanceObject_Release
String ID: Clone
API String ID: 1840915814-766296796
Opcode ID: 04e78f68a47a3c54a56807dbed01e187d6cda0be471370c1f19c097e57bc805c
Instruction ID: 7a689bfedfd25156e63c004b5bb13adc1bf0924e82a03a560e2503bada6cd335
Opcode Fuzzy Hash: 04e78f68a47a3c54a56807dbed01e187d6cda0be471370c1f19c097e57bc805c
Instruction Fuzzy Hash: A9412A36F28A0282EB00DFA9E85526963A1FB98BE9F554031CF0D43B64DE3DE445C702

Function 00007FF8E6A3C690 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 108COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A469A1
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A469B0
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A469C8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A469DF
PyErr_Clear.PYTHON313 ref: 00007FF8E6A469EA
PyErr_SetString.PYTHON313 ref: 00007FF8E6A46A01
PyGILState_Release.PYTHON313 ref: 00007FF8E6A46A27
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A46A62
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A46AF3

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A46A81
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A46A6C
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A469F0
Save, xrefs: 00007FF8E6A46ACD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_Object_State_$ClearD@@@Dict_EnsureFromItemReleaseStringSubclassU_object@@
String ID: Save$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 643398647-2418897439
Opcode ID: f0b18900921c0ab46cabfe901ff53355117424175df26e0dc67bf54f0be26565
Instruction ID: eade3868497a676f94636c5e69cfd45164f50c2d2716d45c3fc1c2b923651b43
Opcode Fuzzy Hash: f0b18900921c0ab46cabfe901ff53355117424175df26e0dc67bf54f0be26565
Instruction Fuzzy Hash: 1E417C62F28A9281EB509BA6E81637963B0FF85BE4F449035DE5E07795DF3CE844C302

Function 00007FF8E6A3C680 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A467DF
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A467EE
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A46806
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4681D
PyErr_Clear.PYTHON313 ref: 00007FF8E6A46828
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4683F
PyGILState_Release.PYTHON313 ref: 00007FF8E6A46865
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A468A1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4692D

Strings

Load, xrefs: 00007FF8E6A46907
The type does not declare a PyCom constructor, xrefs: 00007FF8E6A468C0
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A468AB
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A4682E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_Object_State_$ClearD@@@Dict_EnsureFromItemReleaseStringSubclassU_object@@
String ID: Load$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 643398647-1545106082
Opcode ID: d742f415906d342ef1bcedfd1f57f0845aa8e523bdc6ce8ee25765792b09f493
Instruction ID: 241d0eccb1f227d2a0871eceb8ea0a7f2b03e541dc44c7635c094b8a63c1bc13
Opcode Fuzzy Hash: d742f415906d342ef1bcedfd1f57f0845aa8e523bdc6ce8ee25765792b09f493
Instruction Fuzzy Hash: A7414D32F28A4682EA549BA6E85637863B0FF45BE4F445035DE5E47794EF3CE409C702

Function 00007FF8E6A237E0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PyErr_Fetch.PYTHON313 ref: 00007FF8E6A23801

Part of subcall function 00007FF8E6A23CD0: PyErr_GivenExceptionMatches.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A23817), ref: 00007FF8E6A23CFE
Part of subcall function 00007FF8E6A23CD0: PyErr_Format.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A23817), ref: 00007FF8E6A23D21

PyErr_Clear.PYTHON313 ref: 00007FF8E6A23840
?GetPythonTraceback@@YAPEA_WPEAU_object@@00@Z.PYWINTYPES313 ref: 00007FF8E6A23855
SysAllocString.OLEAUT32 ref: 00007FF8E6A238B6
SysAllocString.OLEAUT32 ref: 00007FF8E6A238CF
PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FF8E6A238E8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A23924
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2393F
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2395A
PyErr_Clear.PYTHON313 ref: 00007FF8E6A23960

Strings

Unexpected Python Error: , xrefs: 00007FF8E6A23892
Python COM Server Internal Error, xrefs: 00007FF8E6A238C8
%s%s, xrefs: 00007FF8E6A2389E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$Dealloc$AllocClearExceptionGivenMatchesString$FetchFormatPythonTraceback@@U_object@@00@
String ID: %s%s$Python COM Server Internal Error$Unexpected Python Error:
API String ID: 766691455-245474060
Opcode ID: 1c7ce6dff1decef65a447aa893d442d3e82c6ae581f46efb95c70f5c55d476cd
Instruction ID: 2a1a8dff0cff5c384f718116b286be878f3383c7fb7ea1c6c1bfbbf99a390c65
Opcode Fuzzy Hash: 1c7ce6dff1decef65a447aa893d442d3e82c6ae581f46efb95c70f5c55d476cd
Instruction Fuzzy Hash: FB41A032F29B4282EA508F91E855379A3A0FF96BE4F005131EE5E42B64DF7CE0908701

Function 00007FF8E6A46390 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 94COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A463AB
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A463D8
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A463F5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4640C
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4641B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A46432
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A46487
PyGILState_Release.PYTHON313 ref: 00007FF8E6A4648F
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A464A9

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A464CB
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A464B3
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A46421
Save, xrefs: 00007FF8E6A4645B

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_Object_State_$ClearD@@@Dict_EnsureFromItemReleaseStringSubclassU_object@@
String ID: Save$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 643398647-2418897439
Opcode ID: abdd2a7e4cb69196a14d6d395e8a2cb25cf6a08dd9f15bc3226e7f6c0fac2060
Instruction ID: 214503f4596b8205209e61574b120c9a3fb8dd30a226d99e6cb34d5a340ea40a
Opcode Fuzzy Hash: abdd2a7e4cb69196a14d6d395e8a2cb25cf6a08dd9f15bc3226e7f6c0fac2060
Instruction Fuzzy Hash: 3B414526F29A4282EF519FA1E96637863B0BF49BE4F485431CE6D47764DF3CE4488302

Function 00007FF8E6A46500 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A4651A
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A46547
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A46564
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4657B
PyErr_Clear.PYTHON313 ref: 00007FF8E6A4658A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A465A1
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A465EC
PyGILState_Release.PYTHON313 ref: 00007FF8E6A465F4
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A46616

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A46638
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A46620
SaveCompleted, xrefs: 00007FF8E6A465C5
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A46590

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_Object_State_$ClearD@@@Dict_EnsureFromItemReleaseStringSubclassU_object@@
String ID: SaveCompleted$The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 643398647-1391842039
Opcode ID: 27935d292763f3edf9d06bd5aeef85a57339d2f72af13c1a67d55c8e29470a8c
Instruction ID: 1ea6cbd8bb6ffab3ef2f6c63f8385414d7d974c187f76283096f28bb57e95ea7
Opcode Fuzzy Hash: 27935d292763f3edf9d06bd5aeef85a57339d2f72af13c1a67d55c8e29470a8c
Instruction Fuzzy Hash: 96412666F29A4282EA549BA5E84637863B0FF89BD8F085431CE5E07769DF3CE405C303

Function 00007FF8E6A42800 Relevance: 21.1, APIs: 14, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

PyDict_New.PYTHON313(?,?,00000000,00007FF8E6A42E19,?,?,?,?,00007FF8E6A43FBB,?,?,?,?,00000000,00007FF8E6A2CDCA), ref: 00007FF8E6A4283C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dict_
String ID:
API String ID: 3613996275-0
Opcode ID: 6c18a5c0e70239ba1c5fed97653a769d8cac3d3fb629dc6170e410f9538843e9
Instruction ID: 148472bacea31fa2cb4e6a1dd494396fc49639d7195570a469a3de8fc41dddfa
Opcode Fuzzy Hash: 6c18a5c0e70239ba1c5fed97653a769d8cac3d3fb629dc6170e410f9538843e9
Instruction Fuzzy Hash: 81513935F29A4381FA989B92E95633D63A2BF48BE4F084034DE1E46795EF2DE4518302

Function 00007FF8E6A25770 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313 ref: 00007FF8E6A257A1
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A257BA
Py_BuildValue.PYTHON313 ref: 00007FF8E6A257DB
PyObject_Call.PYTHON313 ref: 00007FF8E6A257ED
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A25803
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A25816
PySequence_Size.PYTHON313 ref: 00007FF8E6A25829
PyErr_SetNone.PYTHON313 ref: 00007FF8E6A2583E
PySequence_GetItem.PYTHON313 ref: 00007FF8E6A2584B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A25862

Strings

(i), xrefs: 00007FF8E6A257D4
Next, xrefs: 00007FF8E6A257B0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Err_Object_Sequence_$AttrBuildCallItemNoneOccurredSizeStringValue
String ID: (i)$Next
API String ID: 1124991884-3223589528
Opcode ID: 34caed0f8f93715f5ed9c4dfa8db37e11f0ee9a253f27da2f60fd084c3600fed
Instruction ID: 4514ccfd7f7178ea2d44aa27df15b384c78ecc04aabc8204745352a0770898f0
Opcode Fuzzy Hash: 34caed0f8f93715f5ed9c4dfa8db37e11f0ee9a253f27da2f60fd084c3600fed
Instruction Fuzzy Hash: 38316F32F39A0285EA44AF92E94627973A0FF58BE4F484434DE6E07795EF3CE4409702

Function 00007FF8E6A73650 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A4E309), ref: 00007FF8E6A73669
PyErr_NoMemory.PYTHON313(?,?,?,00007FF8E6A4E309), ref: 00007FF8E6A73677
PyErr_SetString.PYTHON313(?,?,?,00007FF8E6A4E309), ref: 00007FF8E6A736F2
VariantClear.OLEAUT32 ref: 00007FF8E6A7371D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A4E309), ref: 00007FF8E6A73726
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A4E309), ref: 00007FF8E6A73737
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A737B4
VariantInit.OLEAUT32 ref: 00007FF8E6A737E4

Strings

Object is not a VARDESC., xrefs: 00007FF8E6A736E1
If varkind==VAR_PERINSTANCE, value attribute must be an integer, xrefs: 00007FF8E6A737A8
PyObject_AsVARDESC has unknown varkind (%d) - None will be used, xrefs: 00007FF8E6A73811

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Variantfree$ClearInitLongLong_MemoryStringmalloc
String ID: If varkind==VAR_PERINSTANCE, value attribute must be an integer$Object is not a VARDESC.$PyObject_AsVARDESC has unknown varkind (%d) - None will be used
API String ID: 2475635751-3241272580
Opcode ID: 3da1aa0dd26f72acb2fcc2149e3f6d56ba6d94744b0eac69ede12bd99724e0d4
Instruction ID: fe4a3697b5901ac14f8fd81e01a5bff220b85832dd91671d93a010a540b7cbdd
Opcode Fuzzy Hash: 3da1aa0dd26f72acb2fcc2149e3f6d56ba6d94744b0eac69ede12bd99724e0d4
Instruction Fuzzy Hash: D8514762B29A4286EB64CB96E44227A73E4FB58FE4B1A4835CE4D03750DE3CF4618712

Function 00007FF8E6A2C780 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A2C7A9
??0PyWin_AutoFreeBstr@@QEAA@PEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A2C7CC
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A2C7E3
?SetBstr@PyWin_AutoFreeBstr@@QEAAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A2C7F7
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2C810
??1PyWin_AutoFreeBstr@@QEAA@XZ.PYWINTYPES313 ref: 00007FF8E6A2C81D

Strings

The Python object is invalid, xrefs: 00007FF8E6A2C802
Ol:DeleteMemberByName, xrefs: 00007FF8E6A2C79F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Bstr@@$AutoFreeWin_$Arg_Bstr@Err_Object_ParseStringTupleU_object@@
String ID: Ol:DeleteMemberByName$The Python object is invalid
API String ID: 879225695-3479644615
Opcode ID: 863c9b68c3fddfa7151b64f374d761b74c54e888c73aab06af9a1f6da5f26627
Instruction ID: 22ee23c8b7c5f9074880a54ab914f16d25a501105e9a1ecd1e26f7a23a99336f
Opcode Fuzzy Hash: 863c9b68c3fddfa7151b64f374d761b74c54e888c73aab06af9a1f6da5f26627
Instruction Fuzzy Hash: 5A314526F28A4282EB509F95E84676963B0FF48BE4B484431DE5E47B64DF3CE545C701

Function 00007FF8E6A296C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

Py_VaBuildValue.PYTHON313 ref: 00007FF8E6A296E0
PyTuple_New.PYTHON313 ref: 00007FF8E6A296EA
PyTuple_New.PYTHON313 ref: 00007FF8E6A2970D
PyObject_GetAttrString.PYTHON313 ref: 00007FF8E6A29729
PyErr_SetString.PYTHON313 ref: 00007FF8E6A29744
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A29758
PyObject_CallFunction.PYTHON313 ref: 00007FF8E6A2979E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A297B5
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A297C9

Strings

_InvokeEx_, xrefs: 00007FF8E6A2971F
siiOOO, xrefs: 00007FF8E6A29777

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$Object_StringTuple_$AttrBuildCallErr_FunctionValue
String ID: _InvokeEx_$siiOOO
API String ID: 3869705896-1807603863
Opcode ID: 1eb1da2683709897c2077d7f93064814e8a9198ab902c39743d797410abefaa5
Instruction ID: 71b3f828f3222313acc0fe68ecb61f2b460d07df201cca26b87dff6639e817a1
Opcode Fuzzy Hash: 1eb1da2683709897c2077d7f93064814e8a9198ab902c39743d797410abefaa5
Instruction Fuzzy Hash: 2F312831F28A4281EA548FA2E84672963A1FF44FE4F084834DE5E07B95DF3CE4508342

Function 00007FF8E6A26540 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A26562
PyErr_SetString.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A26582
PyErr_SetString.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A265CC
PyObject_IsInstance.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A265DD
PyErr_Format.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A26600
PyErr_SetString.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A26621
PyEval_SaveThread.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A2662E
PyEval_RestoreThread.PYTHON313(?,?,?,00007FF8E6A26513), ref: 00007FF8E6A2664B

Strings

The Python object is NULL and no error occurred, xrefs: 00007FF8E6A26578
None is not a valid interface object in this context, xrefs: 00007FF8E6A265C2
argument is not a COM object (got type=%s), xrefs: 00007FF8E6A265EB

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$String$Eval_Thread$FormatInstanceObject_OccurredRestoreSave
String ID: None is not a valid interface object in this context$The Python object is NULL and no error occurred$argument is not a COM object (got type=%s)
API String ID: 2512274376-1399825911
Opcode ID: ad02bf3bf8136d650288c93cbd541d9e694507540efebfc7e15c368e034df372
Instruction ID: e5ee62c762d4d41fdf3d122aebc5fba00b75f0ae9a6a1857c0ba2d733714da2b
Opcode Fuzzy Hash: ad02bf3bf8136d650288c93cbd541d9e694507540efebfc7e15c368e034df372
Instruction Fuzzy Hash: C4314D61F29A4382EB149BA2E85677923A0FF48BE8F545432CD1E47765DE3CF4048302

Function 00007FF8E6A5B3A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 122threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5B3C4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5B3E1
VariantInit.OLEAUT32 ref: 00007FF8E6A5B447
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B452
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B476
PyTuple_New.PYTHON313 ref: 00007FF8E6A5B4AD
VariantClear.OLEAUT32 ref: 00007FF8E6A5B527

Part of subcall function 00007FF8E6A74630: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7468A
Part of subcall function 00007FF8E6A74630: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A746A5
Part of subcall function 00007FF8E6A74630: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A746B9

_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5B502

Strings

The Python object is invalid, xrefs: 00007FF8E6A5B3D3
|l:Next, xrefs: 00007FF8E6A5B3BD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_Eval_ThreadVariant$Arg_ClearFromInitObjectObject_ParseRestoreSaveStringTupleTuple_U_object@@
String ID: The Python object is invalid$|l:Next
API String ID: 3007185450-1850198577
Opcode ID: 87313b80837f58485680c8af16523fefa3cd301076a0e76e83b3ef8eed4fbde0
Instruction ID: 0f1747191d3182633cd42655bb9fd30c7506cef8cd094c419e01e5d98c6cecff
Opcode Fuzzy Hash: 87313b80837f58485680c8af16523fefa3cd301076a0e76e83b3ef8eed4fbde0
Instruction Fuzzy Hash: D3518D32F29A4282EA14CF95E4562B9A3A1FF84BE5F444536DE0E17794DF7CE445C301

Function 00007FF8E6A5D540 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5D593
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D5A1
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF8E6A5D5B0
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D5FA
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D618
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A5D627
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D63F
PyErr_Clear.PYTHON313 ref: 00007FF8E6A5D64A
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5D683

Strings

WriteAt, xrefs: 00007FF8E6A5D5CB

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$FromState_$Bytes_ClearEnsureErr_LongLong_Object_R@@@ReleaseSizeStringU_object@@
String ID: WriteAt
API String ID: 773893014-3181200592
Opcode ID: 4a2213de3460aeb0b16fbdbf26ea12160fc0ddc62398d65229413acec56dd0b9
Instruction ID: 6aeefaaa0bbca0c8767fe5558d35d501cc8aae7318ea3d1bdebe1557106a5850
Opcode Fuzzy Hash: 4a2213de3460aeb0b16fbdbf26ea12160fc0ddc62398d65229413acec56dd0b9
Instruction Fuzzy Hash: C8415872F29B4682EB50AFA0E80632973A1FB44BE4F044035DE5E47B94EE3CE4468702

Function 00007FF8E6A6F820 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 79threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6F85C
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6F879
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6F896
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A6F8BB
Py_BuildValue.PYTHON313 ref: 00007FF8E6A6F8FC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6F913
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6F919
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6F934

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is invalid, xrefs: 00007FF8E6A6F83C
Oiiiii, xrefs: 00007FF8E6A6F8E1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Dealloc$BuildErr_FromObject_U_object@@Value$D@@@ErrorInfoObjectString
String ID: Oiiiii$The Python object is invalid
API String ID: 3592653497-2154538676
Opcode ID: 1402801302b611fb45990ad6508dd1b62de0f3a39aa8c61706d9c9604194c9f2
Instruction ID: 26413a14fc92aa6352d08bb97bf06439ca605ff0bd41747950b10adc0199123e
Opcode Fuzzy Hash: 1402801302b611fb45990ad6508dd1b62de0f3a39aa8c61706d9c9604194c9f2
Instruction Fuzzy Hash: 04311A76F28B4682EB509FA2E505269B3A1FB44BD4B044036DE6E17B68DF3CE454C702

Function 00007FF8E6A75642 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32 ref: 00007FF8E6A7564D
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A7572C
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A75748
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A7575E
PyErr_Clear.PYTHON313 ref: 00007FF8E6A75769
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A75782
PyErr_SetString.PYTHON313 ref: 00007FF8E6A757B2

Strings

The type does not declare a PyCom constructor, xrefs: 00007FF8E6A757A1
The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A7578C
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A7576F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Object_$ArrayClearD@@@DeallocDict_ElementFromItemSafeStringSubclassU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$The type does not declare a PyCom constructor$There is no interface object registered that supports this IID
API String ID: 2284677161-49823770
Opcode ID: ca4ee01924e71e3c8d2cc8fdfc44f10300fd32edfd50ccf10bd46108cc7d02a1
Instruction ID: 6f526901feb75bcdd857d60bc7021ebe1d3995ce2a2605006d8d67717479594a
Opcode Fuzzy Hash: ca4ee01924e71e3c8d2cc8fdfc44f10300fd32edfd50ccf10bd46108cc7d02a1
Instruction Fuzzy Hash: 16310A21F29A02C1FA55AB96E86637823A1BF44BE4F488431CD1E4B795DF3CF505D302

Function 00007FF8E6A30500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 58threadfileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A30519
??0PyWin_AutoFreeBstr@@QEAA@PEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A30537
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A3054E
?SetBstr@PyWin_AutoFreeBstr@@QEAAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A30562
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A30568
StgIsStorageFile.OLE32 ref: 00007FF8E6A30576
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A30581
??1PyWin_AutoFreeBstr@@QEAA@XZ.PYWINTYPES313 ref: 00007FF8E6A305BB

Strings

O:StgIsStorageFile, xrefs: 00007FF8E6A30512

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Bstr@@$AutoFreeWin_$Eval_Thread$Arg_Bstr@FileObject_ParseRestoreSaveStorageTupleU_object@@
String ID: O:StgIsStorageFile
API String ID: 3481950447-3657482639
Opcode ID: cef4aefa2ef294e73bef1be710c66d3b5a0e0171d6d7720813303fbecad44a49
Instruction ID: 2fb08e01ca9436bfb7f4dc96d7473f60bebd6d71be246696279b9d25c1895159
Opcode Fuzzy Hash: cef4aefa2ef294e73bef1be710c66d3b5a0e0171d6d7720813303fbecad44a49
Instruction Fuzzy Hash: D7216322F2CA4382EB009FA5F85227AA361FFC8BE5F484435DE5E46664DE7CE545C701

Function 00007FF8E6A24380 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2438A
PyErr_Fetch.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2439F
PySys_GetObject.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243AC
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243C2
PyFile_WriteObject.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243DC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243EB
fprintf.MSPDB140-MSVCRT ref: 00007FF8E6A243FE

Part of subcall function 00007FF8E6A21C00: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8E6A21C37

_Py_Dealloc.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A24411
PyErr_Restore.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2442B

Strings

stderr, xrefs: 00007FF8E6A243A5

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Object$DeallocDebugFetchFile_FromObject_OutputRestoreStringSys_U_object@@Write__acrt_iob_func__stdio_common_vfwprintffprintf
String ID: stderr
API String ID: 1123423785-1769798200
Opcode ID: 8ec8b82474e6eb592134d3c257bdc853be526ce0a1b0aae09fabf301b45a2e80
Instruction ID: d7ddaed417466a30f5933e0d93c4854c111304a4c7035f9eef05a268e0d2d7ed
Opcode Fuzzy Hash: 8ec8b82474e6eb592134d3c257bdc853be526ce0a1b0aae09fabf301b45a2e80
Instruction Fuzzy Hash: 90118F21F69A8382EA149FD1F8097A963A0FF45BE9F040035CE0E47BA4DE7CE445C702

Function 00007FF8E6A66710 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A66737

Part of subcall function 00007FF8E6A641A0: PyTuple_New.PYTHON313 ref: 00007FF8E6A641C2
Part of subcall function 00007FF8E6A641A0: PyLong_FromUnsignedLong.PYTHON313 ref: 00007FF8E6A641EA

PyErr_Occurred.PYTHON313 ref: 00007FF8E6A6676B
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A667C8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A66849
PyGILState_Release.PYTHON313 ref: 00007FF8E6A66852

Strings

OOk, xrefs: 00007FF8E6A667FF
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A66786, 00007FF8E6A667E0
WriteMultiple, xrefs: 00007FF8E6A6677D, 00007FF8E6A667D7, 00007FF8E6A6680A

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_OccurredState_$DeallocEnsureFromLongLong_ReleaseTuple_Unsigned
String ID: OOk$Unexpected exception in gateway method '%hs'$WriteMultiple
API String ID: 2158939024-700270164
Opcode ID: bfa9299037753223d637199191b44cbd4750cebe2a17dfd8ac4160e460269bca
Instruction ID: 7840d1c0765947c9e32ed52f9a4e40d09cf518211b046d29dd66ce3073e89562
Opcode Fuzzy Hash: bfa9299037753223d637199191b44cbd4750cebe2a17dfd8ac4160e460269bca
Instruction Fuzzy Hash: 9141C572F2964282EB149BE1E81637D73A0BF59BE4F445135DD2E47395EE3CE8058342

Function 00007FF8E6A6B8D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B8F5
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B924

Strings

The Python object is invalid, xrefs: 00007FF8E6A6B8E7
O:DestroyElement, xrefs: 00007FF8E6A6B941

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: O:DestroyElement$The Python object is invalid
API String ID: 1450464846-3564787880
Opcode ID: 7e5c85f843a68c7219634350855d3d65e638f2bba635a558cd3caab827ab1134
Instruction ID: 32051a9e3738c3bdd84d77d708601ad6c07bb73a30b97ffce99cfabb35b18f0e
Opcode Fuzzy Hash: 7e5c85f843a68c7219634350855d3d65e638f2bba635a558cd3caab827ab1134
Instruction Fuzzy Hash: 62315E76F28B4282EB108F96F44226A73A0FF88BD4B484032DE6D57759DF2CE4558702

Function 00007FF8E6A497F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A49827
PyErr_SetString.PYTHON313 ref: 00007FF8E6A49844
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4987B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4988F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A498B6
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A498F3
CoTaskMemFree.OLE32 ref: 00007FF8E6A49901

Strings

Oi:GetCategoryDesc, xrefs: 00007FF8E6A49820
The Python object is invalid, xrefs: 00007FF8E6A49836

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Arg_D@@@Err_FreeFromParseRestoreSaveStringTaskTuple
String ID: Oi:GetCategoryDesc$The Python object is invalid
API String ID: 2389965454-2511023430
Opcode ID: f1723b7e4a5ec9944ab32fc7b86149826884fe2473ac46586f064ff5a3ef2693
Instruction ID: 772327fc19c84b535c18cace597e3d874d05cff984029dafc15a58d7bdb66ba7
Opcode Fuzzy Hash: f1723b7e4a5ec9944ab32fc7b86149826884fe2473ac46586f064ff5a3ef2693
Instruction Fuzzy Hash: 17316335F28A4282FA20DB65F81626963B1FF88BD0F440132DE5D47764DF3CE0558B01

Function 00007FF8E6A6D590 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6D5B7
??0PyWinBufferView@@QEAA@PEAU_object@@_N1@Z.PYWINTYPES313 ref: 00007FF8E6A6D5E8
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6D60A
??1PyWinBufferView@@QEAA@XZ.PYWINTYPES313 ref: 00007FF8E6A6D617

Strings

The Python object is invalid, xrefs: 00007FF8E6A6D5FC
O:Write, xrefs: 00007FF8E6A6D5AD

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: BufferView@@$Arg_Err_ParseStringTupleU_object@@_
String ID: O:Write$The Python object is invalid
API String ID: 3115018833-1308731851
Opcode ID: 36eb1ce19007f081643fde96cceabc39554f65799b544aa68779cb1b077ba7db
Instruction ID: 2c8e86f20aadc45898ec9db209867dd413d380a0dca3fee9cbab33fa2e542396
Opcode Fuzzy Hash: 36eb1ce19007f081643fde96cceabc39554f65799b544aa68779cb1b077ba7db
Instruction Fuzzy Hash: 1F318026F28A8282EB209FA5E5467AD7360FB48BD0F144536DE6D43B54DF3CE845C741

Function 00007FF8E6A60760 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6077C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A607A1

Strings

The Python object is invalid, xrefs: 00007FF8E6A60775
:GetCurFile, xrefs: 00007FF8E6A607AF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :GetCurFile$The Python object is invalid
API String ID: 1450464846-626749715
Opcode ID: 3fde0b46b73db07d57f64e9f72c0ba823cbefefd96052af8cc0ffe1137d4559e
Instruction ID: e83870ddf67200dc2debb205d8633067e377ce553b5405e88b9f8ea78ce0b1df
Opcode Fuzzy Hash: 3fde0b46b73db07d57f64e9f72c0ba823cbefefd96052af8cc0ffe1137d4559e
Instruction Fuzzy Hash: 49213065F28A42C2EF449BA6F95626963A0FF88FE4F441036DE2E47764DE2CE4858701

Function 00007FF8E6A74788 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

VariantChangeType.OLEAUT32 ref: 00007FF8E6A7479B
wsprintfW.USER32 ref: 00007FF8E6A747B4
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A747BF
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A747DE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A747F9
PyLong_FromUnsignedLong.PYTHON313 ref: 00007FF8E6A74812
VariantClear.OLEAUT32 ref: 00007FF8E6A74B36

Strings

Error converting integer variant (%08lx), xrefs: 00007FF8E6A747A8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: FromVariant$ChangeClearDeallocErr_LongLong_ObjectObject_TypeU_object@@Unsignedwsprintf
String ID: Error converting integer variant (%08lx)
API String ID: 4276419876-2415472848
Opcode ID: e8ec41523bde636587c9265a88dd70d5d4b60bd7799250d058a81c2bcae22ddf
Instruction ID: 9c8fad0eb69962ce1fb7a1893b1f9b90ce5f3c7c535d803a5929d064603b457d
Opcode Fuzzy Hash: e8ec41523bde636587c9265a88dd70d5d4b60bd7799250d058a81c2bcae22ddf
Instruction Fuzzy Hash: DE116032F2C54681EA209BA2E45637D2364FF94BE5F400135CD5E47AA5DE3CF544C702

Function 00007FF8E6A2D850 Relevance: 15.2, APIs: 10, Instructions: 166COMMON

Download Yara Rule

APIs

SafeArrayGetRecordInfo.OLEAUT32 ref: 00007FF8E6A2D87D
SafeArrayAccessData.OLEAUT32 ref: 00007FF8E6A2D893
SafeArrayGetUBound.OLEAUT32 ref: 00007FF8E6A2D8AF
SafeArrayGetLBound.OLEAUT32 ref: 00007FF8E6A2D8CB

Part of subcall function 00007FF8E6A79E90: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A22343), ref: 00007FF8E6A79EAA

Part of subcall function 00007FF8E6A2D6D0: PyMem_Malloc.PYTHON313(?,?,?,00007FF8E6A2D924,?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2D6DC
Part of subcall function 00007FF8E6A2D6D0: PyErr_NoMemory.PYTHON313(?,?,?,00007FF8E6A2D924,?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2D6EA

PyErr_Occurred.PYTHON313(?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2D927
PyTuple_New.PYTHON313(?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2D942

Part of subcall function 00007FF8E6A79E90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8E6A79EC0

_Py_NewReference.PYTHON313(?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2D9C6
PyMem_Free.PYTHON313(?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2DA60
_Py_Dealloc.PYTHON313(?,?,?,?,?,00000000,?,?,?,00007FF8E6A75AD9), ref: 00007FF8E6A2DA87
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF8E6A2DAA8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: ArraySafe$BoundDataErr_Mem_$AccessConcurrency::cancel_current_taskDeallocFreeInfoMallocMemoryOccurredRecordReferenceTuple_Unaccessmalloc
String ID:
API String ID: 3374195655-0
Opcode ID: 339e496a91d21ba1a5867bbc73f296e026e09167465dd4ad7b87898307b7828b
Instruction ID: 84d4ba0498a42a7d5839b67cf9c22a363a160c247b00e8d2b160bb79a7bded4c
Opcode Fuzzy Hash: 339e496a91d21ba1a5867bbc73f296e026e09167465dd4ad7b87898307b7828b
Instruction Fuzzy Hash: 65615732B2CA4286EB249FA2E445B6A77A0FB84BD4F448035DE8E47B59DF3CE545C701

Function 00007FF8E6A79640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF8E6A79645

Strings

unknown variant type, xrefs: 00007FF8E6A79773

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: InitVariant
String ID: unknown variant type
API String ID: 1927566239-2165200444
Opcode ID: 954d14f0133bfb4bea6269916dd5180d64b8d3310eb401cfef66ba1d15822076
Instruction ID: b294a2f2c3d1da219c5912a940ce60b76711745c8628aa3063d9b2f2fe123fd6
Opcode Fuzzy Hash: 954d14f0133bfb4bea6269916dd5180d64b8d3310eb401cfef66ba1d15822076
Instruction Fuzzy Hash: 1F418E26F2859285EA309B95E4523792361FF98BE9F440432DE9E877A4DF2CF544D302

Function 00007FF8E6A58650 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A58674
PyErr_SetString.PYTHON313 ref: 00007FF8E6A58691
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A586E2
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A58706
PyTuple_New.PYTHON313 ref: 00007FF8E6A58744
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A587A1

Strings

The Python object is invalid, xrefs: 00007FF8E6A58683
|l:Next, xrefs: 00007FF8E6A5866D

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_DeallocErr_ParseRestoreSaveStringTupleTuple_
String ID: The Python object is invalid$|l:Next
API String ID: 87469785-1850198577
Opcode ID: af9c210fefccbc457e52e0612269b292e2dcf906247e6ce514851a0417ee648d
Instruction ID: 969e57424d6eaf3c8770e2d78b36c29ac310cf58a46a2acebdf8a513e37838b8
Opcode Fuzzy Hash: af9c210fefccbc457e52e0612269b292e2dcf906247e6ce514851a0417ee648d
Instruction Fuzzy Hash: 90416A62F28A8282EA14DF91E8423B963A2FF88BF1F480135DE5D07794DF7CE4458702

Function 00007FF8E6A72810 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON313 ref: 00007FF8E6A72823

Strings

data, xrefs: 00007FF8E6A72880
Unknown tymed, xrefs: 00007FF8E6A72ABB, 00007FF8E6A72B48
tymed, xrefs: 00007FF8E6A72841
data_handle, xrefs: 00007FF8E6A72AC4

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Unicode_
String ID: Unknown tymed$data$data_handle$tymed
API String ID: 2646675794-2304833533
Opcode ID: 11ad6c7cb31652ddeb789c45399bfe55ab918504fd7d1c45576853bc287b6464
Instruction ID: 80f29768ac1ba2be0fd330cfbe92422770478a305e257c327a0e25008a212623
Opcode Fuzzy Hash: 11ad6c7cb31652ddeb789c45399bfe55ab918504fd7d1c45576853bc287b6464
Instruction Fuzzy Hash: 97419F62F2CA8282EB448B95F49127937A2FB89BD4F484031DE5E47745DE6CE891C701

Function 00007FF8E6A52820 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A52841
PyArg_Parse.PYTHON313 ref: 00007FF8E6A52885
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A528A3
PyErr_Occurred.PYTHON313 ref: 00007FF8E6A52908
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A52946
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5294E

Strings

EnumDAdvise, xrefs: 00007FF8E6A52854, 00007FF8E6A528B5, 00007FF8E6A52917
Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A528BE, 00007FF8E6A52920

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_OccurredState_$Arg_DeallocEnsureParseRelease
String ID: EnumDAdvise$Unexpected exception in gateway method '%hs'
API String ID: 3280672200-1741563918
Opcode ID: b0b9420e2c1c42b5c853e54ae7f7edf2ce5477a4959a5fbd5bca25e586ad2333
Instruction ID: c642a60c086137d0cf6361c67a1c896a428e467744926d7a6e461b5ea7ce5b92
Opcode Fuzzy Hash: b0b9420e2c1c42b5c853e54ae7f7edf2ce5477a4959a5fbd5bca25e586ad2333
Instruction Fuzzy Hash: 60317232F2874781EA509BE5E8563B923A2FF88BD8F404135DE5E477A5EE2CE5048742

Function 00007FF8E6A658B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A658CC
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A658FB
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6592C
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A65951
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A6597E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A65996

Strings

O:ReadMultiple, xrefs: 00007FF8E6A658F4
The Python object is invalid, xrefs: 00007FF8E6A658BE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FreeObject_ParseRestoreSaveStringTuplefree
String ID: O:ReadMultiple$The Python object is invalid
API String ID: 2004998745-3093747771
Opcode ID: f71ad35e3ce4d7907b8597667d0c4d55bd6b92175340d3c0e9871b5319c1374e
Instruction ID: d0b06010f587e62b5c9bd2e829d397be33d8cde756121f13acd94479351bc84e
Opcode Fuzzy Hash: f71ad35e3ce4d7907b8597667d0c4d55bd6b92175340d3c0e9871b5319c1374e
Instruction Fuzzy Hash: 78312C76F2874286EA54AF96E44137973A0FF84BE4F484435DEAE07765CE3CE4418B02

Function 00007FF8E6A6E810 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6E865
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6E87A
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6E8A9
PyTuple_New.PYTHON313 ref: 00007FF8E6A6E8CA
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A6E8E7
PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A6E8F5
SysFreeString.OLEAUT32 ref: 00007FF8E6A6E900

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is invalid, xrefs: 00007FF8E6A6E845

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_FromObject_StringTuple_U_object@@$BuildErrorFreeInfoItemObjectValue
String ID: The Python object is invalid
API String ID: 2478855177-2445808733
Opcode ID: 9468105d073f7a8d1d6bd513ce7ab2d9b34134a2b64c8b1310e35284343ab8de
Instruction ID: dd2aef1f36203ab7967c4622ec76a711dac536221eb64bb4bee85301be1f5350
Opcode Fuzzy Hash: 9468105d073f7a8d1d6bd513ce7ab2d9b34134a2b64c8b1310e35284343ab8de
Instruction Fuzzy Hash: CB314021F3CA4682EA60AB91E80676973A1FF84BD4F444036DEAE47754DF3CE405C741

Function 00007FF8E6A60550 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A60587
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A605BA
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A605D5
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A605DF
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A60601

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

PyMem_Free.PYTHON313 ref: 00007FF8E6A60642

Strings

Oi:Save, xrefs: 00007FF8E6A605B0
The Python object is invalid, xrefs: 00007FF8E6A60567

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_Object_U_object@@$Arg_BuildErrorFreeFromInfoMem_ObjectParseStringTupleValue
String ID: Oi:Save$The Python object is invalid
API String ID: 3446329984-1512210177
Opcode ID: b4b5447d08a2d36c600da2f09e1b9930c939a7ca0dda222437cd99e1cf8dc96a
Instruction ID: 1d140aa7bbacc26af887d19d3ca6f0aec6f6f4dc81c513ee12a6bb436b503b78
Opcode Fuzzy Hash: b4b5447d08a2d36c600da2f09e1b9930c939a7ca0dda222437cd99e1cf8dc96a
Instruction Fuzzy Hash: 78313836F29B82C6EB508F96E50226A63A0FB88BD4F484432DE6D47764DF6CE444C742

Function 00007FF8E6A6D880 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6D8A4
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A6D8B8
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6D8E8
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6D912
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6D93F
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A6D96F

Strings

The Python object is invalid, xrefs: 00007FF8E6A6D8DA
OO:CopyTo, xrefs: 00007FF8E6A6D89D

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Object_R@@@ThreadU_object@@$Arg_Err_FromParseRestoreSaveStringTuple
String ID: OO:CopyTo$The Python object is invalid
API String ID: 3769410717-3963427383
Opcode ID: 0ff8399650e44c255e73c1cff1ee35e442128f36fe39c8dd57b82dceeee54500
Instruction ID: 5cd3870a98a79ce88c0661a556e4c4b46e317c73752c0d9ba46b8440be7d7ce4
Opcode Fuzzy Hash: 0ff8399650e44c255e73c1cff1ee35e442128f36fe39c8dd57b82dceeee54500
Instruction Fuzzy Hash: 29215E22F28B8281EB419B92F50526AB3A1FF84BE0F445036DE6D57B68DF2CE845C701

Function 00007FF8E6A60660 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A60697
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A606C5
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A606DF
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A606E9
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A60706

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

PyMem_Free.PYTHON313 ref: 00007FF8E6A60747

Strings

The Python object is invalid, xrefs: 00007FF8E6A60677
O:SaveCompleted, xrefs: 00007FF8E6A606BB

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_Object_U_object@@$Arg_BuildErrorFreeFromInfoMem_ObjectParseStringTupleValue
String ID: O:SaveCompleted$The Python object is invalid
API String ID: 3446329984-4192751109
Opcode ID: 98575547906d66807b0c14adda73669fcdcb26916cbf72d24724770df1df1fa0
Instruction ID: 20f2825f28d5327616a184f6c8a0387193152cc1510b399c04e9e30575f5d51d
Opcode Fuzzy Hash: 98575547906d66807b0c14adda73669fcdcb26916cbf72d24724770df1df1fa0
Instruction Fuzzy Hash: 3B314766F28A42C2EB149F96F54236A73A1FF88BD4B484432DE6D47754DF2CE8448B02

Function 00007FF8E6A4E670 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4E68C
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4E6C0
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4E6DA
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4E6EE
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4E712
SysFreeString.OLEAUT32 ref: 00007FF8E6A4E71D

Strings

iO:SetVarName, xrefs: 00007FF8E6A4E6B9
The Python object is invalid, xrefs: 00007FF8E6A4E67E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: The Python object is invalid$iO:SetVarName
API String ID: 3407569068-494815592
Opcode ID: 158b41316d8d5f2266983014866cf1ee063b3e40f456ea55c48cd851a8f91a69
Instruction ID: 1e8e1e94f69645a2cf48298b38721f3d12ac4af94fcae8b6d4320b233f32ab10
Opcode Fuzzy Hash: 158b41316d8d5f2266983014866cf1ee063b3e40f456ea55c48cd851a8f91a69
Instruction Fuzzy Hash: BA217C36F28A4282EB109B95F812769A3A0FF88BE4F480032DE6D47768DF2CE545C701

Function 00007FF8E6A48610 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4862C
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A48664
?PyWinObject_AsWCHAR@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4867E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A48692
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A486AF
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A486BA

Strings

The Python object is invalid, xrefs: 00007FF8E6A4861E
O:RevokeObjectParam, xrefs: 00007FF8E6A4865A

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Object_Thread$Arg_Err_FreeParseRestoreSaveStringTupleU_object@@
String ID: O:RevokeObjectParam$The Python object is invalid
API String ID: 2199859164-1636578323
Opcode ID: ba5d22349b3fef8fb20a69f80a3417304e5b253d9c8dd70c8bcf82347cc07434
Instruction ID: 8f316e4c69df55dfcef2b683400de3ee5837c1a9d3359ca23593f251e803b370
Opcode Fuzzy Hash: ba5d22349b3fef8fb20a69f80a3417304e5b253d9c8dd70c8bcf82347cc07434
Instruction Fuzzy Hash: EC214B26F38A4282EA949B95F856769A3A0FF89BE4F441031DE5E07768DF3CE4458702

Function 00007FF8E6A4D7C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D7DC
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4D80B
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4D825
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4D839
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4D856
SysFreeString.OLEAUT32 ref: 00007FF8E6A4D861

Strings

O:SetDocString, xrefs: 00007FF8E6A4D804
The Python object is invalid, xrefs: 00007FF8E6A4D7CE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: O:SetDocString$The Python object is invalid
API String ID: 3407569068-3620035398
Opcode ID: f4e8a681eb46630bf67b9902cd3cd5bbd856915be35d969c8fcc215b125f7840
Instruction ID: fd727490d37b4b29ed653fc324077e8a09e5ed75fc7902b30ef5ac4c141de747
Opcode Fuzzy Hash: f4e8a681eb46630bf67b9902cd3cd5bbd856915be35d969c8fcc215b125f7840
Instruction Fuzzy Hash: 71217F36F2CA4282EB549B95F95627923A0FF88BE4B441032DE5E07764DE2CE4418701

Function 00007FF8E6A4F710 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F72C
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4F75B
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4F775
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4F789
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4F7A6
SysFreeString.OLEAUT32 ref: 00007FF8E6A4F7B1

Strings

O:SetDocString, xrefs: 00007FF8E6A4F754
The Python object is invalid, xrefs: 00007FF8E6A4F71E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: O:SetDocString$The Python object is invalid
API String ID: 3407569068-3620035398
Opcode ID: 05c6d6fe96f12fb365db76315f48a42d90a0bd2d2733ae1f14ede7d4a008fe5b
Instruction ID: 999aac0979de4e690dbf030083e82df74168b0ca67fc8ff23823bef3ff2a5ae3
Opcode Fuzzy Hash: 05c6d6fe96f12fb365db76315f48a42d90a0bd2d2733ae1f14ede7d4a008fe5b
Instruction Fuzzy Hash: 06218136F2CA4282EB549B95F84637923B0FF84BE0B442032DE5E47764DE2CE441C702

Function 00007FF8E6A4F800 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F81C
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4F84B
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A4F865
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4F879
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4F896
SysFreeString.OLEAUT32 ref: 00007FF8E6A4F8A1

Strings

The Python object is invalid, xrefs: 00007FF8E6A4F80E
O:SetHelpFileName, xrefs: 00007FF8E6A4F844

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: O:SetHelpFileName$The Python object is invalid
API String ID: 3407569068-392364392
Opcode ID: 9d2354d2e47ec730c44e4156f48a92637f26188b3515f9e82e74cae332892323
Instruction ID: 4c2b4b60a2ff09a3edc0cef3ebf1b0df953e64556ada2de2feb6accdacf2dc20
Opcode Fuzzy Hash: 9d2354d2e47ec730c44e4156f48a92637f26188b3515f9e82e74cae332892323
Instruction Fuzzy Hash: CF217F32F28A4282FB149B96F84637923A0FF85BD0B442032DE5D4B764DF2CE4458742

Function 00007FF8E6A503B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A503CC
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A503FB
?PyWinObject_AsBstr@@YAHPEAU_object@@PEAPEA_WHPEAK@Z.PYWINTYPES313 ref: 00007FF8E6A50415
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A50429
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A50446
SysFreeString.OLEAUT32 ref: 00007FF8E6A50451

Strings

O:SetDocString, xrefs: 00007FF8E6A503F4
The Python object is invalid, xrefs: 00007FF8E6A503BE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_StringThread$Arg_Bstr@@Err_FreeObject_ParseRestoreSaveTupleU_object@@
String ID: O:SetDocString$The Python object is invalid
API String ID: 3407569068-3620035398
Opcode ID: 7cc5279bd25799f83637d0184f84c582417a672e938d1085f93b64ebe0e2f49f
Instruction ID: 191577646571a50011ab7648d08ad4dcb093fb15eab0c774f9c51ac49d7cad4f
Opcode Fuzzy Hash: 7cc5279bd25799f83637d0184f84c582417a672e938d1085f93b64ebe0e2f49f
Instruction Fuzzy Hash: 26217F36F28A4282EB54DB95F45667963B1FF88BE0B441032DE5E47764CE2CE4818702

Function 00007FF8E6A535A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A535BC
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A535FA
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5361A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5362E
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A53654
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A53683

Strings

The Python object is invalid, xrefs: 00007FF8E6A535AE
lOl:DragOver, xrefs: 00007FF8E6A535F3

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Arg_Eval_ParseThreadTuple$Err_FromLongLong_RestoreSaveString
String ID: The Python object is invalid$lOl:DragOver
API String ID: 3706361514-456393553
Opcode ID: 33eac103401777627540d4d3b386035bd103faeebad1c1daac80e8905e420394
Instruction ID: fa9226635952b614ad1763abe39719c426c6a7d6766c6e52bcfd3ea622c4be5e
Opcode Fuzzy Hash: 33eac103401777627540d4d3b386035bd103faeebad1c1daac80e8905e420394
Instruction Fuzzy Hash: AC212A32F28A4682EA00CFA5F4056AA73A2FB84BD4F940136EE5D47768DF3CE545CB41

Function 00007FF8E6A5D790 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5D7B2
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D7C0
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D7CE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D81C
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D835
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5D83E

Strings

LockRegion, xrefs: 00007FF8E6A5D7EC
OOi, xrefs: 00007FF8E6A5D7E0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: LockRegion$OOi
API String ID: 3423895773-417432063
Opcode ID: bbe29c2bdc6705c9fb7f3feaaab121ddcd8d7d93575cb717af02794aacad6f7a
Instruction ID: 3b7082e938413a57f6a403fb508cd5c3dd84274aa9976101f73882b36dd65397
Opcode Fuzzy Hash: bbe29c2bdc6705c9fb7f3feaaab121ddcd8d7d93575cb717af02794aacad6f7a
Instruction Fuzzy Hash: 7C216832F28B9286E7109FA0F8092A973A0FB94BE5F085031EE8946B54DF3CE145C702

Function 00007FF8E6A478E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A47902
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A47910
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A4791E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4796C
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A47985
PyGILState_Release.PYTHON313 ref: 00007FF8E6A4798E

Strings

UnlockRegion, xrefs: 00007FF8E6A4793C
OOi, xrefs: 00007FF8E6A47930

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: OOi$UnlockRegion
API String ID: 3423895773-62055282
Opcode ID: 4215f9fd1ef614c999e31b95be39ce9004df87e44a54963358e441a45e3f8d0b
Instruction ID: f488dc902f701386c93aefd5084cd53922e8fc13b3e0cdf1fe422486ccc7ea1f
Opcode Fuzzy Hash: 4215f9fd1ef614c999e31b95be39ce9004df87e44a54963358e441a45e3f8d0b
Instruction Fuzzy Hash: 44215B36F28B92C6EB509FA1F849369B7A0FB84BE4F084131EE8946B55DF3CE5458701

Function 00007FF8E6A47810 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A47832
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A47840
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A4784E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4789C
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A478B5
PyGILState_Release.PYTHON313 ref: 00007FF8E6A478BE

Strings

LockRegion, xrefs: 00007FF8E6A4786C
OOi, xrefs: 00007FF8E6A47860

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: LockRegion$OOi
API String ID: 3423895773-417432063
Opcode ID: 70031674a007ab282460e59e6465cef140334930b6cb94a63e25db6e35f1d2fa
Instruction ID: e51e6f227d04554edbab3b05daacf23e74987f7648769407fdb2f4a030f910cd
Opcode Fuzzy Hash: 70031674a007ab282460e59e6465cef140334930b6cb94a63e25db6e35f1d2fa
Instruction Fuzzy Hash: D7216D36F28B9286E7609FA1F84936977A0FB84BE5F044031EE8946B54DF3CE585C701

Function 00007FF8E6A5D860 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5D882
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D890
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D89E
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D8EC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D905
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5D90E

Strings

UnlockRegion, xrefs: 00007FF8E6A5D8BC
OOi, xrefs: 00007FF8E6A5D8B0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocFromObject_R@@@State_U_object@@$EnsureRelease
String ID: OOi$UnlockRegion
API String ID: 3423895773-62055282
Opcode ID: 6c5f0d7ec2974498c2233339cf58cf3b1f740b934650b0d17970f7caf35b55de
Instruction ID: 8127714c8adcae67327d7cfb567d61539c78da3f3913a9a6b9b52a906b1ad36b
Opcode Fuzzy Hash: 6c5f0d7ec2974498c2233339cf58cf3b1f740b934650b0d17970f7caf35b55de
Instruction Fuzzy Hash: FE214936F28B9286EB509FA5F84936973A0FB85BE9F044031EE8946B54DF3CE545C702

Function 00007FF8E6A64580 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6451C
PyObject_IsSubclass.PYTHON313 ref: 00007FF8E6A64536
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A64594
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A645AC
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A645C3

Strings

The Python IID map is invalid - the value is not an interface type object, xrefs: 00007FF8E6A64540
There is no interface object registered that supports this IID, xrefs: 00007FF8E6A6450B

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Object_$D@@@DeallocDict_Err_FromItemStringSubclassU_object@@
String ID: The Python IID map is invalid - the value is not an interface type object$There is no interface object registered that supports this IID
API String ID: 3263611697-2203674046
Opcode ID: b9b41166950ee249ba5dce2c3b219ac6d171c6f45723f244ae64a4a82e9de223
Instruction ID: 34500d06c2ca56e5c2021878ed19d3e7f70cc7ca0019baac0f8539d92cd19b3d
Opcode Fuzzy Hash: b9b41166950ee249ba5dce2c3b219ac6d171c6f45723f244ae64a4a82e9de223
Instruction Fuzzy Hash: E8210B25F2DA4281EA519F95E85637833A0FF49FE8F088439CE2E47755DE2CF8458302

Function 00007FF8E6A29560 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A29585
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A295A6
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A295C7
PyErr_SetString.PYTHON313 ref: 00007FF8E6A295E3
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A295F7
PyGILState_Release.PYTHON313 ref: 00007FF8E6A2960D

Strings

GetNextDispID must return an integer object, xrefs: 00007FF8E6A295D9
_GetNextDispID_, xrefs: 00007FF8E6A2959D

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$CallDeallocEnsureErr_LongLong_MethodObject_ReleaseString
String ID: GetNextDispID must return an integer object$_GetNextDispID_
API String ID: 4102426547-654642487
Opcode ID: d36659792e60f9ae2733e3d6ab9c1bd69430cba582ed9275331ed5d4182509e8
Instruction ID: 7de5c4a67b3334187e61d96a3929717e7df58fb9d4390927d37799de9fae650b
Opcode Fuzzy Hash: d36659792e60f9ae2733e3d6ab9c1bd69430cba582ed9275331ed5d4182509e8
Instruction Fuzzy Hash: E6213B32F28B4282EB209F96E846669B3A0FB84BE4F444835DE5D47764DF3CE445C701

Function 00007FF8E6A293F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A29415
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A29436
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A29457
PyErr_SetString.PYTHON313 ref: 00007FF8E6A29473
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A29487
PyGILState_Release.PYTHON313 ref: 00007FF8E6A2949D

Strings

GetMemberProperties must return an integer object, xrefs: 00007FF8E6A29469
_GetMemberProperties_, xrefs: 00007FF8E6A2942D

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$CallDeallocEnsureErr_LongLong_MethodObject_ReleaseString
String ID: GetMemberProperties must return an integer object$_GetMemberProperties_
API String ID: 4102426547-219618243
Opcode ID: f06027d534d6f0cb57b5f82f7a9cb0992f38a49b955407e12888cd87a0ac7a75
Instruction ID: 881d35d2ef2534aee94186a962836da7fd3e22e724537b1541b414fb5d27279f
Opcode Fuzzy Hash: f06027d534d6f0cb57b5f82f7a9cb0992f38a49b955407e12888cd87a0ac7a75
Instruction Fuzzy Hash: B7211832F29B4282EB109F96E846669B7A0FB84BD4F444835DE6D47764DE3CE445C702

Function 00007FF8E6A74888 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

VariantChangeType.OLEAUT32 ref: 00007FF8E6A7489B
wsprintfW.USER32 ref: 00007FF8E6A748B4
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A748BF
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A748DE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A748F9
PyFloat_FromDouble.PYTHON313 ref: 00007FF8E6A7490A
VariantClear.OLEAUT32 ref: 00007FF8E6A74B36

Strings

Error converting floating point variant (%08lx), xrefs: 00007FF8E6A748A8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: FromVariant$ChangeClearDeallocDoubleErr_Float_ObjectObject_TypeU_object@@wsprintf
String ID: Error converting floating point variant (%08lx)
API String ID: 3578438641-723133735
Opcode ID: 7b9100170c47cf82d6be861ec80c7564b581fae52cf5e70215ff36a4249ed944
Instruction ID: c495489816a09913d2bed4d5e954e040e8a093d5ef3bd00bc370d0b017d5346b
Opcode Fuzzy Hash: 7b9100170c47cf82d6be861ec80c7564b581fae52cf5e70215ff36a4249ed944
Instruction Fuzzy Hash: 88116D32F2894681EB208F62E85637D6374FF98BE9F400035CE5E86AA4DE2CF545C702

Function 00007FF8E6A7481D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FF8E6A747B4
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A747BF
PyErr_SetObject.PYTHON313 ref: 00007FF8E6A747DE
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A747F9
VariantChangeType.OLEAUT32 ref: 00007FF8E6A74830
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A74842
VariantClear.OLEAUT32 ref: 00007FF8E6A74B36

Strings

Error converting integer variant (%08lx), xrefs: 00007FF8E6A747A8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: FromVariant$ChangeClearDeallocErr_LongLong_ObjectObject_TypeU_object@@wsprintf
String ID: Error converting integer variant (%08lx)
API String ID: 3799450794-2415472848
Opcode ID: a0dae94550e33db7e7fda928ba41f8cc079aa4cfaff305e3b5ba702e2fdfe927
Instruction ID: f7ab5ccbac3951d7fbb950b022c38fb0f3853479dd960f6a0252839fcc94ed64
Opcode Fuzzy Hash: a0dae94550e33db7e7fda928ba41f8cc079aa4cfaff305e3b5ba702e2fdfe927
Instruction Fuzzy Hash: 69112B32F2894282EA209B52E85637D6364FB98BE9F440035CE5E46A65DE2CF945C702

Function 00007FF8E6A2A660 Relevance: 13.6, APIs: 9, Instructions: 148threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2A6ED
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2A734
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2A74B
GetErrorInfo.OLEAUT32 ref: 00007FF8E6A2A75B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2A766
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2A785
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2A80E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2A81B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2A832

Part of subcall function 00007FF8E6A24E50: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24E90
Part of subcall function 00007FF8E6A24E50: PyLong_FromLong.PYTHON313 ref: 00007FF8E6A24EA0
Part of subcall function 00007FF8E6A24E50: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24ED4
Part of subcall function 00007FF8E6A24E50: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24F93
Part of subcall function 00007FF8E6A24E50: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24FA6
Part of subcall function 00007FF8E6A24E50: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24FC7
Part of subcall function 00007FF8E6A24E50: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24FE8

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$Dealloc$From$BuildErr_ErrorInfoLongLong_ObjectObject_U_object@@Value
String ID:
API String ID: 2233689574-0
Opcode ID: 19330f1c4c0f377c8ec78581e9806de8e51fd16459866a7809de62784f3eb904
Instruction ID: ab8d3addc4a000e35ce7e88135aa0ddc2c31614ef4f887a98d07682e40966e58
Opcode Fuzzy Hash: 19330f1c4c0f377c8ec78581e9806de8e51fd16459866a7809de62784f3eb904
Instruction Fuzzy Hash: 8D514072B18B8282EB509F6AE44166A73A1FB88FD4F144136DF9E87B64DF3CD4468701

Function 00007FF8E6A4D5D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D5FB
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4D637
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4D64B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4D65F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4D67C

Strings

The Python object is invalid, xrefs: 00007FF8E6A4D5ED
O:SetGuid, xrefs: 00007FF8E6A4D630

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_D@@@Err_Object_ParseRestoreSaveStringTupleU_object@@
String ID: O:SetGuid$The Python object is invalid
API String ID: 3738645356-2833450749
Opcode ID: b6fa220a1950272048c291a966120eb3afbe80eb2d201fcc7ddfdc5e1602f127
Instruction ID: 8c09335b7410ec7546dac0295d0038dc36b45398ec98ed46f75d43f25bb737ed
Opcode Fuzzy Hash: b6fa220a1950272048c291a966120eb3afbe80eb2d201fcc7ddfdc5e1602f127
Instruction Fuzzy Hash: 14214672F28B4282EA54ABA6E85627973A1FF88BE4B440036DD5E47764DE2CF441C702

Function 00007FF8E6A4F520 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F53C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F561

Strings

ii:SetVersion, xrefs: 00007FF8E6A4F57C
The Python object is invalid, xrefs: 00007FF8E6A4F535

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$ii:SetVersion
API String ID: 1450464846-3629498280
Opcode ID: 7d334677177397d323d40c5e1499adba236ec6a1b3c20ec6d767be98c0ed856e
Instruction ID: ecf548b5406e016c75be4ffd65e1b137fc9cf093f36ccd12e88f7352336e6c8c
Opcode Fuzzy Hash: 7d334677177397d323d40c5e1499adba236ec6a1b3c20ec6d767be98c0ed856e
Instruction Fuzzy Hash: 0D214F22F28A4282EB549FA5F94627963A1FF88BD4F446031DE6D47768DE2CE481C702

Function 00007FF8E6A63500 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6352B
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A63567
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A6357B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6358F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A635AC

Strings

The Python object is invalid, xrefs: 00007FF8E6A6351D
O:Delete, xrefs: 00007FF8E6A63560

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_D@@@Err_Object_ParseRestoreSaveStringTupleU_object@@
String ID: O:Delete$The Python object is invalid
API String ID: 3738645356-1497512779
Opcode ID: fd30bf040fc435d3d0d40dd2717f1ea97d778adca5472e96e8b4abc1c208c7f6
Instruction ID: a0367d1cd75c485142545b4887c1c9cd6cd13ca9422dc8ec5d7b2bc8897f7640
Opcode Fuzzy Hash: fd30bf040fc435d3d0d40dd2717f1ea97d778adca5472e96e8b4abc1c208c7f6
Instruction Fuzzy Hash: EA217A72F2CB4281EA149BA6E45627973A1FF88BE0F441036DD6E07764DE2CF442C742

Function 00007FF8E6A4F610 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F63B
PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A4F677
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A4F68B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A4F69F
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A4F6BC

Strings

The Python object is invalid, xrefs: 00007FF8E6A4F62D
O:SetGuid, xrefs: 00007FF8E6A4F670

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_D@@@Err_Object_ParseRestoreSaveStringTupleU_object@@
String ID: O:SetGuid$The Python object is invalid
API String ID: 3738645356-2833450749
Opcode ID: a6b9b5d35eac2bd86d8485e0cc1912328a8e75a8850c7373526fff69e337c6d0
Instruction ID: 4aef702419b06851847c64435ba057cc770f2282da2f0f0eae9f3f627a8e7955
Opcode Fuzzy Hash: a6b9b5d35eac2bd86d8485e0cc1912328a8e75a8850c7373526fff69e337c6d0
Instruction Fuzzy Hash: B1216D71F28B8282EA549BA5E85637963A1FF88BD0F442036DD5E47764DE2CF445C702

Function 00007FF8E6A50770 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5078C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A507B1

Strings

The Python object is invalid, xrefs: 00007FF8E6A50785
i:SetLibFlags, xrefs: 00007FF8E6A507C7

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$i:SetLibFlags
API String ID: 1450464846-2322495625
Opcode ID: 45991c6c40985b6a0404241b37efdb0f75b118bf8ce0d5d9f225dd254e431b2e
Instruction ID: 9d85444af361f72ba83630a0ddd6900a8c85647ccd033c6b4aaab9bb2a6a8836
Opcode Fuzzy Hash: 45991c6c40985b6a0404241b37efdb0f75b118bf8ce0d5d9f225dd254e431b2e
Instruction Fuzzy Hash: B1218375F28A4282EB45DBA5F95627923A1FF88BE4B441032DD2D47364DE2CE8818741

Function 00007FF8E6A4D8B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D8CC
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D8F1

Strings

The Python object is invalid, xrefs: 00007FF8E6A4D8C5
l:SetHelpContext, xrefs: 00007FF8E6A4D907

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetHelpContext
API String ID: 1450464846-1782559897
Opcode ID: 28423b000cb26061461662dd8e210f37a83c18f9f6274b717cb28eccea32ce0a
Instruction ID: 910e6c99b3acd589445a0001449b2e316b8257833cbfdbc9349a6bd6d55818f3
Opcode Fuzzy Hash: 28423b000cb26061461662dd8e210f37a83c18f9f6274b717cb28eccea32ce0a
Instruction Fuzzy Hash: 43218076F28A4282EB449BA5F95627923A0FF88BD4B441036DE2D47764DE2CE8828701

Function 00007FF8E6A4F8F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F90C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4F931

Strings

The Python object is invalid, xrefs: 00007FF8E6A4F905
l:SetHelpContext, xrefs: 00007FF8E6A4F947

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetHelpContext
API String ID: 1450464846-1782559897
Opcode ID: e58a9f49356529bd25aea2e62e18731c3c438f87ff39f524d39a6973dbaabf0d
Instruction ID: 8d3ffb9eaa650a85a4e0eecf2ca54055644b8779540d8597db04fd0f996d776e
Opcode Fuzzy Hash: e58a9f49356529bd25aea2e62e18731c3c438f87ff39f524d39a6973dbaabf0d
Instruction Fuzzy Hash: 7F218636F2C64282EB449FA5F95627923A0FF88BD4B442031DD2D47364DE3CE8828701

Function 00007FF8E6A50590 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A505AC
PyErr_SetString.PYTHON313 ref: 00007FF8E6A505D1

Strings

The Python object is invalid, xrefs: 00007FF8E6A505A5
l:SetHelpContext, xrefs: 00007FF8E6A505E7

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetHelpContext
API String ID: 1450464846-1782559897
Opcode ID: 536c38e5f203d6e39194321f0267b0a76573c6961297350ebe56b0df438c4ccf
Instruction ID: 74fab7ef5bd629ec07218b82979355435af561fe79239ce8ff3f235123b7c5a8
Opcode Fuzzy Hash: 536c38e5f203d6e39194321f0267b0a76573c6961297350ebe56b0df438c4ccf
Instruction Fuzzy Hash: E8218336F28A4282EB44DBA5F95627923A1FF88BD4F445032DE2D47764DE2CE8828701

Function 00007FF8E6A6B510 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B52C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B551

Strings

The Python object is invalid, xrefs: 00007FF8E6A6B525
i:Commit, xrefs: 00007FF8E6A6B567

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$i:Commit
API String ID: 1450464846-1346208079
Opcode ID: a8808369c3b4c2210c04bfbf7432b99b1b2dd6dab88577aff2263820e8d254b0
Instruction ID: 3c0fde6b69eb2bdd044ddcb5e549054918a98397d653d9e335c80d3778a09a69
Opcode Fuzzy Hash: a8808369c3b4c2210c04bfbf7432b99b1b2dd6dab88577aff2263820e8d254b0
Instruction Fuzzy Hash: 98218632F28A4282EB459B95F55627D23A0FF48BD4B440031DD2E47764DE3CE8928701

Function 00007FF8E6A50680 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5069C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A506C1

Strings

The Python object is invalid, xrefs: 00007FF8E6A50695
l:SetLcid, xrefs: 00007FF8E6A506D7

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:SetLcid
API String ID: 1450464846-1975059913
Opcode ID: b284d8208a24609e9d0be037efa9836f53137690e801d23846608bb4204a3768
Instruction ID: b19d8c060f1e3409a1307689183a8858dbe20049a63c90ad4bf02311be78bef9
Opcode Fuzzy Hash: b284d8208a24609e9d0be037efa9836f53137690e801d23846608bb4204a3768
Instruction Fuzzy Hash: 52219236F28A4282EB44DBA5F95627923A1FF88BD4F441432DE2D47764DF2CE8828701

Function 00007FF8E6A5C680 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5C69C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5C6C1

Strings

l:RevokeInterfaceFromGlobal, xrefs: 00007FF8E6A5C6D7
The Python object is invalid, xrefs: 00007FF8E6A5C695

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$l:RevokeInterfaceFromGlobal
API String ID: 1450464846-152675950
Opcode ID: 898abf044a5b6ed272342da80665054a0561efb7f79302098e98480bb369d589
Instruction ID: 98acef4a54ebb6a0a40b687b5ef8eeb694223ac01a5de219bd93e337085613bd
Opcode Fuzzy Hash: 898abf044a5b6ed272342da80665054a0561efb7f79302098e98480bb369d589
Instruction Fuzzy Hash: 73218636F2C64282EB45DB95F95627923A1FF88BD4B441035DD2E477A8DF2CE5818701

Function 00007FF8E6A4D6D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D6EC
PyErr_SetString.PYTHON313 ref: 00007FF8E6A4D711

Strings

i:SetTypeFlags, xrefs: 00007FF8E6A4D727
The Python object is invalid, xrefs: 00007FF8E6A4D6E5

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: The Python object is invalid$i:SetTypeFlags
API String ID: 1450464846-3322082645
Opcode ID: a3bdcb6ff7b7eb9a7b7724a4ae5fd7464fda6b996735d04114cd3a788dbe25c4
Instruction ID: 80aaa2b81fa91f63405e1d457464e2087523632f89b52a742f19c5a3b86639ce
Opcode Fuzzy Hash: a3bdcb6ff7b7eb9a7b7724a4ae5fd7464fda6b996735d04114cd3a788dbe25c4
Instruction Fuzzy Hash: 30219536F2CA4282EB459BE5F95627923F0FF88BD4B441036DE2D47764DE2CE8828701

Function 00007FF8E6A2C8D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A2C8EF
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2C90C
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A2C936
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A2C952
PyErr_SetString.PYTHON313 ref: 00007FF8E6A2C978

Strings

The Python object is invalid, xrefs: 00007FF8E6A2C8FE
ll:DeleteMemberByDispID, xrefs: 00007FF8E6A2C8E5

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_Eval_StringThread$Arg_ParseRestoreSaveTuple
String ID: The Python object is invalid$ll:DeleteMemberByDispID
API String ID: 4015722556-3292498650
Opcode ID: a5df8b55589deb061659957de24a4f7d6eeae91b49485271400a67feb40f54c2
Instruction ID: 797cc12575dfb428311979abe1a0d675685859a599e4bcd6a69a81efcd422875
Opcode Fuzzy Hash: a5df8b55589deb061659957de24a4f7d6eeae91b49485271400a67feb40f54c2
Instruction Fuzzy Hash: E2218035F28A4282EA55DBA6F44626923A0FF48BD4B085032DE6E07754CF3CE8518701

Function 00007FF8E6A50860 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A5087C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A508A1

Strings

The Python object is invalid, xrefs: 00007FF8E6A50875
:SaveAllChanges, xrefs: 00007FF8E6A508AF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :SaveAllChanges$The Python object is invalid
API String ID: 1450464846-2045194468
Opcode ID: 524a86bb67535f57cd7e37368eb3b70accfadd7efb0783afbcd54e972b16c612
Instruction ID: 90b597d9c1c845dc8e14bd2ca8605580ca3c1a5c6ca8c800e456192ffe515188
Opcode Fuzzy Hash: 524a86bb67535f57cd7e37368eb3b70accfadd7efb0783afbcd54e972b16c612
Instruction Fuzzy Hash: 23215136F28A42C2EF55DBE6F95627923A1FF48BE4B441035DD2E473A4DE2CE4818742

Function 00007FF8E6A27570 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E6A24BF0: PyErr_Fetch.PYTHON313 ref: 00007FF8E6A24C21
Part of subcall function 00007FF8E6A24BF0: PyErr_NormalizeException.PYTHON313 ref: 00007FF8E6A24C40
Part of subcall function 00007FF8E6A24BF0: PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FF8E6A24C55
Part of subcall function 00007FF8E6A24BF0: PyErr_Restore.PYTHON313 ref: 00007FF8E6A24C7A

Part of subcall function 00007FF8E6A237E0: PyErr_Fetch.PYTHON313 ref: 00007FF8E6A23801
Part of subcall function 00007FF8E6A237E0: PyErr_Clear.PYTHON313 ref: 00007FF8E6A23840
Part of subcall function 00007FF8E6A237E0: ?GetPythonTraceback@@YAPEA_WPEAU_object@@00@Z.PYWINTYPES313 ref: 00007FF8E6A23855
Part of subcall function 00007FF8E6A237E0: SysAllocString.OLEAUT32 ref: 00007FF8E6A238B6
Part of subcall function 00007FF8E6A237E0: SysAllocString.OLEAUT32 ref: 00007FF8E6A238CF
Part of subcall function 00007FF8E6A237E0: PyErr_GivenExceptionMatches.PYTHON313 ref: 00007FF8E6A238E8
Part of subcall function 00007FF8E6A237E0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A23924
Part of subcall function 00007FF8E6A237E0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A2393F
Part of subcall function 00007FF8E6A237E0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A2395A
Part of subcall function 00007FF8E6A237E0: PyErr_Clear.PYTHON313 ref: 00007FF8E6A23960

SysFreeString.OLEAUT32 ref: 00007FF8E6A275C6
SysFreeString.OLEAUT32 ref: 00007FF8E6A275D9
SysFreeString.OLEAUT32 ref: 00007FF8E6A275EC
SysFreeString.OLEAUT32 ref: 00007FF8E6A27612
SysFreeString.OLEAUT32 ref: 00007FF8E6A27625
SysFreeString.OLEAUT32 ref: 00007FF8E6A27638

Part of subcall function 00007FF8E6A23F20: CreateErrorInfo.OLEAUT32 ref: 00007FF8E6A23F3A
Part of subcall function 00007FF8E6A23F20: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A23FA2
Part of subcall function 00007FF8E6A23F20: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A23FC7
Part of subcall function 00007FF8E6A23F20: SetErrorInfo.OLEAUT32 ref: 00007FF8E6A23FD8

Strings

Python error invoking COM method., xrefs: 00007FF8E6A27589

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String$Free$DeallocException$AllocClearErrorEval_FetchGivenInfoMatchesRestoreThread$CreateNormalizePythonSaveTraceback@@U_object@@00@
String ID: Python error invoking COM method.
API String ID: 2096869733-741485538
Opcode ID: 5da9950ddfb750638e44bc8fc92db6836ae59022d2134ce0158874649723a4a0
Instruction ID: d777a1a83174a5f29a8eb336067b089626cfa93ab67b8d4f5ff849fb297192e0
Opcode Fuzzy Hash: 5da9950ddfb750638e44bc8fc92db6836ae59022d2134ce0158874649723a4a0
Instruction Fuzzy Hash: 87216B36F19B0285EF19DFA4E49273863A0FF60BD4B084035CE5D46A58CF2CE990C252

Function 00007FF8E6A536A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A536BC
PyErr_SetString.PYTHON313 ref: 00007FF8E6A536E1

Strings

The Python object is invalid, xrefs: 00007FF8E6A536B5
:DragLeave, xrefs: 00007FF8E6A536EF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :DragLeave$The Python object is invalid
API String ID: 1450464846-767860251
Opcode ID: 4ab1ca3f009777a7cf8140153d35bf278996430c7511c6ca93d5326604a5b339
Instruction ID: b78e9156fa34fdc15cf579da0072748fc9dc983ad26e8d3c7704e19efd7ff0c5
Opcode Fuzzy Hash: 4ab1ca3f009777a7cf8140153d35bf278996430c7511c6ca93d5326604a5b339
Instruction Fuzzy Hash: 80216D66F28A42C2EB54DBE6F95627923A1FF88BE4B441035DD2E47764EE2CE4818701

Function 00007FF8E6A6B600 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B61C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6B641

Strings

:Revert, xrefs: 00007FF8E6A6B64F
The Python object is invalid, xrefs: 00007FF8E6A6B615

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :Revert$The Python object is invalid
API String ID: 1450464846-2634774199
Opcode ID: 4cf4f7ad2aa5fd56229a954d6542237d43dd87e62f4aab13b06f8ac184821476
Instruction ID: 17dfa3f372e053b5363120f352686912a3caf4a850ed4b130a833692d95cc7ff
Opcode Fuzzy Hash: 4cf4f7ad2aa5fd56229a954d6542237d43dd87e62f4aab13b06f8ac184821476
Instruction Fuzzy Hash: F7218135F28A42C2EB549BE6F95627923A0FF48BE4B441435DD2E47364DE3CE4918302

Function 00007FF8E6A6D6B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6D6D0
?PyWinObject_AsLARGE_INTEGER@@YAHPEAU_object@@PEAT_LARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A6D6E4
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6D701
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6D72B
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6D752
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A6D782

Strings

The Python object is invalid, xrefs: 00007FF8E6A6D6F3

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Object_R@@@ThreadU_object@@$Arg_Err_FromParseRestoreSaveStringTuple
String ID: The Python object is invalid
API String ID: 3769410717-2445808733
Opcode ID: 59f5d325e21eeda44baddc104c6fc72151d22d5f3b25e0fd4ed2452e9437bc51
Instruction ID: df15c9b5c4ac8a7882bd15857e9e3ad3fc652cf40006f51b86484b18b187d0dd
Opcode Fuzzy Hash: 59f5d325e21eeda44baddc104c6fc72151d22d5f3b25e0fd4ed2452e9437bc51
Instruction Fuzzy Hash: 83215E26F28A4282EB119B95F905269B3B1FF84BE4F440132DE6D07B68DF2CE545C702

Function 00007FF8E6A756E2 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32 ref: 00007FF8E6A756ED
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A7572C
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A75748
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A7575E
PyErr_Clear.PYTHON313 ref: 00007FF8E6A75769
PyErr_SetString.PYTHON313 ref: 00007FF8E6A757B2

Strings

There is no interface object registered that supports this IID, xrefs: 00007FF8E6A7576F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$ArrayClearD@@@DeallocDict_ElementFromItemObject_SafeStringU_object@@
String ID: There is no interface object registered that supports this IID
API String ID: 41092726-1806556748
Opcode ID: 8b9691b26e38fe0907cab409f8803dcbdaf1de2a57da9644bd46e2e498789a06
Instruction ID: 295a54ff4f69c37289dfb832e990126f986d291982d0e95b07bb8a35832a6f5d
Opcode Fuzzy Hash: 8b9691b26e38fe0907cab409f8803dcbdaf1de2a57da9644bd46e2e498789a06
Instruction Fuzzy Hash: A9210E22F38652C2FA55AB96E96637823A1BF44BF5F448431CD1E4B792DE3CF4459302

Function 00007FF8E6A61540 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6155C
PyErr_SetString.PYTHON313 ref: 00007FF8E6A61581

Strings

:IsDirty, xrefs: 00007FF8E6A6158F
The Python object is invalid, xrefs: 00007FF8E6A61555

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :IsDirty$The Python object is invalid
API String ID: 1450464846-2698278726
Opcode ID: 53ad6c99216caddee3ec2e78b20e69e6f237bb27d183567f530106b6bb0e4fc5
Instruction ID: 3d1519de8efbc9dd248e840f89d6bbcdbe1e4f0c240f9ee7d2ac0720dba7ef7d
Opcode Fuzzy Hash: 53ad6c99216caddee3ec2e78b20e69e6f237bb27d183567f530106b6bb0e4fc5
Instruction Fuzzy Hash: 64118125F2CA42C2EB449BE6F94A27963A0FF48BE4F441031DD2E47364DE2CE8928741

Function 00007FF8E6A62640 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A62656
PyErr_SetString.PYTHON313 ref: 00007FF8E6A62673
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6269D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A626BA
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A626EA

Strings

:GetSizeMax, xrefs: 00007FF8E6A6264F
The Python object is invalid, xrefs: 00007FF8E6A62665

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FromObject_ParseR@@@RestoreSaveStringTupleU_object@@
String ID: :GetSizeMax$The Python object is invalid
API String ID: 587566394-2309627308
Opcode ID: 95030465f3ee043853ef7ecaaff5943841ecff6aab6196d4888aacb678a110eb
Instruction ID: a0f3d1399c3f2338a0773ad17e5a3df95a6c1b7006b9cbde934797846b2d3c07
Opcode Fuzzy Hash: 95030465f3ee043853ef7ecaaff5943841ecff6aab6196d4888aacb678a110eb
Instruction Fuzzy Hash: 94118665F2CA4282EB459B95F94527D7362FF44BE0F441071DE2E47758DF2CE4958302

Function 00007FF8E6A603A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A603BC
PyErr_SetString.PYTHON313 ref: 00007FF8E6A603E1

Strings

:IsDirty, xrefs: 00007FF8E6A603EF
The Python object is invalid, xrefs: 00007FF8E6A603B5

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_String
String ID: :IsDirty$The Python object is invalid
API String ID: 1450464846-2698278726
Opcode ID: 60cc2dd2602919e48bcb15ac4b3f92b101de8a1db1bfc012ff96246cd72a7abf
Instruction ID: 32863d42dc49e214e73d0837cc8cee9bdebbff5aff97e898ccdb6a2deadb1341
Opcode Fuzzy Hash: 60cc2dd2602919e48bcb15ac4b3f92b101de8a1db1bfc012ff96246cd72a7abf
Instruction Fuzzy Hash: 15112165F29A02C2FF149BE6E89A27923E1FF48BD5B081431CD2D47360DE6CE4D68301

Function 00007FF8E6A458E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A4591C

Part of subcall function 00007FF8E6A25030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A25088
Part of subcall function 00007FF8E6A25030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A25097
Part of subcall function 00007FF8E6A25030: ?PyWinObject_FromBstr@@YAPEAU_object@@QEA_WH@Z.PYWINTYPES313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A250A6
Part of subcall function 00007FF8E6A25030: Py_BuildValue.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A250D2
Part of subcall function 00007FF8E6A25030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A250F0
Part of subcall function 00007FF8E6A25030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A25109
Part of subcall function 00007FF8E6A25030: _Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8E6A24EF2), ref: 00007FF8E6A25122

?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A45958
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4599B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A459B4
PyGILState_Release.PYTHON313 ref: 00007FF8E6A459BD

Part of subcall function 00007FF8E6A24250: PyErr_Occurred.PYTHON313 ref: 00007FF8E6A24259

Strings

AddError, xrefs: 00007FF8E6A4596E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$FromObject_U_object@@$Bstr@@$State_$BuildEnsureErr_OccurredReleaseValue
String ID: AddError
API String ID: 2964434163-917986504
Opcode ID: 8b5dc527ab8124f90fc987dab780a379741419373e6626fbcb4da0952e927563
Instruction ID: 3296bc79b97e80908820cd638833b3e9266f74a06cfe9c0c5c85a80d271e4443
Opcode Fuzzy Hash: 8b5dc527ab8124f90fc987dab780a379741419373e6626fbcb4da0952e927563
Instruction Fuzzy Hash: DF317E72F29A4282EB64AB91E816378A3A0FF45BE5F044031DE8E47756EF3DE4458702

Function 00007FF8E6A6E710 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6E74F
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6E768
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6E787
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6E7C8
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6E7E4

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

The Python object is invalid, xrefs: 00007FF8E6A6E72F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_$BuildErrorFromInfoObjectObject_StringU_object@@Value
String ID: The Python object is invalid
API String ID: 3213920475-2445808733
Opcode ID: 9c764609c67e58556629685169cdee21dcd25df6ee2e78c357525aacb1038789
Instruction ID: 0426f06d6a690b8493ffc4de045e1c6f3cc62d5fcd259940b863db6b6fde3566
Opcode Fuzzy Hash: 9c764609c67e58556629685169cdee21dcd25df6ee2e78c357525aacb1038789
Instruction Fuzzy Hash: 90216026F28B4182EB44DFA2E44526A63A1FF89FD4F481032DE6E57B65CF3CE4428701

Function 00007FF8E6A6D7A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A6D7BB
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A6D7CF
PyErr_SetString.PYTHON313 ref: 00007FF8E6A6D7EC
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6D816
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A6D833

Strings

The Python object is invalid, xrefs: 00007FF8E6A6D7DE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_Object_ParseR@@@RestoreSaveStringTupleU_object@@
String ID: The Python object is invalid
API String ID: 2962986857-2445808733
Opcode ID: 2261234515f5470af82ee986d227084ddd66dbf27087506de351c834effe92ac
Instruction ID: 906cbea76a6d1cf4c7eab189377bf279e480a4d7bdf84cba9e911fe96acb1fd5
Opcode Fuzzy Hash: 2261234515f5470af82ee986d227084ddd66dbf27087506de351c834effe92ac
Instruction Fuzzy Hash: F0216036F28A4282EA559F95F54527973B1FF44BE0B441036DE6D47764CF2CE845C702

Function 00007FF8E6A66880 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A668A3

Part of subcall function 00007FF8E6A641A0: PyTuple_New.PYTHON313 ref: 00007FF8E6A641C2
Part of subcall function 00007FF8E6A641A0: PyLong_FromUnsignedLong.PYTHON313 ref: 00007FF8E6A641EA

PyErr_Occurred.PYTHON313 ref: 00007FF8E6A668D4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A66930
PyGILState_Release.PYTHON313 ref: 00007FF8E6A66938

Strings

Unexpected exception in gateway method '%hs', xrefs: 00007FF8E6A668EC
DeleteMultiple, xrefs: 00007FF8E6A668E3, 00007FF8E6A66912

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureErr_FromLongLong_OccurredReleaseTuple_Unsigned
String ID: DeleteMultiple$Unexpected exception in gateway method '%hs'
API String ID: 667690297-3044724248
Opcode ID: dd87a41a8988dc3a1e173c03328119fded4540e4534685f9a4a472afc8debd36
Instruction ID: 5f8a040220f040992b953d84b32a211d27b854b0d22f3f8aab93c2c5f23258a5
Opcode Fuzzy Hash: dd87a41a8988dc3a1e173c03328119fded4540e4534685f9a4a472afc8debd36
Instruction Fuzzy Hash: 15218032F2864282EB509BA1E8163A973A1FF48BD4F444135DE5D47355EE3CE805C742

Function 00007FF8E6A3C6A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A3C6ED
?PyWinObject_AsULARGE_INTEGER@@YAHPEAU_object@@PEAT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A3C71F
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3C737
PyErr_Clear.PYTHON313 ref: 00007FF8E6A3C73D
PyGILState_Release.PYTHON313 ref: 00007FF8E6A3C751

Strings

GetSizeMax, xrefs: 00007FF8E6A3C6FE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$ClearDeallocEnsureErr_Object_R@@@ReleaseU_object@@
String ID: GetSizeMax
API String ID: 1322101601-2032451762
Opcode ID: bb1513db7e07ec20260c6b473a4dea7f55c35330e95a81406e2f137409d84efa
Instruction ID: 5bd76b64f8722d77fc2649013a1912fec1b4c833edef7ad3dbb16170746b289c
Opcode Fuzzy Hash: bb1513db7e07ec20260c6b473a4dea7f55c35330e95a81406e2f137409d84efa
Instruction Fuzzy Hash: 6B219F76F28B4282EB109B65E85A32D63A1FB88BD8F445031DE4E87718DF3CE4448B02

Function 00007FF8E6A627E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A627F6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A62813
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A6283D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A62855

Strings

The Python object is invalid, xrefs: 00007FF8E6A62805
:InitNew, xrefs: 00007FF8E6A627EF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :InitNew$The Python object is invalid
API String ID: 3004187977-3693445850
Opcode ID: d0d9ae0d5224e3d3677614027529b81db472b78d0e7cc17fb93a7262563583f4
Instruction ID: 48b2ae396c49419dd6e18bf7af7fbe39dc5f4e61b9ec56a241fd01cd2e01325f
Opcode Fuzzy Hash: d0d9ae0d5224e3d3677614027529b81db472b78d0e7cc17fb93a7262563583f4
Instruction Fuzzy Hash: E1117F31F28A4282EB459B96F94627933A2FF48BE0B445075DD2D077A4DF2CF8408342

Function 00007FF8E6A587D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A587EB
PyErr_SetString.PYTHON313 ref: 00007FF8E6A58808
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5882D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A58849

Strings

The Python object is invalid, xrefs: 00007FF8E6A587FA
l:Skip, xrefs: 00007FF8E6A587E1

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: d218d97eff3ec4e402ff0cd0cea7f0a783d9b2ee0be79a6b1113435a0597d61c
Instruction ID: 9a0b769c262b4ecffc39aa3440cb520cd32dca96f3e6e251016b7d03220503c6
Opcode Fuzzy Hash: d218d97eff3ec4e402ff0cd0cea7f0a783d9b2ee0be79a6b1113435a0597d61c
Instruction Fuzzy Hash: 55114C65F28A0282EA05DBA6F94627923A2FF88BE0B485036CE6D07754DF3CF4448702

Function 00007FF8E6A5B550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5B56B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5B588
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B5AD
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B5C9

Strings

The Python object is invalid, xrefs: 00007FF8E6A5B57A
l:Skip, xrefs: 00007FF8E6A5B561

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: 1b76ba7f5a8e324c16ece5152895f6b60cc208976b56f467cee58b12a379f64d
Instruction ID: 89d1fb0af0ad052a3db86d629b447e4d53dd2e0408b858d84fb3c68f1fdf9b4e
Opcode Fuzzy Hash: 1b76ba7f5a8e324c16ece5152895f6b60cc208976b56f467cee58b12a379f64d
Instruction Fuzzy Hash: A1114F65F28A0282EB09DB95F55627923A2FF88BE0F585036DE2E07754DF3CE444C702

Function 00007FF8E6A54610 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5462B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A54648
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5466D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A54689

Strings

The Python object is invalid, xrefs: 00007FF8E6A5463A
l:Skip, xrefs: 00007FF8E6A54621

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: The Python object is invalid$l:Skip
API String ID: 3004187977-1306879369
Opcode ID: ac501f56f93fcccdc5e0e2c93dee7c82f7eb6ce7cf07f937d5d12456c2c1dd42
Instruction ID: 87171498d66d207b21485c7efb03b0d4d009edbaabc8a71cfad8bbb98c3a0cd4
Opcode Fuzzy Hash: ac501f56f93fcccdc5e0e2c93dee7c82f7eb6ce7cf07f937d5d12456c2c1dd42
Instruction Fuzzy Hash: 06113D65F28B0282EA05DBA6F94637923A2FF88BE0B485136CE2D07754DE3CE4458702

Function 00007FF8E6A58890 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A588A6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A588C3
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A588E8
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A588FF

Strings

The Python object is invalid, xrefs: 00007FF8E6A588B5
:Reset, xrefs: 00007FF8E6A5889F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Reset$The Python object is invalid
API String ID: 3004187977-3082310266
Opcode ID: 68f18b20b2b54fc4fb8e78159d94e5efd9ca99723c8a9c9add4e4e7cee4777a4
Instruction ID: 94f71e172b05899a8b4005c81cb0395e1ca8b8ef573c2d184f51a6775f5aaec5
Opcode Fuzzy Hash: 68f18b20b2b54fc4fb8e78159d94e5efd9ca99723c8a9c9add4e4e7cee4777a4
Instruction Fuzzy Hash: 90111275F28A0281EB15DB96F95627923A2FF88BE0B485035CD2D47764DF3CF4948302

Function 00007FF8E6A546D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A546E6
PyErr_SetString.PYTHON313 ref: 00007FF8E6A54703
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A54728
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5473F

Strings

The Python object is invalid, xrefs: 00007FF8E6A546F5
:Reset, xrefs: 00007FF8E6A546DF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Reset$The Python object is invalid
API String ID: 3004187977-3082310266
Opcode ID: 3c21d53f1f78df2bab4af7892b1de082c4b20565c256ea4ff4ff7b0d2c981bdd
Instruction ID: 31486c417cd0be8cf80d3b17a23fd20ba842eb0031b59e74e020fb9383745e99
Opcode Fuzzy Hash: 3c21d53f1f78df2bab4af7892b1de082c4b20565c256ea4ff4ff7b0d2c981bdd
Instruction Fuzzy Hash: E3113D65F28A0282EB15DBA6F95623923A2FF89BE0B485035CD2D47764DE2CF490C702

Function 00007FF8E6A5B610 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A5B626
PyErr_SetString.PYTHON313 ref: 00007FF8E6A5B643
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A5B668
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A5B67F

Strings

The Python object is invalid, xrefs: 00007FF8E6A5B635
:Reset, xrefs: 00007FF8E6A5B61F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveStringTuple
String ID: :Reset$The Python object is invalid
API String ID: 3004187977-3082310266
Opcode ID: cc433defc4807ca8bfe05cd067b192bbf296f5bfd510e23ebe762638e2288aff
Instruction ID: 5b7b5e21b3d72c27403432dd897c5347e4a8aa20b4f87885bfa5fd68ae6d4450
Opcode Fuzzy Hash: cc433defc4807ca8bfe05cd067b192bbf296f5bfd510e23ebe762638e2288aff
Instruction Fuzzy Hash: F3113065F28B0282EA15DB96F95627523A2FF48BE0B485035CD2D477A4DE3CF4918301

Function 00007FF8E6A37750 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A37763
?PyWinObject_AsHANDLE@@YAHPEAU_object@@PEAPEAX@Z.PYWINTYPES313 ref: 00007FF8E6A3777B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A3778F
RevokeDragDrop.OLE32 ref: 00007FF8E6A3779D
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A377A8

Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24CFC
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D3F
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D49
Part of subcall function 00007FF8E6A24CC0: GetErrorInfo.OLEAUT32 ref: 00007FF8E6A24D59
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D64
Part of subcall function 00007FF8E6A24CC0: PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A24D85
Part of subcall function 00007FF8E6A24CC0: PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A24D9C
Part of subcall function 00007FF8E6A24CC0: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A24DBC
Part of subcall function 00007FF8E6A24CC0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A24DDD
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24DF4
Part of subcall function 00007FF8E6A24CC0: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A24E07
Part of subcall function 00007FF8E6A24CC0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A24E20

Strings

O:RevokeDragDrop, xrefs: 00007FF8E6A3775C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocObject_U_object@@$Arg_BuildDragDropErr_ErrorFromInfoObjectParseRevokeTupleValue
String ID: O:RevokeDragDrop
API String ID: 56059392-3396276766
Opcode ID: db1ec274f75df3bf19f997c731c9092b05475f5e4bcd8762e95543da29b400ef
Instruction ID: a426d6fcad8d842b08c5d853a2cffd0f9bcfb8e9146ebb3958711605f2810cb8
Opcode Fuzzy Hash: db1ec274f75df3bf19f997c731c9092b05475f5e4bcd8762e95543da29b400ef
Instruction Fuzzy Hash: 99112126F28A4382EA04DFA6E84627963A1FF89BD4F880035DA5D47724CF3CE545C701

Function 00007FF8E6A34380 Relevance: 10.5, APIs: 7, Instructions: 28threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A34386
?PyWin_AcquireGlobalLock@@YAXXZ.PYWINTYPES313 ref: 00007FF8E6A3438F
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6A34395
CoUninitialize.OLE32 ref: 00007FF8E6A343AC
CoUninitialize.OLE32 ref: 00007FF8E6A343BE
?PyWin_ReleaseGlobalLock@@YAXXZ.PYWINTYPES313 ref: 00007FF8E6A343C5
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A343CF

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Thread$Eval_GlobalLock@@UninitializeWin_$AcquireCurrentReleaseRestoreSave
String ID:
API String ID: 1455255957-0
Opcode ID: fd79e4f10c0e1818b30bb0f24df0dbc36a9b17bf35b10442b00f2118b503ffb5
Instruction ID: a2b95f83640a662aeaaaeeae559cece0378868015bb54346dc99373cc7bbfd9e
Opcode Fuzzy Hash: fd79e4f10c0e1818b30bb0f24df0dbc36a9b17bf35b10442b00f2118b503ffb5
Instruction Fuzzy Hash: C9017935F69607C6F6546BE5E84A33863A0FF0ABE5F441438C92D06270DE3C7488D613

Function 00007FF8E6A44570 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E6A79E90: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF8E6A22343), ref: 00007FF8E6A79EAA

_Py_NewReference.PYTHON313 ref: 00007FF8E6A445AF
PyTuple_New.PYTHON313 ref: 00007FF8E6A445C1
PyLong_FromLong.PYTHON313 ref: 00007FF8E6A445DA
PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A445E8
PyTuple_New.PYTHON313 ref: 00007FF8E6A44608
PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A44626

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Tuple_$Item$FromLongLong_Referencemalloc
String ID:
API String ID: 2262048582-0
Opcode ID: 4c3a249609a1a876e3074aebdc699aa25a0f91fd60e9d94ed9810d30a7551712
Instruction ID: 9b1ce098f178db4fecad4c0da8c81a3c36089ca58625efcc7f3bdf2cbb5f458d
Opcode Fuzzy Hash: 4c3a249609a1a876e3074aebdc699aa25a0f91fd60e9d94ed9810d30a7551712
Instruction Fuzzy Hash: 8E314876A147518BD660DF96E845A2AB3E8FB48B91B054135DF8E43B11DF3CE482CB01

Function 00007FF8E6A26670 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A266B3
?PyWinObject_FromIID@@YAPEAU_object@@AEBU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A266CA
PyDict_GetItem.PYTHON313 ref: 00007FF8E6A266E2
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A266F9
PyLong_AsVoidPtr.PYTHON313 ref: 00007FF8E6A26707
PyGILState_Release.PYTHON313 ref: 00007FF8E6A26726

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$D@@@DeallocDict_EnsureFromItemLong_Object_ReleaseU_object@@Void
String ID:
API String ID: 2511354192-0
Opcode ID: f9aace2356f43bfea9000073c30e387ec8e0ce648aa91d3364322bcdd710c4ec
Instruction ID: c124d338cf7388408295d2356c4620d173d7038c6f8162fac5fe2e4e0f3116cf
Opcode Fuzzy Hash: f9aace2356f43bfea9000073c30e387ec8e0ce648aa91d3364322bcdd710c4ec
Instruction Fuzzy Hash: AA218E36F29B4286EA149F92F845329A3E0FB88BD0F081434DE5D4BB55DF3CE4518705

Function 00007FF8E6A24770 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E6A24380: OutputDebugStringW.KERNEL32(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2438A
Part of subcall function 00007FF8E6A24380: PyErr_Fetch.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2439F
Part of subcall function 00007FF8E6A24380: PySys_GetObject.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243AC
Part of subcall function 00007FF8E6A24380: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243C2
Part of subcall function 00007FF8E6A24380: PyFile_WriteObject.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243DC
Part of subcall function 00007FF8E6A24380: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A243EB
Part of subcall function 00007FF8E6A24380: fprintf.MSPDB140-MSVCRT ref: 00007FF8E6A243FE
Part of subcall function 00007FF8E6A24380: _Py_Dealloc.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A24411
Part of subcall function 00007FF8E6A24380: PyErr_Restore.PYTHON313(?,?,00000000,00000000,00007FF8E6A249DA), ref: 00007FF8E6A2442B

__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8E6A247AD
PyErr_Fetch.PYTHON313 ref: 00007FF8E6A247E9
PyErr_NormalizeException.PYTHON313 ref: 00007FF8E6A24808
?GetPythonTraceback@@YAPEA_WPEAU_object@@00@Z.PYWINTYPES313 ref: 00007FF8E6A24829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6A2483D
PyErr_Restore.PYTHON313 ref: 00007FF8E6A24852

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Err_$FetchObjectRestore$DeallocDebugExceptionFile_FromNormalizeObject_OutputPythonStringSys_Traceback@@U_object@@U_object@@00@Write__acrt_iob_func__stdio_common_vswprintffprintffree
String ID:
API String ID: 3328430175-0
Opcode ID: 60b8b7ffb4d918bbde304ec863cc24f66a213f94a1a1019f1ac907af1a82689f
Instruction ID: c2501c6b50da4070c23fcb4fb11b0df4b53d391582c1dea1ff07a8687dd45b15
Opcode Fuzzy Hash: 60b8b7ffb4d918bbde304ec863cc24f66a213f94a1a1019f1ac907af1a82689f
Instruction Fuzzy Hash: 20213B36B28B82D1EB40DB91F4865AAB760FF84BD0F441036EA8E03669DE3CE444CB41

Function 00007FF8E6A7881D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A78873
Py_BuildValue.PYTHON313 ref: 00007FF8E6A788D9
PyErr_SetString.PYTHON313 ref: 00007FF8E6A788F5

Strings

i:SizeOfVT, xrefs: 00007FF8E6A7886C
unknown variant type, xrefs: 00007FF8E6A788EB

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Arg_BuildErr_ParseStringTupleValue
String ID: i:SizeOfVT$unknown variant type
API String ID: 601023725-4270758884
Opcode ID: e99bb5d10b2431ff27c4c2450fd3bb982ecebfbb8699caf6d5c122ff42c39f59
Instruction ID: aaa9ca072567cfe5f63c7b9d0f053eb907e27c4bfdc8aa0e04fe9944d732a4c9
Opcode Fuzzy Hash: e99bb5d10b2431ff27c4c2450fd3bb982ecebfbb8699caf6d5c122ff42c39f59
Instruction Fuzzy Hash: D52193A2F1C58387E7018BB8E8963B83BA0FF497D8F584071C68982254DD1CF157D702

Function 00007FF8E6A3B7C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A45A72
?PyWinObject_AsIID@@YAHPEAU_object@@PEAU_GUID@@@Z.PYWINTYPES313 ref: 00007FF8E6A45AA4
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A45AC6
PyGILState_Release.PYTHON313 ref: 00007FF8E6A45AE7

Strings

GetClassID, xrefs: 00007FF8E6A45A83

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$D@@@DeallocEnsureObject_ReleaseU_object@@
String ID: GetClassID
API String ID: 1645649514-1890744744
Opcode ID: 6d967699810e214aba411f50f78f46df7977191031baef2c71294a2eb3e6ad20
Instruction ID: bacf2ad25dd63ac0bcf31dc4f1bce444d7c47cc1dcd715286ee30ada10c625b4
Opcode Fuzzy Hash: 6d967699810e214aba411f50f78f46df7977191031baef2c71294a2eb3e6ad20
Instruction Fuzzy Hash: B7218176F28B4682EB10ABA5E85A36D63A1FF89BD4F444031DE4E47715DE3CE4058B01

Function 00007FF8E6A71850 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON313 ref: 00007FF8E6A71869

Part of subcall function 00007FF8E6A71BE0: PyTuple_New.PYTHON313 ref: 00007FF8E6A71C23
Part of subcall function 00007FF8E6A71BE0: PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A71C3C
Part of subcall function 00007FF8E6A71BE0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A71C5F
Part of subcall function 00007FF8E6A71BE0: PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A71C6E
Part of subcall function 00007FF8E6A71BE0: Py_BuildValue.PYTHON313 ref: 00007FF8E6A71CC4
Part of subcall function 00007FF8E6A71BE0: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A71CDB

PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A71882
Py_BuildValue.PYTHON313 ref: 00007FF8E6A718AF
PyTuple_SetItem.PYTHON313 ref: 00007FF8E6A718BE

Strings

(ii), xrefs: 00007FF8E6A718A4

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Tuple_$Item$BuildValue$Dealloc
String ID: (ii)
API String ID: 3753781149-4115259616
Opcode ID: b3d13d3f501743bb360580fe62f720b8139fdeb79a7d28346464c8d29d2226ac
Instruction ID: d541d3849ad9ed008c69d0f8e9134f8dcd72ff23ae47605289e55169566235cd
Opcode Fuzzy Hash: b3d13d3f501743bb360580fe62f720b8139fdeb79a7d28346464c8d29d2226ac
Instruction Fuzzy Hash: 29016122F28785C6E7048F62E8451B973A1FB84FD9B484431EE5907B59DF3CE852C741

Function 00007FF8E6A608A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A608BD
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A608C8
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A6090F
PyGILState_Release.PYTHON313 ref: 00007FF8E6A60917

Strings

Load, xrefs: 00007FF8E6A608E9

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureFromObject_ReleaseU_object@@
String ID: Load
API String ID: 4093839183-2234796835
Opcode ID: cd04774691088bb2c5a989e58d7f9fd3e7a29c4cb896ae34f0d85d1fa2dc603c
Instruction ID: e84c71d75f56e4117d7664c9b7b826654d66bebfca02b46b46a34cb0a7774c0e
Opcode Fuzzy Hash: cd04774691088bb2c5a989e58d7f9fd3e7a29c4cb896ae34f0d85d1fa2dc603c
Instruction Fuzzy Hash: 09013936B28B42C2EB008FA1F905269B3A0FB99BE4F484031DE5D43B28DF3CD5948701

Function 00007FF8E6A37530 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37threadcomclipboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3753E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A37559
OleFlushClipboard.OLE32 ref: 00007FF8E6A37562
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A3756D

Strings

:OleFlushClipboard, xrefs: 00007FF8E6A37537

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_ClipboardFlushParseRestoreSaveTuple
String ID: :OleFlushClipboard
API String ID: 994633628-2909607431
Opcode ID: 8ac89f65eaf2e0ae206c7b0a671e31e76a3444249749940ee003a74cb76f0990
Instruction ID: 15196441947cd555fd3164f49076aee15e48a14848c0a69a0f72f46cda299877
Opcode Fuzzy Hash: 8ac89f65eaf2e0ae206c7b0a671e31e76a3444249749940ee003a74cb76f0990
Instruction Fuzzy Hash: A7012C35F68A4282EB18ABA6E84627923E1FF8DBD4F880435D95D87364DF3CF1458702

Function 00007FF8E6A29630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A29645
PyObject_CallMethod.PYTHON313 ref: 00007FF8E6A2965B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2968C
PyGILState_Release.PYTHON313 ref: 00007FF8E6A296A2

Strings

_GetNameSpaceParent_, xrefs: 00007FF8E6A2964F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$CallDeallocEnsureMethodObject_Release
String ID: _GetNameSpaceParent_
API String ID: 3715620727-2203319814
Opcode ID: c3534e490f02fa6dd5337582f2c666aa5afb906ba97738069805392142b9802e
Instruction ID: e2450400aea07c73cf3c7be5c0cdf08f9fea60f3197276e1b76f6ba5122ee65d
Opcode Fuzzy Hash: c3534e490f02fa6dd5337582f2c666aa5afb906ba97738069805392142b9802e
Instruction Fuzzy Hash: 79015A22F28B4282FB149BA2F85676863A0FF88BE4F045430DE1D47765EE3CE445C742

Function 00007FF8E6A3C5F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A3C5FD
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A3C633
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A3C64B
PyGILState_Release.PYTHON313 ref: 00007FF8E6A3C65F

Strings

IsDirty, xrefs: 00007FF8E6A3C613

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureLongLong_Release
String ID: IsDirty
API String ID: 1519730240-535502831
Opcode ID: 3d0743fbe4dd6409113d59f2b052ac450f83edd4ca4a57ffbea1203645b1baaa
Instruction ID: fd311ed04a8335987be6878a44b6345c40ae7510886cc94bee2586603c67e438
Opcode Fuzzy Hash: 3d0743fbe4dd6409113d59f2b052ac450f83edd4ca4a57ffbea1203645b1baaa
Instruction Fuzzy Hash: 8E011E33F28B5282E7409BA5E48566D63A4FB88BD8F552031DA5E43654CF3DD445C741

Function 00007FF8E6A466F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A466FD
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A46733
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A4674B
PyGILState_Release.PYTHON313 ref: 00007FF8E6A4675F

Strings

IsDirty, xrefs: 00007FF8E6A46713

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureLongLong_Release
String ID: IsDirty
API String ID: 1519730240-535502831
Opcode ID: dd1ce7138e4cfb9051e4ec4dcb4a0202090ac9d52e892c1b945430719ffe178b
Instruction ID: 0a1abfd0064254f891e28bdbf5cbbfdc466570187017ff8ca0b7ee868931a253
Opcode Fuzzy Hash: dd1ce7138e4cfb9051e4ec4dcb4a0202090ac9d52e892c1b945430719ffe178b
Instruction Fuzzy Hash: D4011E37F28B5282E7409BA5E48576963A4FF88BD8F551031DA5E43614CE3CD445C741

Function 00007FF8E6A5D700 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5D717
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A5D724
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A5D767
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5D76F

Strings

SetSize, xrefs: 00007FF8E6A5D741

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureFromObject_R@@@ReleaseU_object@@
String ID: SetSize
API String ID: 3310634197-2911674618
Opcode ID: 971f2d20354e8fd7f6a4d8f5a64c3f52c16e03786dcf14da839b6040d7ca01c3
Instruction ID: 73bbf8bf9289ee5f18db8fb5e977efdff77bbebd8d4004bf3acd4e4d9ea48080
Opcode Fuzzy Hash: 971f2d20354e8fd7f6a4d8f5a64c3f52c16e03786dcf14da839b6040d7ca01c3
Instruction Fuzzy Hash: D4014836F28B6282EB009BA4E649228A3B4FB44BE4F404431DE5C43B58EF3CE555C701

Function 00007FF8E6A32390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A3239E
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A323B9
CoResumeClassObjects.OLE32 ref: 00007FF8E6A323C2
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A323CD

Strings

:CoResumeClassObjects, xrefs: 00007FF8E6A32397

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Arg_ClassObjectsParseRestoreResumeSaveTuple
String ID: :CoResumeClassObjects
API String ID: 579042037-995057619
Opcode ID: a1ae044dc858589a26809cdb6a8c1d4088e4bdbc98bbc36a9cb1891a349cb8a2
Instruction ID: ffafe8608341daabcfce0689b32d652e6c05ebc745ce6b80fdf3b274d31148ec
Opcode Fuzzy Hash: a1ae044dc858589a26809cdb6a8c1d4088e4bdbc98bbc36a9cb1891a349cb8a2
Instruction Fuzzy Hash: 15012832F28A4282EA149F96E84626963E2FF89BD4F884135DA5D43324CE3CF1558702

Function 00007FF8E6A78500 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A78518
PyErr_SetString.PYTHON313 ref: 00007FF8E6A7853B
PyLong_FromUnsignedLongLong.PYTHON313 ref: 00007FF8E6A78550

Strings

s#:UL64, xrefs: 00007FF8E6A7850C
argument must be 8 characters, xrefs: 00007FF8E6A78531

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Long$Arg_Err_FromLong_ParseStringTupleUnsigned
String ID: argument must be 8 characters$s#:UL64
API String ID: 329311993-2289726216
Opcode ID: 7938910b0a3f077d94f59d9e33b7783c79098e877c911b53a34d434f53f042b9
Instruction ID: 4bfc89d5da24839caac1618acff9aabea72e4f2aebaa5a4ca60ade9e28c799c1
Opcode Fuzzy Hash: 7938910b0a3f077d94f59d9e33b7783c79098e877c911b53a34d434f53f042b9
Instruction Fuzzy Hash: A4F01221F29903C1EB04DBA5E88626923B1FF85BD9F940032DA1D46524CE3DE559C702

Function 00007FF8E6A7972D Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
?PyWinObject_FromLARGE_INTEGER@@YAPEAU_object@@AEBT_LARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A79734
?PyWinObject_FromLARGE_INTEGER@@YAPEAU_object@@AEBT_LARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A7973F

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: FromLongLong_Object_R@@@U_object@@$SizeTuple_
String ID:
API String ID: 2536423618-0
Opcode ID: 83d707271d8bbeb4c37f74b4487810e791dd6995d1454972390dd8f4f5cdab5e
Instruction ID: 354799072bfd08cfe06cc3510b8d94cb63c5f49185a20b70792a530e0b68a188
Opcode Fuzzy Hash: 83d707271d8bbeb4c37f74b4487810e791dd6995d1454972390dd8f4f5cdab5e
Instruction Fuzzy Hash: E4211A66F28A5285FA749F95E45237923A1FF98BE6F440432CE5E473A0DE2CF8059212

Function 00007FF8E6A79713 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A7971A
?PyWinObject_FromULARGE_INTEGER@@YAPEAU_object@@AEBT_ULARGE_INTEGER@@@Z.PYWINTYPES313 ref: 00007FF8E6A79725

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: FromLongLong_Object_R@@@U_object@@$SizeTuple_
String ID:
API String ID: 2536423618-0
Opcode ID: 7126636ff5fbfef15ad5e9bb3a890d352a4db2f035d3941cbed292845a2de881
Instruction ID: 0c37cc56486843bb154d277f93462b11334d53cbd191722c77e87d8e3f2c2b9c
Opcode Fuzzy Hash: 7126636ff5fbfef15ad5e9bb3a890d352a4db2f035d3941cbed292845a2de881
Instruction Fuzzy Hash: FC211A65F28A5285FA749F95E45237923A1FF98BE2F440432CE9E477A0DE2CF8059312

Function 00007FF8E6A3188E Relevance: 7.5, APIs: 5, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A31CEB
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A31D11
?PyWinObject_FreeWCHAR@@YAXPEA_W@Z.PYWINTYPES313 ref: 00007FF8E6A31D2A
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A31D63
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A31DA3
CoTaskMemFree.OLE32 ref: 00007FF8E6A31DB3

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$FreeRestoreSave$Object_Task
String ID:
API String ID: 783668138-0
Opcode ID: 820d6485c1b572dbe88501ffbc4fa96cc3d19f051fba35e38e1c8f818ff5b0b7
Instruction ID: 40365affa183bb908cb1c65357cb52ba73b6892ac4f91955d02ca2146c72e75c
Opcode Fuzzy Hash: 820d6485c1b572dbe88501ffbc4fa96cc3d19f051fba35e38e1c8f818ff5b0b7
Instruction Fuzzy Hash: 4D21E936A18A41C6D754DB48E48536EB3B0F7C6B90F100035EA9E477A4CF3DE885CB01

Function 00007FF8E6A69850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FF8E6A6987B
PyEval_SaveThread.PYTHON313 ref: 00007FF8E6A69893
PyEval_RestoreThread.PYTHON313 ref: 00007FF8E6A698AB

Strings

The Python object is invalid, xrefs: 00007FF8E6A6985B

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveString
String ID: The Python object is invalid
API String ID: 695671107-2445808733
Opcode ID: a2796d78fa384c94eac0d4eebfac4cf66185b162b59c039c5059b5ea3163b916
Instruction ID: 59edc0d12aeed3a3c67e9e5ea2fb4d219c872ff2219406184b53d6beacb01f4c
Opcode Fuzzy Hash: a2796d78fa384c94eac0d4eebfac4cf66185b162b59c039c5059b5ea3163b916
Instruction Fuzzy Hash: 81115E36F2CA4282EB559B96F55627D73A0FF48BE4F441032DE2E47764DE2CE4518702

Function 00007FF8E6A785A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A785BA
PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FF8E6A785D0
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF8E6A785E5

Strings

O!:strUL64, xrefs: 00007FF8E6A785B3

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Long$Arg_Bytes_FromLong_ParseSizeStringTupleUnsigned
String ID: O!:strUL64
API String ID: 3897942398-3999675700
Opcode ID: 232cfefb3a415edd69ea6ad47ec3751f0987da64a692cd6ecd497953bcc3b4b2
Instruction ID: 2200ec079d395c2eabb3129fafb4e655339dbe0905ac4858c7e65f5a43b234f3
Opcode Fuzzy Hash: 232cfefb3a415edd69ea6ad47ec3751f0987da64a692cd6ecd497953bcc3b4b2
Instruction Fuzzy Hash: 1DE0ED25F29A4381EA44DFA1F84226933B0FB867E4F900431DB5D46624DE3CE59A8741

Function 00007FF8E6A796B5 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
memcpy.VCRUNTIME140 ref: 00007FF8E6A796DB

Part of subcall function 00007FF8E6A74630: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7468A
Part of subcall function 00007FF8E6A74630: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A746A5
Part of subcall function 00007FF8E6A74630: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A746B9

PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_LongLong_$FromObjectObject_SizeStringTuple_U_object@@memcpy
String ID:
API String ID: 765997161-0
Opcode ID: 99d853281744b847a397d1f53c28ef11fdcc589b22e329a43df4055f62d7376d
Instruction ID: 2758ba4ec1d7cd42811c9c69f969a2020cf284ec6489b93a760c1c7c11201ec3
Opcode Fuzzy Hash: 99d853281744b847a397d1f53c28ef11fdcc589b22e329a43df4055f62d7376d
Instruction Fuzzy Hash: EE215E66F28A5281FA349F95E45237923A1FF98BF6F400432CE5E473A0DE2CF8059312

Function 00007FF8E6A796BD Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
memcpy.VCRUNTIME140 ref: 00007FF8E6A796DB

Part of subcall function 00007FF8E6A74630: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7468A
Part of subcall function 00007FF8E6A74630: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A746A5
Part of subcall function 00007FF8E6A74630: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A746B9

PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_LongLong_$FromObjectObject_SizeStringTuple_U_object@@memcpy
String ID:
API String ID: 765997161-0
Opcode ID: 11d6bcbad7048e0c054be25191fc6888b00fed8ff16394cf8b3a191bd5fcf63a
Instruction ID: e6ddfd1f71db089d930aa1adcbaf77fc7bdd346327ebfa5508262e952bf5ba4f
Opcode Fuzzy Hash: 11d6bcbad7048e0c054be25191fc6888b00fed8ff16394cf8b3a191bd5fcf63a
Instruction Fuzzy Hash: 63215E66F28A5281FA349F95E45237923A1FF98BF6F400432CE5E473A1DE2CF4059312

Function 00007FF8E6A796C5 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
memcpy.VCRUNTIME140 ref: 00007FF8E6A796DB

Part of subcall function 00007FF8E6A74630: ?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7468A
Part of subcall function 00007FF8E6A74630: PyErr_SetObject.PYTHON313 ref: 00007FF8E6A746A5
Part of subcall function 00007FF8E6A74630: _Py_Dealloc.PYTHON313 ref: 00007FF8E6A746B9

PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: DeallocErr_LongLong_$FromObjectObject_SizeStringTuple_U_object@@memcpy
String ID:
API String ID: 765997161-0
Opcode ID: ccfba71dc46fa59e42b5944861d6b7711cfaeb89e0118ef10f97b04e325ad306
Instruction ID: 8b4b79088f668cc8db35db730bd6dfac58bdf8ec5dc78ae469c26d9eeece726d
Opcode Fuzzy Hash: ccfba71dc46fa59e42b5944861d6b7711cfaeb89e0118ef10f97b04e325ad306
Instruction Fuzzy Hash: EF214D66F28A5281EA349F95E45237923A1FB98BE6F400432CE5E473A0DE2CF4059312

Function 00007FF8E6A79708 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
?PyWinObject_FromOLECHAR@@YAPEAU_object@@PEB_W@Z.PYWINTYPES313 ref: 00007FF8E6A7970B
PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: LongLong_$DeallocErr_FromObject_SizeStringTuple_U_object@@
String ID:
API String ID: 2632132997-0
Opcode ID: 8b50dd71f2afe396f78e5e3bcd47f300c3422ad01ac1133c6f85b1c4bf5470d6
Instruction ID: c30bfc1d5eff2bbedd21fae0292c676fb09fb86bb06cb35e92641a165c5109b2
Opcode Fuzzy Hash: 8b50dd71f2afe396f78e5e3bcd47f300c3422ad01ac1133c6f85b1c4bf5470d6
Instruction Fuzzy Hash: 21112E76F28A5285FA749F95E45137923A1FB98BF6F440432CE9E473A0DE2CF8059312

Function 00007FF8E6A796FD Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
PyBytes_FromString.PYTHON313 ref: 00007FF8E6A79700
PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: LongLong_String$Bytes_DeallocErr_FromSizeTuple_
String ID:
API String ID: 1284453918-0
Opcode ID: 6ed2c3dac3dac34035185257ff3ccc958aeba063bd22a6b485ea2b3a5fac3144
Instruction ID: e185a71b99ca53d8cdc6e07ecf89ed3ebfa89edb7713da66f8d9eb96a39344a3
Opcode Fuzzy Hash: 6ed2c3dac3dac34035185257ff3ccc958aeba063bd22a6b485ea2b3a5fac3144
Instruction Fuzzy Hash: AF114C76F28A5285EA749F95E05137923A1FB88BE6F400432CE9E473A0DE2CF8019312

Function 00007FF8E6A79747 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON313 ref: 00007FF8E6A7953C
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A79560
PyLong_AsLong.PYTHON313 ref: 00007FF8E6A7956F
PyLong_FromVoidPtr.PYTHON313 ref: 00007FF8E6A7974A
PyErr_SetString.PYTHON313 ref: 00007FF8E6A79796
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A797AC

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Long_$Long$DeallocErr_FromSizeStringTuple_Void
String ID:
API String ID: 4151990473-0
Opcode ID: 3a1d0cb427ff50bac2e13f302c73860293e519b7d6c1895e37388ac695eb7a56
Instruction ID: d8d03ee9fe432457df305f9bbcf501fb14281f7eaefc5ec2bfa7bf41ec465445
Opcode Fuzzy Hash: 3a1d0cb427ff50bac2e13f302c73860293e519b7d6c1895e37388ac695eb7a56
Instruction Fuzzy Hash: 8D116D66F28A5281FA349F95E05137923A1FB88BF2F440436CE5E473A0DE2CF8019312

Function 00007FF8E6A277A0 Relevance: 6.0, APIs: 4, Instructions: 44threadwindowCOMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313(?,?,?,00007FF8E6A25FE4), ref: 00007FF8E6A277DB
_Py_Dealloc.PYTHON313(?,?,?,00007FF8E6A25FE4), ref: 00007FF8E6A277F2
PyGILState_Release.PYTHON313(?,?,?,00007FF8E6A25FE4), ref: 00007FF8E6A277FA
PostThreadMessageW.USER32 ref: 00007FF8E6A27834

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$DeallocEnsureMessagePostReleaseThread
String ID:
API String ID: 2729011261-0
Opcode ID: f92e162427310c49f1e2f526082893fc7d4f5cf52090ef30a0f9ba200c1458ae
Instruction ID: 13c5498be9fdeadd5e4ff9222b7b729d861fca87812581316818083669800248
Opcode Fuzzy Hash: f92e162427310c49f1e2f526082893fc7d4f5cf52090ef30a0f9ba200c1458ae
Instruction Fuzzy Hash: 52114232F29B0186EB459FA8E45677937A4FF44BA4F140531C91D427A0CF3DE985C742

Function 00007FF8E6A2E510 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E537
PyUnicode_Concat.PYTHON313 ref: 00007FF8E6A2E554
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E56B
_Py_Dealloc.PYTHON313 ref: 00007FF8E6A2E587

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Dealloc$ConcatUnicode_
String ID:
API String ID: 973650400-0
Opcode ID: f2ec0b04d0cf53d7425a2969d3e2008c0b9a55915d45d2f15facfae4f40e3a49
Instruction ID: d3c340e4b5fbbbe6a549d495d0e1bd7f6925dca1cb84cba28a576bc6dcffba5f
Opcode Fuzzy Hash: f2ec0b04d0cf53d7425a2969d3e2008c0b9a55915d45d2f15facfae4f40e3a49
Instruction Fuzzy Hash: F5016D32F7AA4281EB858FA5F60572873A4FB54BD8F049030DA6902B44EF3DE4918702

Function 00007FF8E6A728E3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00007FF8E6A728E7
GlobalSize.KERNEL32 ref: 00007FF8E6A728F9
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF8E6A72905
GlobalUnlock.KERNEL32 ref: 00007FF8E6A72912

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Global$Size$Bytes_FromLockStringUnlock
String ID:
API String ID: 911184104-0
Opcode ID: 29b85938cf0b3a91f0d98d1f346e26298622598660a1be10a37f41af03a5a3b4
Instruction ID: 8dc0f234a5f05ce453b730603fb1dc64b22353eeda5b4ec7a872ac3e93030407
Opcode Fuzzy Hash: 29b85938cf0b3a91f0d98d1f346e26298622598660a1be10a37f41af03a5a3b4
Instruction Fuzzy Hash: A9F01D26F69A0286EA509F57E45522923A1FF58FE5B080431CF5E47355DE3CF8918301

Function 00007FF8E6A72660 Relevance: 6.0, APIs: 4, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32 ref: 00007FF8E6A72664
GlobalAlloc.KERNEL32 ref: 00007FF8E6A72672
memcpy.VCRUNTIME140 ref: 00007FF8E6A7268B
PyErr_NoMemory.PYTHON313 ref: 00007FF8E6A726E0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Global$AllocErr_MemorySizememcpy
String ID:
API String ID: 1092170675-0
Opcode ID: b98035858a0c3effd8288935a4ecc66f0fce42e7d3d39beeabc18ad413944e5b
Instruction ID: 778ed534f82df0bd5d1915759b109136051a0107cc1db963a1215a2160a0f3d4
Opcode Fuzzy Hash: b98035858a0c3effd8288935a4ecc66f0fce42e7d3d39beeabc18ad413944e5b
Instruction Fuzzy Hash: 90F01D62F29A4186EA448B56F44522A63A0FB48BD0B441435EF5E47755DF2CF4E18700

Function 00007FF8E6A527C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A527D4
PyGILState_Release.PYTHON313 ref: 00007FF8E6A52804

Strings

DUnadvise, xrefs: 00007FF8E6A527F0

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: DUnadvise
API String ID: 715727267-1018835392
Opcode ID: e8ba20a68a4bc86554509d512f520de24a763bfc1729f21fbd04d9169c7669c9
Instruction ID: a0520aa885f2e641a13fa89d7e0404372797f776d1bf019c1dc666d8152f4605
Opcode Fuzzy Hash: e8ba20a68a4bc86554509d512f520de24a763bfc1729f21fbd04d9169c7669c9
Instruction Fuzzy Hash: 02F03A36F24B61C2EB008F69F4042596370FB88B94F544531DE5C93718DE3CD445CB00

Function 00007FF8E6A47760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A47774
PyGILState_Release.PYTHON313 ref: 00007FF8E6A477A4

Strings

Commit, xrefs: 00007FF8E6A47790

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Commit
API String ID: 715727267-1232612251
Opcode ID: b21ec9d3d4c7731d07e204df68bc54d3499f784c1dcb17fcdffe5861d9e0394f
Instruction ID: f9e783dd71134e32015febfa2edb187b9f02866f87024c08131f00590f149979
Opcode Fuzzy Hash: b21ec9d3d4c7731d07e204df68bc54d3499f784c1dcb17fcdffe5861d9e0394f
Instruction Fuzzy Hash: 29F03A36F24A6282EB008F69F408259A360FB88B94B444532DE5C83718DF3CD445CB00

Function 00007FF8E6A57660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A57674
PyGILState_Release.PYTHON313 ref: 00007FF8E6A576A4

Strings

Skip, xrefs: 00007FF8E6A57690

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Skip
API String ID: 715727267-1480915523
Opcode ID: 9058ef396169b30aefdc5e0416343158c28c4d19a2c9e8a540e1711c94387d69
Instruction ID: 9273060d0672e403c49574ff9bc49af3c8b55323140c32b4e07182dffbba8a84
Opcode Fuzzy Hash: 9058ef396169b30aefdc5e0416343158c28c4d19a2c9e8a540e1711c94387d69
Instruction Fuzzy Hash: A4F03A36F24A6282EB008F69F408259A3A0FB88B94F444532DF5C83718DF3CD445CB00

Function 00007FF8E6A45650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A45664
PyGILState_Release.PYTHON313 ref: 00007FF8E6A45694

Strings

Skip, xrefs: 00007FF8E6A45680

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Skip
API String ID: 715727267-1480915523
Opcode ID: 23a8da1d8b2f3b00a3b8504d90bc360abbef92d817d11d8ba64ddd25ffb291f9
Instruction ID: 9273060d0672e403c49574ff9bc49af3c8b55323140c32b4e07182dffbba8a84
Opcode Fuzzy Hash: 23a8da1d8b2f3b00a3b8504d90bc360abbef92d817d11d8ba64ddd25ffb291f9
Instruction Fuzzy Hash: A4F03A36F24A6282EB008F69F408259A3A0FB88B94F444532DF5C83718DF3CD445CB00

Function 00007FF8E6A477C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A477CD
PyGILState_Release.PYTHON313 ref: 00007FF8E6A477F5

Strings

Revert, xrefs: 00007FF8E6A477DE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Revert
API String ID: 715727267-3951012024
Opcode ID: 0c059b7f5a25823b82a075a3de6e9ed1c40efb00b4a1d2024a7ddf53db951d30
Instruction ID: d7e528438b0be166ac0f0719a8754f60651e61b81b825ee270bee8fa2da51d6c
Opcode Fuzzy Hash: 0c059b7f5a25823b82a075a3de6e9ed1c40efb00b4a1d2024a7ddf53db951d30
Instruction Fuzzy Hash: 04E09223F2465282EB005BB9F499B1C63A0FB9CBC8F455030DE1947614DD3CD4488700

Function 00007FF8E6A60850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A6085D
PyGILState_Release.PYTHON313 ref: 00007FF8E6A60885

Strings

IsDirty, xrefs: 00007FF8E6A6086E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: IsDirty
API String ID: 715727267-535502831
Opcode ID: 8c3f088fd76946eb6851e874c7616a4dfcdb5d71400ce54d42518e4a758c38af
Instruction ID: 5efe80d99243c96e591607b19f1c8c6f9739eed6f0049f5c92007eb3a6bb97cc
Opcode Fuzzy Hash: 8c3f088fd76946eb6851e874c7616a4dfcdb5d71400ce54d42518e4a758c38af
Instruction Fuzzy Hash: 2DE09A23F24A4282EB009BB5F489A2C63A0FB8CBE4F856030DB1987614DE3CD8898700

Function 00007FF8E6A5A510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5A51D
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5A545

Strings

Reset, xrefs: 00007FF8E6A5A52E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Reset
API String ID: 715727267-2438762569
Opcode ID: 3faca6b4bd5b1f2735f0105c045a1eb13038efbeb16938a701c7526414eec165
Instruction ID: 7279207ec59db473e326f052c7d95c7b12746bc92044160876011922f0989c68
Opcode Fuzzy Hash: 3faca6b4bd5b1f2735f0105c045a1eb13038efbeb16938a701c7526414eec165
Instruction Fuzzy Hash: 53E09223F2465282EB005BB9F489B1C63A0FB9CBD4F455030DF1947614DD3CD4488700

Function 00007FF8E6A456B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A456BD
PyGILState_Release.PYTHON313 ref: 00007FF8E6A456E5

Strings

Reset, xrefs: 00007FF8E6A456CE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Reset
API String ID: 715727267-2438762569
Opcode ID: 5cee90ab110b5e07b6c80498cc72ba4e2ac07fbdb28b4067ae0b2f62934e850e
Instruction ID: 7279207ec59db473e326f052c7d95c7b12746bc92044160876011922f0989c68
Opcode Fuzzy Hash: 5cee90ab110b5e07b6c80498cc72ba4e2ac07fbdb28b4067ae0b2f62934e850e
Instruction Fuzzy Hash: 53E09223F2465282EB005BB9F489B1C63A0FB9CBD4F455030DF1947614DD3CD4488700

Function 00007FF8E6A5D6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A5D6BD
PyGILState_Release.PYTHON313 ref: 00007FF8E6A5D6E9

Strings

Flush, xrefs: 00007FF8E6A5D6D5

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Flush
API String ID: 715727267-1965063083
Opcode ID: cf7489b0eaff020e9fcffe4ee9769259bd0fd40b46cdb2390cc99efb6aef9740
Instruction ID: 00076777b7097d020a2007904255d65a3eec0b58d199897952dab36c6cfd6b29
Opcode Fuzzy Hash: cf7489b0eaff020e9fcffe4ee9769259bd0fd40b46cdb2390cc99efb6aef9740
Instruction Fuzzy Hash: B2E06D22F24A16C2EB009BB9F4496686360FB48B94F444031DE1947214DE3CD449C700

Function 00007FF8E6A576C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A576CD
PyGILState_Release.PYTHON313 ref: 00007FF8E6A576F5

Strings

Reset, xrefs: 00007FF8E6A576DE

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: Reset
API String ID: 715727267-2438762569
Opcode ID: d44d15d4b8bfa292cd50c8703d5194dc040c4334107febb975d7957cea8f9b22
Instruction ID: 7279207ec59db473e326f052c7d95c7b12746bc92044160876011922f0989c68
Opcode Fuzzy Hash: d44d15d4b8bfa292cd50c8703d5194dc040c4334107febb975d7957cea8f9b22
Instruction Fuzzy Hash: 53E09223F2465282EB005BB9F489B1C63A0FB9CBD4F455030DF1947614DD3CD4488700

Function 00007FF8E6A46670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON313 ref: 00007FF8E6A4667D
PyGILState_Release.PYTHON313 ref: 00007FF8E6A466A5

Strings

HandsOffStorage, xrefs: 00007FF8E6A4668E

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: State_$EnsureRelease
String ID: HandsOffStorage
API String ID: 715727267-722837440
Opcode ID: 613ed996d0a544814b13cec0af9d3618824f7f3c8065a6c53501b073da32086e
Instruction ID: e08e3d2e77d01a019e6c05316892fd6ed9bb670c4d483b2fbc4b393a8b51a6ae
Opcode Fuzzy Hash: 613ed996d0a544814b13cec0af9d3618824f7f3c8065a6c53501b073da32086e
Instruction Fuzzy Hash: 6FE09A23F24A4282EB009BB5F489A2C63A0FB8CBE4F856030DB1987614DE3CD8898700

Function 00007FF8E6A78560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON313 ref: 00007FF8E6A78573
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FF8E6A7858E

Strings

L:strL64, xrefs: 00007FF8E6A7856C

Memory Dump Source

Source File: 00000002.00000002.2626192871.00007FF8E6A21000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E6A20000, based on PE: true

Associated: 00000002.00000002.2626143093.00007FF8E6A20000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626263035.00007FF8E6A7E000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626325301.00007FF8E6AB1000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626371201.00007FF8E6ABC000.00000008.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626419666.00007FF8E6ABD000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.2626467633.00007FF8E6AC6000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6a20000_user.jbxd

Similarity

API ID: Arg_Bytes_FromParseSizeStringTuple
String ID: L:strL64
API String ID: 4252258149-2264511172
Opcode ID: 8e23a64006ad3b0771e25865773678a12317a5b2e98ed9c61afcfdade862c04a
Instruction ID: 714a1ec6a1431816d02085647b7228fd398a7a030daf667ff2a51edc476b93c1
Opcode Fuzzy Hash: 8e23a64006ad3b0771e25865773678a12317a5b2e98ed9c61afcfdade862c04a
Instruction Fuzzy Hash: E2D05E10F29443C2FA449BA1EC823A933A1FF85795FD44432CA1D86554DE2CEA9AC741

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report user.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\mfc140u.dll

C:\Users\user\AppData\Local\Temp\_MEI75642\Pythonwin\win32ui.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI75642\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI75642\_brotli.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_cffi_backend.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\_wmi.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI75642\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI75642\cryptography-43.0.3.dist-info\INSTALLER

Windows Analysis Report
user.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre