Edit tour

Windows Analysis Report
builded.exe

Overview

General Information

Sample name:	builded.exe
Analysis ID:	1591683
MD5:	16a4f448219d7e20a80612d03a0a0f5c
SHA1:	4e86a64e2d2df2b6303cc0bcfae8d2feab157e03
SHA256:	c897f350c048329e77eae707fcf6ee75a6a18d75068927005ee1e8450009b394
Tags:	exepythonuser-zhuzhu0009
Infos:

Detection

Python Stealer, CStealer

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected CStealer

AI detected suspicious sample

Potentially malicious time measurement code found

Yara detected Generic Python Stealer

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

builded.exe (PID: 4744 cmdline: "C:\Users\user\Desktop\builded.exe" MD5: 16A4F448219D7E20A80612D03A0A0F5C)

builded.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\builded.exe" MD5: 16A4F448219D7E20A80612D03A0A0F5C)

cmd.exe (PID: 2924 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DynamicStealer	Dynamic Stealer is a Github Project C# written code by L1ghtN4n. This code collects passwords and uploads these to Telegram. According to Cyble this Eternity Stealer leverages code from this project and also Jester Stealer could be rebranded from it.	No Attribution	https://blog.cyble.com/2022/05/12/a-closer-look-at-eternity-malware/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dynamicstealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CStealer	Yara detected CStealer	Joe Security
Process Memory Space: builded.exe PID: 6496	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: builded.exe PID: 6496	JoeSecurity_CStealer	Yara detected CStealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://discord.gift/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: builded.exe

Virustotal: Detection: 43%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 93.3% probability

Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6199720 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FF8B6199720
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BB720 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8B61BB720
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A3730 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FF8B61A3730
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61720F9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	2_2_00007FF8B61720F9
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B7760 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61B7760
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171E10 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6171E10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61710FF CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FF8B61710FF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171DCA CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	2_2_00007FF8B6171DCA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6191790 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6191790
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61717BD OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_memcmp,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	2_2_00007FF8B61717BD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61716F4 CRYPTO_malloc,CRYPTO_THREAD_lock_new,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FF8B61716F4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7860 CRYPTO_free,	2_2_00007FF8B61A7860
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BD840 CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61BD840
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617205E EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8B617205E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617176C CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	2_2_00007FF8B617176C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61AF8F0 CRYPTO_realloc,	2_2_00007FF8B61AF8F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C7530 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,EVP_PKEY_id,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FF8B61C7530
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171163 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171163
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61795F0 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8B61795F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C1620 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8B61C1620
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171235 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8B6171235
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61713B6 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61713B6
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6195327 CRYPTO_memdup,ERR_put_error,	2_2_00007FF8B6195327
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A3360 CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	2_2_00007FF8B61A3360
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172293 CRYPTO_memdup,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6172293
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BB350 CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8B61BB350
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617192E CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B617192E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171073 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FF8B6171073
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7460 CRYPTO_free,	2_2_00007FF8B61A7460
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171461 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6171461
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617160E CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8B617160E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6199490 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8B6199490
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171433 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B6171433
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171C94 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	2_2_00007FF8B6171C94
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A74D0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8B61A74D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61874D0 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,	2_2_00007FF8B61874D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171114 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8B6171114
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61791B0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61791B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172284 EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	2_2_00007FF8B6172284
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61714B5 ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FF8B61714B5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61719EC CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61719EC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171FFF memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,_time64,	2_2_00007FF8B6171FFF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171A87 memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171A87
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617194C ERR_put_error,ASN1_item_free,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FF8B617194C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617201D EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	2_2_00007FF8B617201D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61716F9 CRYPTO_free,	2_2_00007FF8B61716F9
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171FB9 CRYPTO_free,	2_2_00007FF8B6171FB9
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6187F60 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6187F60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61CBF40 CRYPTO_memcmp,	2_2_00007FF8B61CBF40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171523 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8B6171523
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617DFE0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8B617DFE0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618DFC0 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8B618DFC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618C030 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	2_2_00007FF8B618C030
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617228E CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B617228E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171956 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	2_2_00007FF8B6171956
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61D0050 EVP_PKEY_get0_RSA,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	2_2_00007FF8B61D0050
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6174094 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FF8B6174094
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61860D8 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B61860D8
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C3D30 CRYPTO_malloc,memcpy,	2_2_00007FF8B61C3D30
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61716D1 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8B61716D1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6193D00 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6193D00
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61713FC EVP_MD_CTX_new,CRYPTO_memcmp,memcpy,memcpy,	2_2_00007FF8B61713FC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61CFD40 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	2_2_00007FF8B61CFD40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61711B3 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8B61711B3
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171C8A CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6171C8A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C1D90 CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61C1D90
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172216 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6172216
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6189DF0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B6189DF0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61711EA CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	2_2_00007FF8B61711EA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617DE20 CRYPTO_free,	2_2_00007FF8B617DE20
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6179E30 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6179E30
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171FF0 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6171FF0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172522 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6172522
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618FE40 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FF8B618FE40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617258B CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B617258B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61720B3 CRYPTO_free,CRYPTO_malloc,memcpy,	2_2_00007FF8B61720B3
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7EE0 CRYPTO_free,	2_2_00007FF8B61A7EE0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618DED0 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8B618DED0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617DED0 CRYPTO_free,	2_2_00007FF8B617DED0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61AFB20 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61AFB20
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172185 CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6172185
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6187B60 CRYPTO_zalloc,	2_2_00007FF8B6187B60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171122 CRYPTO_free,	2_2_00007FF8B6171122
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618FBE0 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8B618FBE0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172220 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6172220
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7BD0 CRYPTO_free,	2_2_00007FF8B61A7BD0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171974 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6171974
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61710F5 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	2_2_00007FF8B61710F5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A3C30 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8B61A3C30
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171348 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8B6171348
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617102D CRYPTO_malloc,COMP_expand_block,	2_2_00007FF8B617102D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7C40 CRYPTO_free,	2_2_00007FF8B61A7C40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61CDCA0 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61CDCA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6185C90 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FF8B6185C90
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61714FB EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8B61714FB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61718DE CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8B61718DE
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171A64 CRYPTO_free,	2_2_00007FF8B6171A64
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617129E CRYPTO_THREAD_run_once,	2_2_00007FF8B617129E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6195987 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8B6195987
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C1990 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61C1990
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171438 ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171438
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A79E0 CRYPTO_free,	2_2_00007FF8B61A79E0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B79F0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B61B79F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61979D0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8B61979D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6177A20 CRYPTO_free,	2_2_00007FF8B6177A20
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B619FA70 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8B619FA70
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61723BA CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61723BA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BBAA0 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B61BBAA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A7A80 CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61A7A80
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C8720 CRYPTO_memcmp,	2_2_00007FF8B61C8720
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617101E CRYPTO_free,CRYPTO_free,	2_2_00007FF8B617101E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A4820 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8B61A4820
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C2820 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FF8B61C2820
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171195 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171195
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61AA8B0 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8B61AA8B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617214E CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8B617214E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171924 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6171924
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B08D0 CRYPTO_memcmp,	2_2_00007FF8B61B08D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171BC7 CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8B6171BC7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61D0570 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B61D0570
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171762 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8B6171762
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B85D7 CRYPTO_clear_free,	2_2_00007FF8B61B85D7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B0620 CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61B0620
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171C03 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FF8B6171C03
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617135C memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	2_2_00007FF8B617135C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171FCD CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171FCD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171AC3 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8B6171AC3
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61AA690 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61AA690
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6174690 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FF8B6174690
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172225 CRYPTO_free,	2_2_00007FF8B6172225
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171BDB EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B6171BDB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171E79 CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8B6171E79
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172365 CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	2_2_00007FF8B6172365
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61715C8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8B61715C8
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B0350 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61B0350
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171F32 CRYPTO_free,CRYPTO_malloc,RAND_bytes,	2_2_00007FF8B6171F32
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61783E0 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8B61783E0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61AA3F0 CRYPTO_memcmp,	2_2_00007FF8B61AA3F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171DBB BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8B6171DBB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6192410 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8B6192410
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C0460 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B61C0460
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6174473 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FF8B6174473
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61722C0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8B61722C0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617240F CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	2_2_00007FF8B617240F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171F0F CRYPTO_free,	2_2_00007FF8B6171F0F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6178490 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	2_2_00007FF8B6178490
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61719FB CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8B61719FB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171131 CRYPTO_free,	2_2_00007FF8B6171131
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6188200 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8B6188200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618E200 CRYPTO_THREAD_run_once,	2_2_00007FF8B618E200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171DCF CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	2_2_00007FF8B6171DCF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617E200 CRYPTO_malloc,	2_2_00007FF8B617E200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6186210 CRYPTO_free,	2_2_00007FF8B6186210
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6196270 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FF8B6196270
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61D8240 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	2_2_00007FF8B61D8240
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61721BC CRYPTO_free,_time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,	2_2_00007FF8B61721BC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171B7C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8B6171B7C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171CB7 CRYPTO_clear_free,	2_2_00007FF8B6171CB7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B8F1A CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61B8F1A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617254F BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FF8B617254F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BAF10 CRYPTO_malloc,EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FF8B61BAF10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171802 CRYPTO_strdup,	2_2_00007FF8B6171802
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171A4B OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	2_2_00007FF8B6171A4B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C8FB0 CRYPTO_malloc,EVP_CIPHER_CTX_new,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_iv_length,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	2_2_00007FF8B61C8FB0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171A05 CRYPTO_zalloc,memcpy,memcpy,memcpy,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B6171A05
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171069 CRYPTO_free,	2_2_00007FF8B6171069
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C3020 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FF8B61C3020
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172383 CRYPTO_malloc,	2_2_00007FF8B6172383
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617177B EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,_time64,EVP_MD_CTX_free,EVP_PKEY_free,EVP_MD_CTX_free,EVP_PKEY_free,	2_2_00007FF8B617177B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171047 EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8B6171047
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61DD0B0 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FF8B61DD0B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171398 EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_security_bits,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8B6171398
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617115E OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8B617115E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618CD10 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B618CD10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617163B CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8B617163B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61CAD6C CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61CAD6C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172207 ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	2_2_00007FF8B6172207
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BAD40 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8B61BAD40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61DCDA0 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FF8B61DCDA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B0DE0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B61B0DE0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B619CDC0 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,	2_2_00007FF8B619CDC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6186DD7 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6186DD7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171078 CRYPTO_free,	2_2_00007FF8B6171078
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171410 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	2_2_00007FF8B6171410
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172306 CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B6172306
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171E24 CRYPTO_malloc,	2_2_00007FF8B6171E24
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6186EA3 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8B6186EA3
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617AEA0 CRYPTO_free,	2_2_00007FF8B617AEA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61724F5 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8B61724F5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B619CB10 CRYPTO_free,CRYPTO_free,	2_2_00007FF8B619CB10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B8BAF CRYPTO_malloc,	2_2_00007FF8B61B8BAF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172478 CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	2_2_00007FF8B6172478
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61B0BF0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61B0BF0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B619CC00 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8B619CC00
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A8C60 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8B61A8C60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61A4C70 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	2_2_00007FF8B61A4C70
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171983 CRYPTO_free,CRYPTO_memdup,memcmp,CRYPTO_memdup,	2_2_00007FF8B6171983
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618CCB0 CRYPTO_get_ex_new_index,	2_2_00007FF8B618CCB0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617189D CRYPTO_malloc,ERR_put_error,	2_2_00007FF8B617189D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61BCCF0 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8B61BCCF0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C8CF0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8B61C8CF0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617ECC0 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	2_2_00007FF8B617ECC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171393 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	2_2_00007FF8B6171393
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B618C910 OPENSSL_sk_num,X509_STORE_CTX_new,ERR_put_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_put_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_put_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	2_2_00007FF8B618C910
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B619C970 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8B619C970
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6178970 CRYPTO_free,	2_2_00007FF8B6178970
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171D9D CRYPTO_THREAD_run_once,	2_2_00007FF8B6171D9D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617132A CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	2_2_00007FF8B617132A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171D5C CRYPTO_clear_free,	2_2_00007FF8B6171D5C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172464 CRYPTO_malloc,memcpy,	2_2_00007FF8B6172464
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61C8AD0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8B61C8AD0

Source: builded.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239535513.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: builded.exe, 00000002.00000002.2241677084.00007FF8BA4F3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: builded.exe, 00000002.00000002.2238568534.00007FF8B7EE0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: win32trace.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:34:57 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: builded.exe, 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: builded.exe, 00000002.00000002.2236120388.00007FF8A8C8D000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: builded.exe, 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2240440862.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb?? source: builded.exe, 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: builded.exe, 00000002.00000002.2237933900.00007FF8B7E7C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_multiprocessing.pdb source: builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: builded.exe, 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2240269822.00007FF8B8F73000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: builded.exe, 00000000.00000003.2103560501.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2241376133.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: builded.exe, 00000002.00000002.2237475467.00007FF8B78AD000.00000002.00000001.01000000.00000015.sdmp, _ssl.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: builded.exe, 00000002.00000002.2238568534.00007FF8B7EE0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2238907267.00007FF8B8167000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239535513.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: builded.exe, 00000002.00000002.2240927502.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: builded.exe, 00000002.00000002.2237933900.00007FF8B7E7C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: builded.exe, 00000002.00000002.2237715116.00007FF8B7E03000.00000002.00000001.01000000.00000011.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\pyexpat.pdb source: builded.exe, 00000002.00000002.2239115051.00007FF8B81A2000.00000002.00000001.01000000.0000000D.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: builded.exe, 00000002.00000002.2237715116.00007FF8B7E03000.00000002.00000001.01000000.00000011.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239338420.00007FF8B8B08000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: builded.exe, 00000002.00000002.2225363341.0000019401CA0000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: builded.exe, 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: builded.exe, 00000000.00000003.2103717117.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2241122443.00007FF8B9845000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdbOO source: win32ui.pyd.0.dr

Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B283B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7A3B283B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B292F0 FindFirstFileExW,FindClose,	0_2_00007FF7A3B292F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B418E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B292F0 FindFirstFileExW,FindClose,	2_2_00007FF7A3B292F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B283B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7A3B283B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B418E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FF8A8613229

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: webhook.my

Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: builded.exe, 00000002.00000003.2215367100.0000019402E60000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215532950.0000019402E62000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402E63000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216494704.0000019402E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: builded.exe, 00000002.00000002.2230273469.0000019402FCD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FC9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213333916.0000019402FCA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212600609.0000019402FC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2232296527.000001940362E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: builded.exe, 00000002.00000003.2217437739.0000019400229000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2224875265.0000019400229000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2228911914.0000019402E02000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215574688.0000019402E00000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E01000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: builded.exe, 00000002.00000002.2229154751.0000019402EB6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207908188.000001940261E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208050372.0000019402622000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213196538.0000019402630000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208381063.000001940262F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: builded.exe, 00000002.00000002.2230273469.0000019402FCD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FC9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213333916.0000019402FCA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212600609.0000019402FC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: builded.exe, 00000002.00000002.2232296527.000001940362E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: builded.exe, 00000002.00000003.2213289393.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: builded.exe, 00000002.00000003.2211909452.0000019402EFC000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: builded.exe, 00000002.00000003.2213289393.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlB
Source: builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: builded.exe, 00000002.00000003.2211909452.0000019402EFC000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlRLopener._
Source: builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2228911914.0000019402E02000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215574688.0000019402E00000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E01000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207209080.0000019402C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: builded.exe, 00000002.00000002.2231186387.0000019403410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: builded.exe, 00000002.00000003.2214385703.00000194025F5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134754188.0000019402431000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134602070.0000019402C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/pprint.html#pprint.pprint
Source: builded.exe, 00000002.00000002.2230415130.0000019402FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/ActiveState/appdirs
Source: builded.exe, 00000002.00000002.2229060934.0000019402E5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: builded.exe, 00000002.00000003.2215333433.0000019402DF0000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402DF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216717503.0000019402DF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: builded.exe, 00000002.00000003.2206561494.0000019402D13000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D35000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: builded.exe, 00000002.00000003.2207966068.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212632731.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: METADATA0.0.dr	String found in binary or memory: http://mail.python.org/pipermail/distutils-sig/
Source: builded.exe, 00000002.00000003.2212914415.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229610004.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: builded.exe, 00000002.00000003.2133566440.0000019402612000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227161670.00000194028E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227038840.00000194027E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: builded.exe, 00000002.00000003.2134602070.0000019402C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyparsing.wikispaces.com
Source: builded.exe, 00000002.00000002.2229468058.0000019402F4D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207966068.0000019402CAA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217831700.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2228137811.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: builded.exe, 00000002.00000002.2229154751.0000019402EB6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/JJ
Source: builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/O
Source: builded.exe, 00000002.00000002.2230415130.0000019402FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/19622133/
Source: builded.exe, 00000002.00000003.2206179860.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208530618.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2210176314.000001940272B000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209550869.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2135757851.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226850582.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134602070.0000019402BE1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2219246007.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211585629.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209398619.0000019402427000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214428837.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134602070.0000019402C20000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular-
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: builded.exe, 00000002.00000003.2212914415.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229610004.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: builded.exe, 00000002.00000003.2212729494.0000019402F08000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211909452.0000019402EFC000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211941468.0000019402F05000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: builded.exe, 00000002.00000003.2208530618.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2210176314.000001940272B000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209550869.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226850582.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2219246007.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211585629.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214428837.000001940272C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: builded.exe, 00000002.00000003.2208530618.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2210176314.000001940272B000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209550869.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226850582.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2219246007.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211585629.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214428837.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: builded.exe, 00000002.00000002.2227277816.00000194029E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2133566440.0000019402612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: builded.exe, 00000002.00000003.2212914415.0000019402FA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FAA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213635058.0000019402FC2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2230166628.0000019402FC3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213076566.0000019402FB5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr, _multiprocessing.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: builded.exe, 00000002.00000003.2212842134.0000019403630000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215367100.0000019402E60000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2232408060.0000019403636000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213549647.0000019403634000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215532950.0000019402E62000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402E63000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216494704.0000019402E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: builded.exe, 00000002.00000003.2206561494.0000019402D13000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D35000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: builded.exe, 00000002.00000002.2229248948.0000019402EF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213351253.0000019402EC6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213384788.0000019402EF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212259966.0000019402EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: builded.exe, 00000002.00000002.2229154751.0000019402EB6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402DFF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)
Source: METADATA0.0.dr	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: _cffi_backend.cp310-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://checkip.amazonaws.com
Source: METADATA0.0.dr	String found in binary or memory: https://codecov.io/gh/pypa/setuptools
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com)
Source: builded.exe, 00000002.00000003.2211585629.0000019402725000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229178571.0000019402EBD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209550869.0000019402717000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208530618.0000019402716000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209118349.0000019402716000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.0000019402716000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214544629.0000019402EBB000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216424480.0000019402EBD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212259966.0000019402EBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/fernet/spec/blob/master/Spec.md
Source: builded.exe, builded.exe, 00000002.00000002.2238727022.00007FF8B7EF1000.00000002.00000001.01000000.0000000E.sdmp, builded.exe, 00000002.00000002.2238321712.00007FF8B7EC4000.00000002.00000001.01000000.00000010.sdmp, builded.exe, 00000002.00000002.2237787891.00007FF8B7E11000.00000002.00000001.01000000.00000011.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.dr	String found in binary or memory: https://github.com/mhammond/pywin32
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/psf/black
Source: builded.exe, 00000002.00000003.2205771887.0000019402C87000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212632731.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213674713.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207966068.0000019402CAA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217831700.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2228137811.0000019402CB1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2231420988.0000019403578000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packagingabout__.pyc
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packagingut__.pyc
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/setuptools
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/setuptools/issues
Source: builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: builded.exe, 00000002.00000002.2227038840.00000194027E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: METADATA0.0.dr	String found in binary or memory: https://github.com/pypa/setuptools/workflows/tests/badge.svg
Source: builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: builded.exe, 00000002.00000003.2208346038.000001940261F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218859946.00000194026C3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215067262.00000194026C1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211145578.0000019402621000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.0000019402676000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134984384.000001940261E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207908188.000001940261E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208530618.00000194026C0000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206896459.00000194026A3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208976139.0000019402620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/mypy/issues/3216
Source: builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: builded.exe, 00000002.00000003.2212400705.0000019402CF6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216233925.0000019402CF7000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216380371.0000019402CF9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207966068.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: builded.exe, 00000002.00000002.2230984159.000001940332C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)
Source: builded.exe, 00000002.00000003.2206179860.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214297997.000001940242C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214492268.0000019402E17000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209398619.0000019402427000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E1C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214664979.0000019402E8D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214492268.0000019402E17000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E1C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hbo.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)
Source: builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2228977379.0000019402E1D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214492268.0000019402E17000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E1C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216063450.00000194024BD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214544629.0000019402EBB000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216797852.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209977476.0000019402448000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215942281.000001940243A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209398619.0000019402427000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213528235.0000019402F90000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225882200.0000019402430000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208226087.0000019402435000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212259966.0000019402EBA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211470147.00000194024A9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217098110.00000194024CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: builded.exe, 00000002.00000002.2228484048.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206561494.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/badge/code%20style-black-000000.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/badge/skeleton-2021-informational
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/pyversions/setuptools.svg
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/setuptools.svg
Source: METADATA0.0.dr	String found in binary or memory: https://img.shields.io/readthedocs/setuptools/latest.svg
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)
Source: builded.exe, 00000002.00000003.2214664979.0000019402E90000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402E8E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402E91000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://media.discordapp.net/attachments/1111364024408494140/1111364181032177766/cs.png
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)
Source: METADATA0.0.dr	String found in binary or memory: https://packaging.python.org/installing/
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: METADATA0.0.dr	String found in binary or memory: https://pypi.org/project/setuptools
Source: builded.exe, 00000002.00000002.2236120388.00007FF8A8C8D000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: builded.exe, 00000002.00000002.2228484048.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2231186387.00000194034DC000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206561494.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: builded.exe, 00000002.00000002.2231186387.00000194034DC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.iopxN
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)
Source: METADATA0.0.dr	String found in binary or memory: https://setuptools.readthedocs.io
Source: METADATA0.0.dr	String found in binary or memory: https://setuptools.readthedocs.io/
Source: builded.exe, 00000002.00000003.2211800866.00000194024A9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206688703.00000194024A6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2133161590.0000019402723000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2132134180.0000019402723000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209280264.00000194024A7000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206179860.000001940245A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2219786821.00000194024A9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2132507450.00000194026D3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2132367491.00000194026CC000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2132507450.0000019402723000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2135643249.000001940245A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134754188.0000019402431000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226132483.00000194024A9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211470147.00000194024A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-access
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stake.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/badges/github/pypa/setuptools?style=flat
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/security
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme
Source: METADATA0.0.dr	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)
Source: builded.exe, 00000002.00000003.2211361574.0000019402C82000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206070893.0000019402C7A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213674713.0000019402C82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)
Source: builded.exe, 00000002.00000003.2206179860.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214297997.000001940242C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209398619.0000019402427000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214664979.0000019402E8D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)
Source: builded.exe, 00000002.00000002.2227161670.00000194028E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2230415130.0000019402FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies
Source: builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxiesI
Source: builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: builded.exe, 00000002.00000002.2231420988.0000019403598000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212291501.0000019402D6F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2210331897.0000019402D6E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217411194.0000019402D6F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206561494.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webhook.my/1.txt
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.my/hi.txt
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.my/post?uniqueid=2eac2fc1
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.my/uploads
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webhook.my/words.txt
Source: builded.exe, 00000002.00000003.2215429838.0000019400253000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216156282.0000019400254000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105218033.000002E54ACBF000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, pyexpat.pyd.0.dr, _ctypes.pyd.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: builded.exe, 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmp, builded.exe, 00000002.00000002.2235276694.00007FF8A8954000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: builded.exe, 00000002.00000002.2228484048.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206561494.0000019402D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: builded.exe, 00000002.00000003.2214664979.0000019402E90000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402E8E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402E91000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: builded.exe, 00000000.00000003.2107935191.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227038840.00000194027E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: builded.exe, 00000002.00000003.2215367100.0000019402E60000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216494704.0000019402E61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: builded.exe, 00000002.00000003.2212914415.0000019402F98000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: builded.exe, 00000002.00000002.2230273469.0000019402FCD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FC9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213333916.0000019402FCA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212600609.0000019402FC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2232296527.000001940362E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)
Source: builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214492268.0000019402E17000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E1C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B45C70	0_2_00007FF7A3B45C70
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B28BD0	0_2_00007FF7A3B28BD0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B469D4	0_2_00007FF7A3B469D4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B40938	0_2_00007FF7A3B40938
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B21000	0_2_00007FF7A3B21000
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2A4E4	0_2_00007FF7A3B2A4E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B43C80	0_2_00007FF7A3B43C80
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B32C80	0_2_00007FF7A3B32C80
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B46488	0_2_00007FF7A3B46488
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B40938	0_2_00007FF7A3B40938
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B31BC0	0_2_00007FF7A3B31BC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2A34B	0_2_00007FF7A3B2A34B
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B3DACC	0_2_00007FF7A3B3DACC
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B33A14	0_2_00007FF7A3B33A14
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B319B4	0_2_00007FF7A3B319B4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B321D4	0_2_00007FF7A3B321D4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B4411C	0_2_00007FF7A3B4411C
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B38154	0_2_00007FF7A3B38154
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B418E4	0_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B29870	0_2_00007FF7A3B29870
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B38804	0_2_00007FF7A3B38804
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B49798	0_2_00007FF7A3B49798
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B317B0	0_2_00007FF7A3B317B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B31FD0	0_2_00007FF7A3B31FD0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B3DF60	0_2_00007FF7A3B3DF60
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B45EEC	0_2_00007FF7A3B45EEC
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B39F10	0_2_00007FF7A3B39F10
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B3E5E0	0_2_00007FF7A3B3E5E0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B33610	0_2_00007FF7A3B33610
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B35DA0	0_2_00007FF7A3B35DA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B31DC4	0_2_00007FF7A3B31DC4
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2AD1D	0_2_00007FF7A3B2AD1D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2A34B	2_2_00007FF7A3B2A34B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B469D4	2_2_00007FF7A3B469D4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B21000	2_2_00007FF7A3B21000
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2A4E4	2_2_00007FF7A3B2A4E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B45C70	2_2_00007FF7A3B45C70
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B43C80	2_2_00007FF7A3B43C80
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B32C80	2_2_00007FF7A3B32C80
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B46488	2_2_00007FF7A3B46488
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B40938	2_2_00007FF7A3B40938
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B31BC0	2_2_00007FF7A3B31BC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B28BD0	2_2_00007FF7A3B28BD0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B3DACC	2_2_00007FF7A3B3DACC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B33A14	2_2_00007FF7A3B33A14
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B319B4	2_2_00007FF7A3B319B4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B321D4	2_2_00007FF7A3B321D4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B4411C	2_2_00007FF7A3B4411C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B40938	2_2_00007FF7A3B40938
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B38154	2_2_00007FF7A3B38154
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B418E4	2_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B29870	2_2_00007FF7A3B29870
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B38804	2_2_00007FF7A3B38804
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B49798	2_2_00007FF7A3B49798
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B317B0	2_2_00007FF7A3B317B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B31FD0	2_2_00007FF7A3B31FD0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B3DF60	2_2_00007FF7A3B3DF60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B45EEC	2_2_00007FF7A3B45EEC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B39F10	2_2_00007FF7A3B39F10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B3E5E0	2_2_00007FF7A3B3E5E0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B33610	2_2_00007FF7A3B33610
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B35DA0	2_2_00007FF7A3B35DA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B31DC4	2_2_00007FF7A3B31DC4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2AD1D	2_2_00007FF7A3B2AD1D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A84F12F0	2_2_00007FF8A84F12F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A84F18D0	2_2_00007FF8A84F18D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86123F1	2_2_00007FF8A86123F1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614E49	2_2_00007FF8A8614E49
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86122AC	2_2_00007FF8A86122AC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86111CC	2_2_00007FF8A86111CC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861275C	2_2_00007FF8A861275C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615D9E	2_2_00007FF8A8615D9E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616D57	2_2_00007FF8A8616D57
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A874AD50	2_2_00007FF8A874AD50
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86F2E70	2_2_00007FF8A86F2E70
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614CFF	2_2_00007FF8A8614CFF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86110AA	2_2_00007FF8A86110AA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611B22	2_2_00007FF8A8611B22
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862EF00	2_2_00007FF8A862EF00
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86172BB	2_2_00007FF8A86172BB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861213F	2_2_00007FF8A861213F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861144C	2_2_00007FF8A861144C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862F060	2_2_00007FF8A862F060
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8747020	2_2_00007FF8A8747020
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86143FE	2_2_00007FF8A86143FE
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611217	2_2_00007FF8A8611217
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87C6290	2_2_00007FF8A87C6290
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611B31	2_2_00007FF8A8611B31
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611424	2_2_00007FF8A8611424
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615E20	2_2_00007FF8A8615E20
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611A4B	2_2_00007FF8A8611A4B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8742670	2_2_00007FF8A8742670
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616FF5	2_2_00007FF8A8616FF5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861655A	2_2_00007FF8A861655A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614679	2_2_00007FF8A8614679
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87C7980	2_2_00007FF8A87C7980
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614F39	2_2_00007FF8A8614F39
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861216C	2_2_00007FF8A861216C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614160	2_2_00007FF8A8614160
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A867FA00	2_2_00007FF8A867FA00
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87AFA10	2_2_00007FF8A87AFA10
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A874FB40	2_2_00007FF8A874FB40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86150A6	2_2_00007FF8A86150A6
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861724D	2_2_00007FF8A861724D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862BD60	2_2_00007FF8A862BD60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612289	2_2_00007FF8A8612289
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612D0B	2_2_00007FF8A8612D0B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A873FE60	2_2_00007FF8A873FE60
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861266C	2_2_00007FF8A861266C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862BF20	2_2_00007FF8A862BF20
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86140FC	2_2_00007FF8A86140FC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614741	2_2_00007FF8A8614741
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861114F	2_2_00007FF8A861114F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86129CD	2_2_00007FF8A86129CD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87C71D0	2_2_00007FF8A87C71D0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861659B	2_2_00007FF8A861659B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86168C5	2_2_00007FF8A86168C5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862F200	2_2_00007FF8A862F200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616EEC	2_2_00007FF8A8616EEC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611EA1	2_2_00007FF8A8611EA1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615F0B	2_2_00007FF8A8615F0B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615164	2_2_00007FF8A8615164
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86153A3	2_2_00007FF8A86153A3
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A863B4C0	2_2_00007FF8A863B4C0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615D85	2_2_00007FF8A8615D85
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86154C5	2_2_00007FF8A86154C5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861542A	2_2_00007FF8A861542A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86115C8	2_2_00007FF8A86115C8
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861655F	2_2_00007FF8A861655F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86121B7	2_2_00007FF8A86121B7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A863B850	2_2_00007FF8A863B850
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861609B	2_2_00007FF8A861609B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8747800	2_2_00007FF8A8747800
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614C0F	2_2_00007FF8A8614C0F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861177B	2_2_00007FF8A861177B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614A4F	2_2_00007FF8A8614A4F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612D74	2_2_00007FF8A8612D74
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614B51	2_2_00007FF8A8614B51
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612FCC	2_2_00007FF8A8612FCC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87B0B50	2_2_00007FF8A87B0B50
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86126E9	2_2_00007FF8A86126E9
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86122FC	2_2_00007FF8A86122FC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616EBA	2_2_00007FF8A8616EBA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611140	2_2_00007FF8A8611140
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861592A	2_2_00007FF8A861592A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A873CFC0	2_2_00007FF8A873CFC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615B0A	2_2_00007FF8A8615B0A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861462E	2_2_00007FF8A861462E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861362F	2_2_00007FF8A861362F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613189	2_2_00007FF8A8613189
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611D89	2_2_00007FF8A8611D89
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612E8C	2_2_00007FF8A8612E8C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615B6E	2_2_00007FF8A8615B6E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861378D	2_2_00007FF8A861378D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614354	2_2_00007FF8A8614354
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86157CC	2_2_00007FF8A86157CC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613486	2_2_00007FF8A8613486
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862C480	2_2_00007FF8A862C480
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612C75	2_2_00007FF8A8612C75
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862C620	2_2_00007FF8A862C620
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86C06E0	2_2_00007FF8A86C06E0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86125EF	2_2_00007FF8A86125EF
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A873C620	2_2_00007FF8A873C620
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8617072	2_2_00007FF8A8617072
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615A5B	2_2_00007FF8A8615A5B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616C1C	2_2_00007FF8A8616C1C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86160D7	2_2_00007FF8A86160D7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86169E2	2_2_00007FF8A86169E2
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611CC1	2_2_00007FF8A8611CC1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86159F2	2_2_00007FF8A86159F2
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87C59F0	2_2_00007FF8A87C59F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8617040	2_2_00007FF8A8617040
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86153BC	2_2_00007FF8A86153BC
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613FD5	2_2_00007FF8A8613FD5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614AC0	2_2_00007FF8A8614AC0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A87B1A90	2_2_00007FF8A87B1A90
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A884DA80	2_2_00007FF8A884DA80
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616A82	2_2_00007FF8A8616A82
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8745B40	2_2_00007FF8A8745B40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86135FD	2_2_00007FF8A86135FD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613832	2_2_00007FF8A8613832
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611CFD	2_2_00007FF8A8611CFD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86130C1	2_2_00007FF8A86130C1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8617360	2_2_00007FF8A8617360
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613BA2	2_2_00007FF8A8613BA2
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613A85	2_2_00007FF8A8613A85
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612982	2_2_00007FF8A8612982
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8745E40	2_2_00007FF8A8745E40
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86132E7	2_2_00007FF8A86132E7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86172A2	2_2_00007FF8A86172A2
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611622	2_2_00007FF8A8611622
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614C32	2_2_00007FF8A8614C32
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612766	2_2_00007FF8A8612766
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613693	2_2_00007FF8A8613693
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A862D260	2_2_00007FF8A862D260
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8635200	2_2_00007FF8A8635200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8617103	2_2_00007FF8A8617103
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86144C1	2_2_00007FF8A86144C1
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616CB7	2_2_00007FF8A8616CB7
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861560A	2_2_00007FF8A861560A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615BEB	2_2_00007FF8A8615BEB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8614282	2_2_00007FF8A8614282
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615042	2_2_00007FF8A8615042
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861550B	2_2_00007FF8A861550B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613B93	2_2_00007FF8A8613B93
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613A8F	2_2_00007FF8A8613A8F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86122E8	2_2_00007FF8A86122E8
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8616F23	2_2_00007FF8A8616F23
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8611299	2_2_00007FF8A8611299
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8612135	2_2_00007FF8A8612135
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A86154CA	2_2_00007FF8A86154CA
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61713F2	2_2_00007FF8B61713F2
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61717BD	2_2_00007FF8B61717BD
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61D7860	2_2_00007FF8B61D7860
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617114F	2_2_00007FF8B617114F
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617F8E5	2_2_00007FF8B617F8E5
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171451	2_2_00007FF8B6171451
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617B360	2_2_00007FF8B617B360
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171C94	2_2_00007FF8B6171C94
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6181200	2_2_00007FF8B6181200
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171A87	2_2_00007FF8B6171A87
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171956	2_2_00007FF8B6171956
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61D0050	2_2_00007FF8B61D0050
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171997	2_2_00007FF8B6171997
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171BDB	2_2_00007FF8B6171BDB
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617256D	2_2_00007FF8B617256D
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61720AE	2_2_00007FF8B61720AE
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B61715B4	2_2_00007FF8B61715B4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171398	2_2_00007FF8B6171398
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617115E	2_2_00007FF8B617115E
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B617168B	2_2_00007FF8B617168B
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6171537	2_2_00007FF8B6171537
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6176B90	2_2_00007FF8B6176B90
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B7830820	2_2_00007FF8B7830820

Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8614836 appears 127 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8611EF1 appears 1589 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A86124B9 appears 84 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8612734 appears 509 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8B61DD465 appears 103 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8614D63 appears 35 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8B61DD3CF appears 218 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8616889 appears 31 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A861300D appears 55 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8B61712EE appears 582 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8B7823A10 appears 44 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8616988 appears 49 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8612A04 appears 170 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF7A3B22710 appears 104 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF8A8614052 appears 780 times
Source: C:\Users\user\Desktop\builded.exe	Code function: String function: 00007FF7A3B22910 appears 34 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: builded.exe, 00000000.00000003.2106192195.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2103235642.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32ui.pyd0 vs builded.exe
Source: builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2103717117.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs builded.exe
Source: builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2104248782.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2104595503.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2103560501.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs builded.exe
Source: builded.exe, 00000000.00000003.2106584149.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs builded.exe
Source: builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs builded.exe
Source: builded.exe	Binary or memory string: OriginalFilename vs builded.exe
Source: builded.exe, 00000002.00000002.2238727022.00007FF8B7EF1000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamepywintypes310.dll0 vs builded.exe
Source: builded.exe, 00000002.00000002.2239420763.00007FF8B8B12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2241791405.00007FF8BA4F6000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilenamelibsslH vs builded.exe
Source: builded.exe, 00000002.00000002.2240331816.00007FF8B8F76000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2239203399.00007FF8B81AD000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2241493635.00007FF8BA257000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs builded.exe
Source: builded.exe, 00000002.00000002.2236878518.00007FF8A8DA7000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs builded.exe
Source: builded.exe, 00000002.00000002.2240736232.00007FF8B8F92000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2237611031.00007FF8B78C5000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2235276694.00007FF8A8954000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs builded.exe
Source: builded.exe, 00000002.00000002.2241194295.00007FF8B9849000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs builded.exe
Source: builded.exe, 00000002.00000002.2238990080.00007FF8B816E000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2241000646.00007FF8B93DB000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2225363341.0000019401CA0000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs builded.exe
Source: builded.exe, 00000002.00000002.2238321712.00007FF8B7EC4000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamepythoncom310.dll0 vs builded.exe
Source: builded.exe, 00000002.00000002.2239663426.00007FF8B8B44000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs builded.exe
Source: builded.exe, 00000002.00000002.2237787891.00007FF8B7E11000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs builded.exe

Source: classification engine

Classification label: mal76.troj.evad.winEXE@6/92@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6576:120:WilError_03

Source: C:\Users\user\Desktop\builded.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI47442

Jump to behavior

Source: builded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\builded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: SELECT action_url, username_value, password_value FROM logins;

Source: builded.exe

Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\builded.exe

File read: C:\Users\user\Desktop\builded.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\builded.exe "C:\Users\user\Desktop\builded.exe"
Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Users\user\Desktop\builded.exe "C:\Users\user\Desktop\builded.exe"
Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Users\user\Desktop\builded.exe "C:\Users\user\Desktop\builded.exe"	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Users\user\Desktop\builded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\builded.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: builded.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: builded.exe

Static file information: File size 17318617 > 1048576

Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: builded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: builded.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: builded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbMM source: builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239535513.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\select.pdb source: builded.exe, 00000002.00000002.2241677084.00007FF8BA4F3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb** source: builded.exe, 00000002.00000002.2238568534.00007FF8B7EE0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: builded.exe, 00000000.00000003.2107586824.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, _uuid.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdb source: win32ui.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32trace.pdb source: win32trace.pyd.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1l 24 Aug 2021built on: Thu Aug 26 18:34:57 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: builded.exe, 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: builded.exe, 00000002.00000002.2236120388.00007FF8A8C8D000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: builded.exe, 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2240440862.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb?? source: builded.exe, 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb source: builded.exe, 00000002.00000002.2237933900.00007FF8B7E7C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_multiprocessing.pdb source: builded.exe, 00000000.00000003.2105218033.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: builded.exe, 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: builded.exe, 00000000.00000003.2105389899.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2240269822.00007FF8B8F73000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: builded.exe, 00000000.00000003.2103560501.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2241376133.00007FF8BA251000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: builded.exe, 00000002.00000002.2237475467.00007FF8B78AD000.00000002.00000001.01000000.00000015.sdmp, _ssl.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pywintypes.pdb source: builded.exe, 00000002.00000002.2238568534.00007FF8B7EE0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: builded.exe, 00000000.00000003.2104902081.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2238907267.00007FF8B8167000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: builded.exe, 00000000.00000003.2105042231.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239535513.00007FF8B8B3B000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: builded.exe, 00000002.00000002.2240927502.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\pythoncom.pdb}},GCTL source: builded.exe, 00000002.00000002.2237933900.00007FF8B7E7C000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb source: builded.exe, 00000002.00000002.2237715116.00007FF8B7E03000.00000002.00000001.01000000.00000011.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\pyexpat.pdb source: builded.exe, 00000002.00000002.2239115051.00007FF8B81A2000.00000002.00000001.01000000.0000000D.sdmp, pyexpat.pyd.0.dr
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32api.pdb!! source: builded.exe, 00000002.00000002.2237715116.00007FF8B7E03000.00000002.00000001.01000000.00000011.sdmp, win32api.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: builded.exe, 00000000.00000003.2105505879.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2239338420.00007FF8B8B08000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: builded.exe, 00000002.00000002.2225363341.0000019401CA0000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: builded.exe, 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: builded.exe, 00000000.00000003.2103717117.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2241122443.00007FF8B9845000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-310\Release\win32ui.pdbOO source: win32ui.pyd.0.dr

Source: builded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: builded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: builded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: builded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: builded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: mfc140u.dll.0.dr	Static PE information: section name: .didat
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI47442\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B25820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7A3B25820

Source: C:\Users\user\Desktop\builded.exe

Code function: 2_2_00007FF8A86132F6 rdtsc

2_2_00007FF8A86132F6

Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pywintypes310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pythoncom310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\builded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\builded.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-18155

Source: C:\Users\user\Desktop\builded.exe

API coverage: 2.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B283B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7A3B283B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B292F0 FindFirstFileExW,FindClose,	0_2_00007FF7A3B292F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B418E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B292F0 FindFirstFileExW,FindClose,	2_2_00007FF7A3B292F0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B283B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7A3B283B0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B418E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7A3B418E4
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8613229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FF8A8613229

Source: builded.exe, 00000000.00000003.2108257222.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: System32\vmGuestLib.dll
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxmrxnp.dll
Source: builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: builded.exe, 00000002.00000003.2211800866.00000194024A9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206688703.00000194024A6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209280264.00000194024A7000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206179860.000001940245A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2132946338.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226164202.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216063450.00000194024BD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216797852.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2135643249.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134754188.00000194024CD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211470147.00000194024A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWket.%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615727		2_2_00007FF8A8615727
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A861423C		2_2_00007FF8A861423C

Source: C:\Users\user\Desktop\builded.exe

Code function: 2_2_00007FF8A86132F6 rdtsc

2_2_00007FF8A86132F6

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B2D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7A3B2D19C

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B434F0 GetProcessHeap,

0_2_00007FF7A3B434F0

Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2D37C SetUnhandledExceptionFilter,	0_2_00007FF7A3B2D37C
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A3B2D19C
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B2C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7A3B2C910
Source: C:\Users\user\Desktop\builded.exe	Code function: 0_2_00007FF7A3B3A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A3B3A684
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2D37C SetUnhandledExceptionFilter,	2_2_00007FF7A3B2D37C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7A3B2D19C
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B2C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7A3B2C910
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF7A3B3A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7A3B3A684
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A84F2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A84F2AA0
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A84F3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A84F3068
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8A8615A1A IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8615A1A
Source: C:\Users\user\Desktop\builded.exe	Code function: 2_2_00007FF8B6172004 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8B6172004

Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Users\user\Desktop\builded.exe "C:\Users\user\Desktop\builded.exe"			Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"			Jump to behavior

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B495E0 cpuid

0_2_00007FF7A3B495E0

Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\licenses VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\licenses VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\libssl-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32com VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md__mypyc.cp310-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI47442\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\builded.exe	Queries volume information: C:\Users\user\Desktop\builded.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B2D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7A3B2D080

Source: C:\Users\user\Desktop\builded.exe

Code function: 0_2_00007FF7A3B45C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7A3B45C70

Source: C:\Users\user\Desktop\builded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected CStealer

Source: Yara match	File source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: builded.exe PID: 6496, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: builded.exe PID: 6496, type: MEMORYSTR

Remote Access Functionality

Yara detected CStealer

Source: Yara match	File source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: builded.exe PID: 6496, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: builded.exe PID: 6496, type: MEMORYSTR

Source: C:\Users\user\Desktop\builded.exe

Code function: 2_2_00007FF8A8612B5D bind,WSAGetLastError,

2_2_00007FF8A8612B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
builded.exe	43%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI47442\_sqlite3.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://discord.gift/	100%	Avira URL Cloud	malware
https://paypal.com)	0%	Avira URL Cloud	safe
https://crunchyroll.com)	0%	Avira URL Cloud	safe
https://discord.com)	0%	Avira URL Cloud	safe
https://youtube.com)	0%	Avira URL Cloud	safe
https://xbox.com)	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies	0%	Avira URL Cloud	safe
https://tiktok.com)	0%	Avira URL Cloud	safe
https://coinbase.com)	0%	Avira URL Cloud	safe
http://repository.swisssign.com/O	0%	Avira URL Cloud	safe
https://playstation.com)	0%	Avira URL Cloud	safe
https://ebay.com)	0%	Avira URL Cloud	safe
https://sellix.io)	0%	Avira URL Cloud	safe
https://binance.com)	0%	Avira URL Cloud	safe
https://outlook.com)	0%	Avira URL Cloud	safe
https://github.com)	0%	Avira URL Cloud	safe
https://netflix.com)	0%	Avira URL Cloud	safe
https://gmail.com)	0%	Avira URL Cloud	safe
https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral	0%	Avira URL Cloud	safe
https://steam.com)	0%	Avira URL Cloud	safe
https://spotify.com)	0%	Avira URL Cloud	safe
https://hbo.com)	0%	Avira URL Cloud	safe
https://twitter.com)	0%	Avira URL Cloud	safe
https://pornhub.com)	0%	Avira URL Cloud	safe
http://pyparsing.wikispaces.com	0%	Avira URL Cloud	safe
https://tidelift.com/badges/github/pypa/setuptools?style=flat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
webhook.my	104.21.77.174	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.gift/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.dhimyotis.com/certignarootca.crl0	builded.exe, 00000002.00000002.2232296527.000001940362E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://coinbase.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/pypi/pyversions/setuptools.svg	METADATA0.0.dr	false		high
https://img.shields.io/pypi/v/setuptools.svg	METADATA0.0.dr	false		high
https://tiktok.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	builded.exe, 00000002.00000002.2236120388.00007FF8A8C8D000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	LICENSE.APACHE.0.dr	false		high
https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white	METADATA0.0.dr	false		high
https://paypal.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/packaging	builded.exe, 00000002.00000002.2230655305.00000194030E0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pypi.org/project/setuptools	METADATA0.0.dr	false		high
https://github.com/pypa/setuptools/workflows/tests/badge.svg	METADATA0.0.dr	false		high
https://discord.com/api/v9/users/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xbox.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://youtube.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.jaraco.com/skeleton	METADATA0.0.dr	false		high
http://repository.swisssign.com/O	builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl	builded.exe, 00000002.00000002.2230273469.0000019402FCD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FC9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213333916.0000019402FCA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212600609.0000019402FC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	builded.exe, 00000002.00000002.2231186387.0000019403410000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md	METADATA0.0.dr	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies	builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://json.org	builded.exe, 00000002.00000003.2207966068.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212632731.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crunchyroll.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wwww.certigna.fr/autorites/0m	builded.exe, 00000002.00000002.2230273469.0000019402FCD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FC9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213333916.0000019402FCA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212600609.0000019402FC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2232296527.000001940362E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ebay.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	LICENSE.APACHE.0.dr	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	builded.exe, 00000002.00000002.2225189310.0000019401BA0000.00000004.00001000.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp	false		high
https://playstation.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	builded.exe, 00000002.00000003.2206561494.0000019402D13000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214058925.0000019402D35000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211220075.0000019402D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/distutils-sig/	METADATA0.0.dr	false		high
https://cryptography.io/en/latest/installation/	builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://sellix.io)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	builded.exe, 00000002.00000002.2227038840.00000194027E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/fernet/spec/blob/master/Spec.md	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wiki.debian.org/XDGBaseDirectorySpecification#state	builded.exe, 00000002.00000003.2215429838.0000019400253000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216156282.0000019400254000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	builded.exe, 00000002.00000003.2212914415.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229610004.0000019402F9D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v6/guilds/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	builded.exe, 00000002.00000003.2212914415.0000019402FA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213023278.0000019402FAA000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213635058.0000019402FC2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2230166628.0000019402FC3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212471062.0000019402FA8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213076566.0000019402FB5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212442048.0000019402F9C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	builded.exe, 00000002.00000003.2213973304.0000019402DFD000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211419796.0000019402DF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214492268.0000019402E17000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402E1C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es00	builded.exe, 00000002.00000003.2208530618.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2210176314.000001940272B000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209550869.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2226850582.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.000001940272A000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2219246007.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211585629.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214428837.000001940272C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	METADATA.0.dr	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	builded.exe, 00000002.00000003.2212400705.0000019402CF6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216233925.0000019402CF7000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216380371.0000019402CF9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207966068.0000019402CB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/installing/	METADATA0.0.dr	false		high
https://mahler:8092/site-updates.py	builded.exe, 00000002.00000003.2214664979.0000019402E90000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402E8E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402E91000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402E90000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	METADATA.0.dr	false		high
https://discord.gg/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	builded.exe, 00000002.00000003.2212842134.0000019403630000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215367100.0000019402E60000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2232408060.0000019403636000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213549647.0000019403634000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215532950.0000019402E62000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402E63000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216494704.0000019402E63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral	METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225189310.0000019401C28000.00000004.00001000.00020000.00000000.sdmp	false		high
https://netflix.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2920	builded.exe, 00000002.00000002.2230984159.00000194032F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gmail.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crl0	builded.exe, 00000002.00000003.2211909452.0000019402EFC000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl3.digi	builded.exe, 00000000.00000003.2103915044.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	builded.exe, 00000002.00000003.2128523396.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2225050186.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130215745.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130039106.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212143134.000001940028C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217039368.0000019400293000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2130458610.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128732316.000001940029F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129076923.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2128523396.0000019400233000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209872602.0000019400259000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214464910.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2131042500.000001940028F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2129685820.000001940026C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208175346.0000019400226000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	builded.exe, 00000002.00000002.2229154751.0000019402EB6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://binance.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/SGCA.crlB	builded.exe, 00000002.00000003.2213289393.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/changelog/	builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
https://spotify.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/badge/code%20style-black-000000.svg	METADATA0.0.dr	false		high
https://mail.python.org/mailman/listinfo/cryptography-dev	builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://docs.python.org/library/itertools.html#recipes	builded.exe, 00000002.00000002.2230415130.0000019402FE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/users/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/setuptools/issues/1024.	builded.exe, 00000002.00000002.2227373807.0000019402AE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	builded.exe, 00000002.00000003.2215367100.0000019402E60000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215532950.0000019402E62000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2229085288.0000019402E63000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216494704.0000019402E63000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es0	builded.exe, 00000002.00000003.2212225092.0000019402F96000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/	builded.exe, 00000002.00000003.2214664979.0000019402E90000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402E8E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218208743.0000019402E91000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402E90000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/pprint.html#pprint.pprint	builded.exe, 00000002.00000003.2214385703.00000194025F5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134754188.0000019402431000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134602070.0000019402C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0205/	builded.exe, 00000000.00000003.2107935191.000002E54ACB2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000002.2227038840.00000194027E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.com/	builded.exe, 00000002.00000003.2206179860.0000019402422000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214297997.000001940242C000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2209398619.0000019402427000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2214664979.0000019402E8D000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207509222.0000019402422000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crlRLopener._	builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212332520.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213157638.0000019402EB3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hbo.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps	builded.exe, 00000002.00000002.2229248948.0000019402EF5000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213351253.0000019402EC6000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2213384788.0000019402EF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212073828.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206410674.0000019402EA9000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2212259966.0000019402EBA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/mypy/issues/3216	builded.exe, 00000002.00000003.2208346038.000001940261F000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2218859946.00000194026C3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2215067262.00000194026C1000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2211145578.0000019402621000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206716240.0000019402676000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2134984384.000001940261E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2207908188.000001940261E000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208530618.00000194026C0000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206896459.00000194026A3000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2208976139.0000019402620000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://geolocation-db.com/jsonp/	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://google.com/mail/	builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/cryptography.svg	builded.exe, 00000000.00000003.2109171323.000002E54ACB5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		high
http://google.com/mail/	builded.exe, 00000002.00000003.2215333433.0000019402DF0000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2206091047.0000019402DC8000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2217957882.0000019402DF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2216717503.0000019402DF2000.00000004.00000020.00020000.00000000.sdmp, builded.exe, 00000002.00000003.2205771887.0000019402DC5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pyparsing.wikispaces.com	builded.exe, 00000002.00000003.2134602070.0000019402C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/badges/github/pypa/setuptools?style=flat	METADATA0.0.dr	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	builded.exe, 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmp, builded.exe, 00000002.00000002.2235276694.00007FF8A8954000.00000002.00000001.01000000.00000014.sdmp	false		high
https://pornhub.com)	builded.exe, 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/readthedocs/setuptools/latest.svg	METADATA0.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.77.174	webhook.my	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591683
Start date and time:	2025-01-15 10:00:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	builded.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@6/92@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
webhook.my	dog.jpg.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
webhook.my	Fw3icx4ZWB.exe	Get hash	malicious	Unknown	Browse	172.67.142.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.184.241
	https://www.google.com/url?q=https://newinvite.es/zoom&source=gmail&ust=1736277206672000&usg=AOvVaw1tMcQvXWpd-idsJybr3xOA	Get hash	malicious	ScreenConnect Tool	Browse	104.21.64.1
	https://www.google.com/url?q=https://newinvite.es/zoom&source=gmail&ust=1736277206672000&usg=AOvVaw1tMcQvXWpd-idsJybr3xOA	Get hash	malicious	ScreenConnect Tool	Browse	104.21.112.1
	http://arthistoryteachingresources.org/2015/02/talk-to-your-profbut-how/	Get hash	malicious	Unknown	Browse	188.114.97.3
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	17369284269327933f4ce2d9485e98192cffc35d127e85bf0db77dc37ba595305760e31611471.dat-decoded.exe	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	104.16.185.241
	http://jfdhq.offerpeercheck.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	NEW SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd	pbz3swuapf.exe	Get hash	malicious	Python Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse
	LEmcGUQfA7.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Discord Token Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer	Browse
	DChOtFdp9T.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	3OQL58yflv.exe	Get hash	malicious	Metasploit	Browse
C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd	pbz3swuapf.exe	Get hash	malicious	Python Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse
	LEmcGUQfA7.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	3LcZO15oTC.exe	Get hash	malicious	Unknown	Browse
	main.exe	Get hash	malicious	Discord Token Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer	Browse
	DChOtFdp9T.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse
	3OQL58yflv.exe	Get hash	malicious	Metasploit	Browse
	7zip.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pbz3swuapf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: LEmcGUQfA7.exe, Detection: malicious, Browse Filename: 3LcZO15oTC.exe, Detection: malicious, Browse Filename: 3LcZO15oTC.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: DChOtFdp9T.exe, Detection: malicious, Browse Filename: 3OQL58yflv.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pbz3swuapf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: LEmcGUQfA7.exe, Detection: malicious, Browse Filename: 3LcZO15oTC.exe, Detection: malicious, Browse Filename: main.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: DChOtFdp9T.exe, Detection: malicious, Browse Filename: 3OQL58yflv.exe, Detection: malicious, Browse Filename: 7zip.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5653536
Entropy (8bit):	6.729079283804055
Encrypted:	false
SSDEEP:	49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
MD5:	CD1D99DF975EE5395174DF834E82B256
SHA1:	F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
SHA-256:	D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
SHA-512:	397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\Pythonwin\win32ui.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1142272
Entropy (8bit):	6.044159301267025
Encrypted:	false
SSDEEP:	12288:ETqIp0hPXIZSPzQ5u0j1Sn1w0vhYvSZav8pqR4aPFTP86:ETqImIN5pA1BlZZcyal
MD5:	79FF2A54A88364617450A95224BAAFFD
SHA1:	BDF9B430C6DC1CC83E4572761A19C0FEC65E7362
SHA-256:	18D37C6FEE55515F9242D31A627671EC4413A428B08A14EA329D8D9B2A54D57F
SHA-512:	7A97A7F0044E74FD6A05451F6CEB68D5E08E1ECE6D6E9BEDAA7D0C4AA2009834C5374E2ADAF66990AD3D7C1BFD21716DAA0AE77412E85532288CFFFEB08169C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.K.............d].....-i......#i.......d.......i.......i.......i...............i......-i......-i......-i1.....-i......Rich....................PE..d......g.........." .........p......T.....................................................`..............................................T...q..h...............................`\..@...T.......................(.......8................0...........................text............................... ..`.rdata..............................@..@.data...............................@....pdata...............`..............@..@.rsrc...............................@..@.reloc..`\.......^..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97160
Entropy (8bit):	6.422776154074499
Encrypted:	false
SSDEEP:	1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5:	11D9AC94E8CB17BD23DEA89F8E757F18
SHA1:	D4FB80A512486821AD320C4FD67ABCAE63005158
SHA-256:	E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E
SHA-512:	AA6AFD6BEA27F554E3646152D8C4F96F7BCAAA4933F8B7C04346E410F93F23CFA6D29362FD5D51CCBB8B6223E094CD89E351F072AD0517553703F5BF9DE28778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d....(.`.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37256
Entropy (8bit):	6.2987721506649335
Encrypted:	false
SSDEEP:	384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
MD5:	7667B0883DE4667EC87C3B75BED84D84
SHA1:	E6F6DF83E813ED8252614A46A5892C4856DF1F58
SHA-256:	04E7CCBDCAD7CBAF0ED28692FB08EAB832C38AAD9071749037EE7A58F45E9D7D
SHA-512:	968CBAAFE416A9E398C5BFD8C5825FA813462AE207D17072C035F916742517EDC42349A72AB6795199D34CCECE259D5F2F63587CFAEB0026C0667632B05C5C74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D_.O.>...>...>...N...>..RK...>...F^..>...>..1>..RK...>..RK...>..RK...>..RK...>..RK2..>..RK...>..Rich.>..........................PE..d....(.`.........." .....:...6......`A....................................................`A.........................................l.......m..x....................n...#......<...(b..T............................b..8............P..X............................text...e9.......:.................. ..`.rdata.. "...P...$...>..............@..@.data... ............b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..<............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80112
Entropy (8bit):	6.4309989963681105
Encrypted:	false
SSDEEP:	1536:owz7h8B7BjhJCZePYgIjFNf8AnZydTBIAMVyyw:owz18BrJCJgIHEAodTBIAMVy
MD5:	B45E82A398713163216984F2FEBA88F6
SHA1:	EAAF4B91DB6F67D7C57C2711F4E968CE0FE5D839
SHA-256:	4C2649DC69A8874B91646723AACB84C565EFEAA4277C46392055BCA9A10497A8
SHA-512:	B9C4F22DC4B52815C407AB94D18A7F2E1E4F2250AECDB2E75119150E69B006ED69F3000622EC63EABCF0886B7F56FFDB154E0BF57D8F7F45C3B1DD5C18B84EC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..>...m...m...m..=m...mQ..l...me.Sm...mQ..l...mQ..l...mQ..l...m...l...m...l...m...m\..m...l...m...l...m..Qm...m...l...mRich...m................PE..d....O[a.........." .........^...............................................P............`.............................................H............0....... ..,............@......`...T...............................8............................................text...U........................... ..`.rdata..\>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120040
Entropy (8bit):	5.921989765012805
Encrypted:	false
SSDEEP:	3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
MD5:	79F339753DC8954B8EB45FE70910937E
SHA1:	3AD1BF9872DC779F32795988EB85C81FE47B3DD4
SHA-256:	35CDD122679041EBEF264DE5626B7805F3F66C8AE6CC451B8BC520BE647FA007
SHA-512:	21E567E813180ED0480C4B21BE3E2E67974D8D787E663275BE054CEE0A3F5161FC39034704DBD25F1412FEB021D6A21B300A32D1747DEE072820BE81B9D9B753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......XP...1a..1a..1a..I..1a.ND`..1a.NDd..1a.NDe..1a.NDb..1a..D`..1a..Ze..1a..Z`..1a..X`..1a..1`..1a..Dl..1a..Da..1a..D...1a..Dc..1a.Rich.1a.................PE..d....O[a.........." .................[....................................................`.........................................0Q.......Q..........................................T...........................0...8...............@............................text...d........................... ..`.rdata...l.......n..................@..@.data...T>...p...8...`..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247528
Entropy (8bit):	6.5130349256035975
Encrypted:	false
SSDEEP:	6144:xJADMQRl2npdNqRb8o+wmxYk29qWMa3pLW1ALH+4t4g3:IDMQ2Nqi02/U/+g3
MD5:	1CDD7239FC63B7C8A2E2BC0A08D9EA76
SHA1:	85EF6F43BA1343B30A223C48442A8B4F5254D5B0
SHA-256:	384993B2B8CFCBF155E63F0EE2383A9F9483DE92AB73736FF84590A0C4CA2690
SHA-512:	BA4E19E122F83D477CC4BE5E0DEA184DAFBA2F438A587DD4F0EF038ABD40CB9CDC1986EE69C34BAC3AF9CF2347BEA137FEEA3B82E02CCA1A7720D735CEA7ACDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P..P..P.....P...Q..P...U..P...T..P...S..P.Q.Q..P...Q..P..Q...P.Q.S..P.Q.]..P.Q.P..P.Q...P.Q.R..P.Rich.P.................PE..d....O[a.........." .....r...:............................................................`..........................................T..P...@U...................'..............<... ...T...............................8............................................text...)q.......r.................. ..`.rdata...............v..............@..@.data....)...p...$...N..............@....pdata...'.......(...r..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59112
Entropy (8bit):	6.088455033709072
Encrypted:	false
SSDEEP:	768:13RNYlTw3glkXa/bNnVXP5ZV17reFyPXS9aEyp6fZIAYIPVDG4ywh2:2TRiXa/bNFLVFPXS93fZIAYI3yz
MD5:	CFB9E0A73A6C9D6D35C2594E52E15234
SHA1:	B86042C96F2CE6D8A239B7D426F298A23DF8B3B9
SHA-256:	50DAEB3985302A8D85CE8167B0BF08B9DA43E7D51CEAE50E8E1CDFB0EDF218C6
SHA-512:	22A5FD139D88C0EEE7241C5597D8DBBF2B78841565D0ED0DF62383AB50FDE04B13A203BDDEF03530F8609F5117869ED06894A572F7655224285823385D7492D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................m.....B.......B.......B.......B.....................F......................................Rich....................PE..d....O[a.........." .....R...z......`>....................................................`.........................................P...P............................................y..T............................y..8............p..x............................text....P.......R.................. ..`.rdata...M...p...N...V..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153320
Entropy (8bit):	6.800724697808258
Encrypted:	false
SSDEEP:	3072:3o6xxrSqs+vs0H0q8bnpbVDbX5AyYCznfo9mNomenNjc3KBIAD15:3o6DrScRLCV3twYOmUQKt
MD5:	5A77A1E70E054431236ADB9E46F40582
SHA1:	BE4A8D1618D3AD11CFDB6A366625B37C27F4611A
SHA-256:	F125A885C10E1BE4B12D988D6C19128890E7ADD75BAA935FE1354721AA2DEA3E
SHA-512:	3C14297A1400A93D1A01C7F8B4463BFD6BE062EC08DAAF5EB7FCBCDE7F4FA40AE06E016FF0DE16CB03B987C263876F2F437705ADC66244D3EE58F23D6BF7F635
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.h...h...h.......h.......h.......h.......h.......h..+....h.......h...h...h..+....h..+....h..+....h..+....h..Rich.h..........PE..d....O[a.........." .....^...........2..............................................`d....`......................................... ...L...l...x....`.......@.......:.......p..D...H{..T............................{..8............p...............................text....].......^.................. ..`.rdata......p.......b..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..D....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29928
Entropy (8bit):	6.073847763367447
Encrypted:	false
SSDEEP:	768:PSZtryImJxGC+sPDnrJIAAtDfDG4yKYh/:qLrUJsC+sPDnrJIAAtD5yKy
MD5:	FCE357F864A558C03ED17755F87D0E30
SHA1:	B74ECB2BEE03A8FF209F52F652C011F28D5AE4D0
SHA-256:	000486AAAC9DD21E88B3DC65FD854DD83519B1FBCC224A70530BC3EC8CBD1A5D
SHA-512:	564DEA2BF3410011A76CA5EA376DBA3EC9B2D03FD25248824F6C956FA5EA061C1A9EE6F6B65B021EA5BF9CC5E3AB9C6FCF4779446B920891A2C0979BBC57D58B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s... ... ... ..e ... ..!... ..!... ..!... ..!... !..!... ...!... ... ... !..!... !..!... !.. ... !..!... Rich... ................PE..d....O[a.........." .........<......0.....................................................`.........................................pD..`....D..x....p.......`.......X..............`3..T............................3..8............0...............................text............................... ..`.rdata.......0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	6.111826139660432
Encrypted:	false
SSDEEP:	384:ztfqkQfrUC+qFYS9F6N76r1PSMYpKnHgEFIAmUJDG4y8YSNhJl:zOrUC+Us6r1PSMjFFIAmUJDG4y4hP
MD5:	C9EE37E9F3BFFD296ADE10A27C7E5B50
SHA1:	B7EEE121B2918B6C0997D4889CFF13025AF4F676
SHA-256:	9ECEC72C5FE3C83C122043CAD8CEB80D239D99D03B8EA665490BBCED183CE42A
SHA-512:	C63BB1B5D84D027439AF29C4827FA801DF3A2F3D5854C7C79789CAD3F5F7561EB2A7406C6F599D2AC553BC31969DC3FA9EEF8648BED7282FBC5DC3FB3BA4307F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a..}...}...}.......}......}......}......}......}..s....}.......}...}..}..s....}..s....}..s....}..s....}..Rich.}..........PE..d....O[a.........." .........8.......................................................w....`..........................................C..L....C..d....p.......`.......N...............3..T...........................p3..8............0.. ............................text...*........................... ..`.rdata.......0......................@..@.data........P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74472
Entropy (8bit):	6.119165103878181
Encrypted:	false
SSDEEP:	1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
MD5:	5DD51579FA9B6A06336854889562BEC0
SHA1:	99C0ED0A15ED450279B01D95B75C162628C9BE1D
SHA-256:	3669E56E99AE3A944FBE7845F0BE05AEA96A603717E883D56A27DC356F8C2F2C
SHA-512:	7AA6C6587890AE8C3F9A5E97EBDE689243AC5B9ABB9B1E887F29C53EEF99A53E4B4EC100C03E1C043E2F0D330E7AF444C3CA886C9A5E338C2EA42AAACAE09F3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......BV...7...7...7...Og..7..TB...7..TB..7..TB..7..TB...7...B...7...\...7...7...7...B...7...B...7...B...7...B...7..Rich.7..........................PE..d....O[a.........." .....l...........%.......................................P............`.............................................P............0....... ..<............@..........T..............................8............................................text...Vj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	93416
Entropy (8bit):	6.082968229829419
Encrypted:	false
SSDEEP:	1536:6WRj/57JzRFSbiSBYNdS4JkFTH57GlrpD5T82SXEv/cttngyB+HmTq0eZIAYQikX:bRj51g7YNwIkpHsfD5Q2SXttgyB4zZII
MD5:	6486E5C8512BDDC5F5606D11FE8F21E0
SHA1:	650861B2C4A1D6689FF0A49BB916F8FF278BB387
SHA-256:	728D21BE4D47DD664CAF9FA60C1369FE059BC0498EDD383B27491D0DEE23E439
SHA-512:	F2C9267A3CAB31190079037E3CC5614F19C1235852454708C4978008EA9DA345892191750980AEBC809CC83DD1F5788B60F8CF39A6A41623210C96AF916D1821
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V7F.8dF.8dF.8dO.d@.8d..9eD.8d ..dG.8d..=eJ.8d..<eN.8d..;eE.8d..9eC.8dR.9eD.8dF.9d..8d..5eO.8d..8eG.8d...dG.8d..:eG.8dRichF.8d........................PE..d....O[a.........." .................................................................b....`.............................................P............p.......P..\....P..........\|...D...T...............................8...............H............................text...`........................... ..`.rdata...n.......p..................@..@.data...,....0......................@....pdata..\....P......................@..@.rsrc........p.......B..............@..@.reloc..\|............L..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	155880
Entropy (8bit):	5.928662213847181
Encrypted:	false
SSDEEP:	3072:wYb/EGIexVYBgWHaCJaLuJ3TE8sOGH70NmHh4kwooSLteSdo9QBIAM73:wY7jIexVYKUazuJMOADtho9QO
MD5:	11C5008E0BA2CAA8ADF7452F0AAAFD1E
SHA1:	764B33B749E3DA9E716B8A853B63B2F7711FCC7C
SHA-256:	BF63F44951F14C9D0C890415D013276498D6D59E53811BBE2FA16825710BEA14
SHA-512:	FCEB022D8694BCE6504D6B64DE4596E2B8252FC2427EE66300E37BCFF297579CC7D32A8CB8F847408EAA716CB053E20D53E93FBD945E3F60D58214E6A969C9DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..w&.w&.w&....w&...'.w&...#.w&...".w&...%.w&.%.'.w&...'.w&..'.w&.w'..v&.%.+.w&.%.&.w&.%...w&.%.$.w&.Rich.w&.................PE..d....O[a.........." ................l*..............................................2p....`............................................d...4........`.......P.......D.......p..8.......T...............................8...............x............................text...T........................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20712
Entropy (8bit):	6.192560804933009
Encrypted:	false
SSDEEP:	384:tvEaNKFDyLnM5BIADwQDuDG4y8i1Iah7PR0:tTNK4LM5BIADwiuDG4yNh7Z0
MD5:	AEEAD50876DDB63CB8E882989041D7DA
SHA1:	C9BF23227CED84D39BD33665444DE3E9064315C6
SHA-256:	C74AAEEC487457139B47C0AB56E01922BFAE6DEBEF562800E5B9B6BAF1EC9D6A
SHA-512:	74C8FE6CFD67E1984A2DF9BD998AE363519DE16B5840CABBA01660154FBEAC92E2C773ECC2884D531362E8A0B739673C44F450C1BEA05CA33EEF58A8E61BC2CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f<I."]'."]'."]'.+%.. ]'.p(&. ]'.p(".)]'.p(#.*]'.p($.!]'..(&. ]'.66&.']'."]&..]'..(/.#]'..('.#]'..(..#]'..(%.#]'.Rich"]'.........................PE..d....O[a.........." .........&...... ........................................p......B.....`.........................................`)..L....)..x....P.......@.......4.......`..<...."..T...........................`"..8............ ..0............................text...X........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..<....`.......2..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\base_library.zip

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	878682
Entropy (8bit):	5.684379151192553
Encrypted:	false
SSDEEP:	12288:LVghgWWy4C6Sdc7bA4a2Yqo3Vw9sfJEunw7SDQNh:LVgh1V4FLa2D2Vw9sfJEunNQNh
MD5:	4BB4E9FBD23477BA38E3D18636483678
SHA1:	C76C5FBD15104F2800400205EF7925E36D59D88A
SHA-256:	12851C5F8D56BF0B22C4693180CA630F13D5BE7BDEA5E1E3FC0B012269A69AC9
SHA-512:	7AAD6A4C4C252E53DDF4F7999638726B2C479457E553042351DA70BF110C5BF72B09B56276DD0B8F63896738556FA30E2D658574A3A1B53A25F4005264201CF6
Malicious:	false
Preview:	PK..........!.^/.............._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI47442\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294769
Entropy (8bit):	6.047057219398099
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahx:QWb/TRiLWURrId5MWavdX08/
MD5:	52A8319281308DE49CCEF4850A7245BC
SHA1:	43D20D833B084454311CA9B00DD7595C527CE3BB
SHA-256:	807897254F383A27F45E44F49656F378ABAB2141EDE43A4AD3C2420A597DD23F
SHA-512:	2764222C0CD8C862906AC0E3E51F201E748822FE9CE9B1008F3367FDD7F0DB7CC12BF86E319511157AF087DD2093C42E2D84232FAE023D35EE1E425E7C43382D
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.825419221995283
Encrypted:	false
SSDEEP:	96:ij0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFPCQAASmAolyc8H4ao:AFCk2z1/t12iwU5usJFLCyuoccg
MD5:	90245EDD2E2D307C3BF7DF4E4A30E142
SHA1:	06952B19180F687536F27DFB8BD69225AEDBED72
SHA-256:	7EDF019905C36CF7D81CFE1B5F5EEF1365AE118CBBA4138396247C9ACF93E813
SHA-512:	7B8B517EAEF6D662D7A2342B2E0867E79C0BE903623910BC049C157CADB97043989F949B64FEEF289BB05683777A1714841955507362C462FB5A73B3A2E2D420
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.................N......X......h_.......X.......X.......X.................<...X......X......X".....X......Rich....................PE..d.....jg.........." ...*.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.908689578930274
Encrypted:	false
SSDEEP:	1536:TCIe0EsYCJ9lJNirv/ZlKwXy4AwhD6fUzJJfb8AbvO6q7OaOUz6DLQHxp:2IeCXTirv/Z0wXpAwh3z8DyUz0LQH
MD5:	46338AEC32AA676C3C82A39F41EBD66B
SHA1:	49212A95F46637149DD5904B33F5D714638A2F9E
SHA-256:	09056D560486A2368A917B2D476A453AF1B885C4D98E45AC80F8BA61C0DFF824
SHA-512:	8360F6B32152FBEE1CA4587317931FDDDC128EC2F33365CD3D2ACB2B5CB6331E37BF07FDFE9E2AA997DA774047D89871C331E3BA1024089A2D6F2DFC5567EF9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.7...Y...Y...Y.......Y...X...Y.\|.X...Y...Z...Y...]...Y...\...Y...X...Y...X..Y...Q...Y...Y...Y.......Y...[...Y.Rich..Y.........................PE..d.....jg.........." ...*.6...........9.......................................0............`.............................................d.................................... ......................................p...@............P...............................text...X5.......6.................. ..`.rdata...Z...P...\...:..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5724
Entropy (8bit):	5.120429897887076
Encrypted:	false
SSDEEP:	96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
MD5:	526D9AC9D8150602EC9ED8B9F4DE7102
SHA1:	DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
SHA-256:	D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
SHA-512:	FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16380
Entropy (8bit):	5.58935582120211
Encrypted:	false
SSDEEP:	192:hXr1We/l45jEVeK6tkhX/v4WJr6W51HepPNIq+NX6ih5VBUqw8q:hXzlMEVdX/9Jr6W51HepPN/+96ihI8q
MD5:	F15EF7175220C9F59F90BBBAEDA16DBD
SHA1:	5367CAC8814D7A54E1C0274FF3F651ED5C6FE5D6
SHA-256:	04DB3839C853D4164576122B7D5A2BAB186536DC8F9A4980385E11CF59946114
SHA-512:	BB0FA967E03D98B9611006DF2155BD8AD58A0E8B1A679D636B94CE931D316F18B61B801E018DECA90D8E5A35FA744AE8C9E1A36F25C791052008C43AF53A8117
Malicious:	false
Preview:	cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-310.pyc,,..cryptography/__pycache__/__init__.cpython-310

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.0373614967294325
Encrypted:	false
SSDEEP:	3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
MD5:	A868F93FCF51C4F1C25658D54F994349
SHA1:	535C88A10911673DEABB7889D365E81729E483A6
SHA-256:	1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
SHA-512:	EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI47442\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8292864
Entropy (8bit):	6.493076254122072
Encrypted:	false
SSDEEP:	98304:Y4sf3zg+qUuQdPJMqYLSxuBLZqwt0kDO+5+O:cdeqYLSxuBLZrGjq+
MD5:	34293B976DA366D83C12D8EE05DE7B03
SHA1:	82B8EB434C26FCC3A5D9673C9B93663C0FF9BF15
SHA-256:	A2285C3F2F7E63BA8A17AB5D0A302740E6ADF7E608E0707A7737C1EC3BD8CECC
SHA-512:	0807EC7515186F0A989BB667150A84FF3BEBCC248625597BA0BE3C6F07AD60D70CF8A3F65191436EC16042F446D4248BF92FCD02212E459405948DB10F078B8E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.R\..n"......~Z.......................................~...........`...........................................x.X.....x...............y...............~.......o.T.....................o.(...p.o.@............p\.8............................text....Q\......R\................. ..`.rdata..P9...p\..:...V\.............@..@.data... >....x.......x.............@....pdata........y.......y.............@..@.reloc........~.......}.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3429624
Entropy (8bit):	6.093870626224665
Encrypted:	false
SSDEEP:	49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
MD5:	63C4F445B6998E63A1414F5765C18217
SHA1:	8C1AC1B4290B122E62F706F7434517077974F40E
SHA-256:	664C3E52F914E351BB8A66CE2465EE0D40ACAB1D2A6B3167AE6ACF6F1D1724D2
SHA-512:	AA7BDB3C5BC8AEEFBAD70D785F2468ACBB88EF6E6CAC175DA765647030734453A2836F9658DC7CE33F6FFF0DE85CB701C825EF5C04018D79FA1953C8EF946AFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.>y..P..P..Pv..m.P-.Q+}.P-.U+t.P-.T+w.P-.S+{.Pk.Q+t.P..Q..P).S+b.P).T+..P).P+~.P).~.P).R+~.PRich..P*........PE..d.....'a.........." ......$...................................................4.......4...`.........................................@Q/..h....4.@....@4.\|....@2......84......P4..O....,.8...........................P.,.8.............4..............................text...4.$.......$................. ..`.rdata..V.....$.......$.............@..@.data....z....1..,....1.............@....pdata.. ....@2.......1.............@..@.idata..^#....4..$....3.............@..@.00cfg..Q....04.......3.............@..@.rsrc...\|....@4.......3.............@..@.reloc...x...P4..z....3.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	695032
Entropy (8bit):	5.528361289023932
Encrypted:	false
SSDEEP:	12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
MD5:	BD857F444EBBF147A8FCD1215EFE79FC
SHA1:	1550E0D241C27F41C63F197B1BD669591A20C15B
SHA-256:	B7C0E42C1A60A2A062B899C8D4EBD0C50EF956177BA21785CE07C517C143AEAF
SHA-512:	2B85C1521EDEADF7E118610D6546FAFBBAD43C288A7F0F9D38D97C4423A541DFAC686634CDE956812916830FBB4AAD8351A23D95CD490C4A5C0F628244D30F0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&v..G.^.G.^.G.^.?.^.G.^.2._.G.^.,._.G.^.2._.G.^.2._.G.^.2._.G.^.2._.G.^.G.^HF.^.2._.G.^.2._.G.^.2.^.G.^.2._.G.^Rich.G.^........................PE..d.....'a.........." .....8...L......<.....................................................`.........................................p+...N..HE..........s........K...~..........l.......8...............................8............0..H............................text....6.......8.................. ..`.rdata..z)...P...*...<..............@..@.data...QM.......D...f..............@....pdata...T.......V..................@..@.idata..PW...0...X..................@..@.00cfg..Q............X..............@..@.rsrc...s............Z..............@..@.reloc..]............b..............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191720
Entropy (8bit):	6.322506643675763
Encrypted:	false
SSDEEP:	3072:gUV1H8tt/Z6dhxQMOJzr9JuB9OVqjxCXRTWiTayyXsflyOCiXOgeDpSRP4kFIABQ:BVGtkdhAr9JuB0VTTV9yXsfo+o
MD5:	983D8E003E772E9C078FAAD820D14436
SHA1:	1C90AD33DC4FECBDEB21F35CA748AA0094601C07
SHA-256:	E2146BED9720EB94388532551444F434D3195310FA7BD117253E7DF81A8E187E
SHA-512:	E7F0FD841C41F313C1782331C0F0AA35E1D8BA42475D502D08C3598A3AAEFD400179C19613941CDFAD724ECA067DD1B2F4C2F1E8A1D6F70EEB29F7B2213E6500
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Qe.....J...J...J.\|:J...JGq.K...JGq.K...JGq.K...JGq.K...J.q.K...J.o.K...J...Jm..J.q.K...J.q.K...J.qVJ...J.q.K...JRich...J........................PE..d....O[a.........." ................p...............................................\E....`.........................................@...P............................................4..T...........................P5..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\python3.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61680
Entropy (8bit):	5.923759574558729
Encrypted:	false
SSDEEP:	768:ek8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqe:ekwewnvtjnsfwGFIAB0hy
MD5:	A5471F05FD616B0F8E582211EA470A15
SHA1:	CB5F8BF048DC4FC58F80BDFD2E04570DBEF4730E
SHA-256:	8D5E09791B8B251676E16BDD66A7118D88B10B66AD80A87D5897FADBEFB91790
SHA-512:	E87D06778201615B129DCF4E8B4059399128276EB87102B5C3A64B6E92714F6B0D5BDE5DF4413CC1B66D33A77D7A3912EAA1035F73565DBFD62280D09D46ABFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.\|.l...d.\|.d...d.\|.....d.\|.f...d.Rich..d.........................PE..d...\|O[a.........." .....................................................................`.........................................`...`...............................................T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\python310.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4450544
Entropy (8bit):	6.458222828027988
Encrypted:	false
SSDEEP:	49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5:	384349987B60775D6FC3A6D202C3E1BD
SHA1:	701CB80C55F859AD4A31C53AA744A00D61E467E5
SHA-256:	F281C2E252ED59DD96726DBB2DE529A2B07B818E9CC3799D1FFA9883E3028ED8
SHA-512:	6BF3EF9F08F4FC07461B6EA8D9822568AD0A0F211E471B990F62C6713ADB7B6BE28B90F206A4EC0673B92BAE99597D1C7785381E486F6091265C7DF85FF0F9B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................~..........................................3...F..3......3.\|....3......Rich...........PE..d...pO[a.........." .....X#..d!.....,.........................................E......D...`...........................................<......z=.\|....pD......@B.0.....C.......D..t..x.$.T.............................$.8............p#.8............................text...bW#......X#................. ..`.rdata...-...p#......\#.............@..@.data.........=.......=.............@....pdata..0....@B......6A.............@..@PyRuntim`....`D......HC.............@....rsrc........pD......LC.............@..@.reloc...t....D..v...VC.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pythoncom310.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	669184
Entropy (8bit):	6.038501106256027
Encrypted:	false
SSDEEP:	12288:Z0t/kfQ/Uylo3H6J6vEGOIWGe3PVpdYqWMA:6t/kf1ylo33vp9KPFP
MD5:	3B8B8691D5E5E80F54548A7E210D4339
SHA1:	064C6BCDFAEF6662F3C1B243C1AA9AA8DAB520BB
SHA-256:	007DF83330975B9A70F1700CC6DF11286D14D06987BE75D4B0B05452CB7B84F1
SHA-512:	BA67915000A00B4A56F34A5035863228F3253004BB8B669DFF08848483D8D05CCE41E535A7142C18620E4F9F7BA85DA19F965D1B67DEC2B64F6296F34DD06638
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5.~.T.-.T.-.T.-.,.-.T.-.!.,.T.-.!.,.T.-.!.,.T.-.!.,.T.-p!.,.T.-.,.,.T.-~!.,.T.-.,.,.T.-.T.-.U.-p!.,.T.-p!.,.T.-p!.,.T.-Rich.T.-........................PE..d...9..g.........." ................T.....................................................`..........................................U...c..(...........l....@...z............... ..P...T...............................8............................................text...C........................... ..`.rdata..x$.......&..................@..@.data....I..........................@....pdata...z...@...\|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\pywin32_system32\pywintypes310.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.995301814533339
Encrypted:	false
SSDEEP:	3072:MBdf5t5cspEpc/1utS9DNbtt1Y/r06Yrmu30mpEGNwX9iuu:MBdf5t5c/pW7nY/rk6y0mpEowX9i
MD5:	C873CF87068A45FB47993AF23D8A3E12
SHA1:	96A26436F22E3431D25661CEA7E5C2BCF3C7EE51
SHA-256:	3813FC39304F64101E99F2C5378C0A72B784EFCAEA695FFEEDE5FF6EA06F097B
SHA-512:	95975E39ECD6C60FFE0B973BAB9B5AE8C7B129EEDCEBCFE142EE2550C11385388CBCAFBF3CAA055E0A521D322948476C736FEDD473EB0C9BB5B3FCF4CEF311BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ZI+.;'x.;'x.;'x.C.x.;'x.N&y.;'x.T.x.;'x.N"y.;'x.N#y.;'x.N$y.;'x.C#y.;'x1N&y.;'x.C&y.;'x.;&x.;'x?N.y.;'x?N'y.;'x?N%y.;'xRich.;'x........................PE..d......g.........." .........................................................P............`..........................................u..lB......,....0..l.......L............@..0....Q..T............................R..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\select.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25840
Entropy (8bit):	6.184647213244152
Encrypted:	false
SSDEEP:	384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
MD5:	78D421A4E6B06B5561C45B9A5C6F86B1
SHA1:	C70747D3F2D26A92A0FE0B353F1D1D01693929AC
SHA-256:	F1694CE82DA997FAA89A9D22D469BFC94ABB0F2063A69EC9B953BC085C2CB823
SHA-512:	83E02963C9726A40CD4608B69B4CDF697E41C9EEDFB2D48F3C02C91500E212E7E0AB03E6B3F70F42E16E734E572593F27B016B901C8AA75F674B6E0FBB735012
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f ...N...N...N.......N..rO...N..rK...N..rJ...N..rM...N..rO...N..lO...N...O...N..rC...N..rN...N..r....N..rL...N.Rich..N.........................PE..d....O[a.........." .........2.......................................................y....`..........................................@..L....@..x....p.......`.......H..........H....2..T............................2..8............0...............................text............................... ..`.rdata..6....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..H............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.072538194763298
Encrypted:	false
SSDEEP:	24:1rmJHcwH0MP3gt8Hw1hj9QHOsUv4eOk4/+/m3oqMSFJ:1aJ8YHvEH5QHOs5exm3oEFJ
MD5:	7A7126E068206290F3FE9F8D6C713EA6
SHA1:	8E6689D37F82D5617B7F7F7232C94024D41066D1
SHA-256:	DB3F0246B1F9278F15845B99FEC478B8B506EB76487993722F8C6E254285FAF8
SHA-512:	C9F0870BC5D5EFF8769D9919E6D8DDE1B773543634F7D03503A9E8F191BD4ACC00A97E0399E173785D1B65318BAC79F41D3974AE6855E5C432AC5DACF8D13E8A
Malicious:	false
Preview:	Copyright Jason R. Coombs..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense, and/or.sell copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTW

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4908
Entropy (8bit):	5.0861617176323435
Encrypted:	false
SSDEEP:	96:DpsYyJAm4a113Nr1uCDIGSwMHodIDvVnddPnzQDiHNU4o7POX7FwTtPMk:dQdrMYIGSwMHodIDvBdBn77FwTJ
MD5:	36BE36BE5EC1F5B5843A30038F034434
SHA1:	B903344823DBD9176774D5EA17F8513C3C8CFF01
SHA-256:	518DD6D71AC1743D85CE3CD8C692A58611340BC4A55DDEE4D0DF1C0921D613D5
SHA-512:	509B79F3DD004A4C4B12CE16271CF89BD2AEAEBFA48F862922D650AF469F80599C305FE185B9AA6A7A129427A0BD293B085587624E4A7EA799393101B1B6E2C6
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: setuptools.Version: 57.4.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.License: UNKNOWN.Project-URL: Documentation, https://setuptools.readthedocs.io/.Keywords: CPAN PyPI distutils eggs package management.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: Topic :: System :: Systems Administration.Classifier: Topic :: Utilities.Requires-Python: >=3.6.License-File: LICENSE.Provides-Extra: certs.Provides-Extra: docs.Requires-Dist: sphinx ; extra == 'doc

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	23214
Entropy (8bit):	5.587143938943948
Encrypted:	false
SSDEEP:	384:dnz9AWSogahtKJwQjIbwA+h4gcWmdcYcvX6Y/KUtWD3yCjhZDP1z39L1:ddxcFiUtMiCj3p39L1
MD5:	E27F2E80BF17B029DF1BD79A29045D8A
SHA1:	AB0C2AC3E32B7AD1570A65CD3DC02284A7C99F7F
SHA-256:	F21F239121DB547655371DDE814E349B3912553C18F8FF6D5214E633E09D900D
SHA-512:	6948EEA34B8AAF9DB645BE2EE7ACDC987734A474980732F30CE2FE310D060B78180A663EE75D05877A42C2C053FD081294F65EE936A7D34C503FDE1D02182B8A
Malicious:	false
Preview:	_distutils_hack/__init__.py,sha256=X3RUiA6KBPoEmco_CjACyltyQbFRGVUpZRAbSkPGwMs,3688.._distutils_hack/__pycache__/__init__.cpython-310.pyc,,.._distutils_hack/__pycache__/override.cpython-310.pyc,,.._distutils_hack/override.py,sha256=Eu_s-NF6VIZ4Cqd0tbbA5wtWky2IZPNd8et6GLt1mzo,44..distutils-precedence.pth,sha256=fqf_7z_ioRfuEsaO1lU2F_DX_S8FkCV8JcSElZo7c3M,152..pkg_resources/__init__.py,sha256=P3PNN3_m8JJrYMp-i-Sq-3rhK5vuViqqjn1UXKHfe7Q,108202..pkg_resources/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-310.pyc,,..pkg_resources/_vendor/__pycache__/pyparsing.cpython-310.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/packaging/__about__.py,sha256=PNMsaZn4UcCHyubgROH1bl6CluduPjI5kFrSp_Zgklo,736..pkg_resources/_vendor/packaging/__

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.842566724466667
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCfA5S:RtBMwlViQWBBf
MD5:	11AA48DBE7E7CC631B11DD66DC493AEB
SHA1:	249FDB01AD3E3F71356E33E1897D06F23CFB20C2
SHA-256:	3AA464174798E461ECB0CA2B16395B4C8AB4EF6BE91E917AD1F21003A952F710
SHA-512:	EDD5892C9B2FE1F2439C53D2CD05F4478EC360885054BD06AFCF7936F6D066377FEE07796DAE9ECDF810E3D6100E039CAD48F00AD0E3145693D53E844CC5319D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2869
Entropy (8bit):	4.534411891756618
Encrypted:	false
SSDEEP:	48:l9Zvy3g6yj+DsmnA540rZh2Phv4hhpTSeToq:xPAorZoP94hTTSecq
MD5:	629278048EF5BF7880A43409D136981D
SHA1:	04BC1062E0800A8570F1C81751B734E81FA9BBCB
SHA-256:	96478968ADB5BE5B92DB2ECC7E63BFB5B2D88E1F2F6990E066CC33538243F608
SHA-512:	31EB224235746AAFD44FEB872A5743FBED78F2B21317C81A31E5CFB076E67378518C32E09EB92DC5D52BB9863F322924B21F17A636EBDAA4AF027FE24D68D50F
Malicious:	false
Preview:	[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveopts = setuptools.command.saveopts:saveopts.sdist = setuptools.command.sdist:sdist.setopt = setuptools.command.setopt:setopt.test = setuptools.command.test:test.upload_docs = setuptools.comman

C:\Users\user\AppData\Local\Temp\_MEI47442\setuptools-57.4.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.9115956018096876
Encrypted:	false
SSDEEP:	3:3Wd+Nt8AfQYv:3Wd+Nttv
MD5:	789A691C859DEA4BB010D18728BAD148
SHA1:	AEF2CBCCC6A9A8F43E4E150E7FCF1D7B03F0E249
SHA-256:	77DC8BDFDBFF5BBAA62830D21FAB13E1B1348FF2ECD4CDCFD7AD4E1A076C9B88
SHA-512:	BC2F7CAAD486EB056CB9F68E6C040D448788C3210FF028397CD9AF1277D0051746CAE58EB172F9E73EA731A65B2076C6091C10BCB54D911A7B09767AA6279EF6
Malicious:	false
Preview:	_distutils_hack.pkg_resources.setuptools.

C:\Users\user\AppData\Local\Temp\_MEI47442\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1465072
Entropy (8bit):	6.573395442335468
Encrypted:	false
SSDEEP:	24576:kPrlPOhOZxO9hhvpPfRMtmJXRqGedEexiBgvLSHEpkz6FIVaPe+:k5POhOZxO9hhv15rJhqGegyLhpFIc
MD5:	7BB1D577405F1129FAF3EA0225C9D083
SHA1:	60472DE4B1C7A12468D79994D6D0D684C91091EF
SHA-256:	831BA87CB1A91D4581F0ABBCC4966C6F4B332536F70CF481F609C44CC3D987C2
SHA-512:	33B1FD3A289193BFF168C967CAEBC0131732BD04562A770CF2EDAC602AB6D958F7BDE7A0E57BB125A7598852BDAC30F96D0DB46CB4A2460A61A0D914B011ED20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v..f.@.f.@.f.@...@.f.@...A.f.@...A.f.@...A.f.@...A.f.@...A.f.@.f.@nf.@^..A.f.@^..A.f.@^..@.f.@^..A.f.@Rich.f.@........PE..d....O[a.........." .....l...........q.......................................p.......M....`.............................................D!...$.......P...............>.......`......@...T...............................8...............(............................text....k.......l.................. ..`.rdata..d............p..............@..@.data....?...@...6...$..............@....pdata...............Z..............@..@.rsrc........P.......&..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1118448
Entropy (8bit):	5.371925569374372
Encrypted:	false
SSDEEP:	12288:t0lBMmuZ63N6QCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uUs:ilBuVZV0m81MMREtV6Vo4uYUs
MD5:	A40FF441B1B612B3B9F30F28FA3C680D
SHA1:	42A309992BDBB68004E2B6B60B450E964276A8FC
SHA-256:	9B22D93F4DB077A70A1D85FFC503980903F1A88E262068DD79C6190EC7A31B08
SHA-512:	5F9142B16ED7FFC0E5B17D6A4257D7249A21061FE5E928D3CDE75265C2B87B723B2E7BD3109C30D2C8F83913134445E8672C98C187073368C244A476AC46C3EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N$z./J)./J)./J).W.)./J).ZK(./J).ZO(./J).ZN(./J).ZI(./J)YZK(./J).DK(./J)./K)./J)YZG(./J)YZJ(./J)YZ.)./J)YZH(./J)Rich./J)................PE..d....O[a.........." .....B..........`*.......................................@............`.............................................X...h........ .......................0......0L..T............................L..8............`..x............................text....A.......B.................. ..`.rdata.......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\win32\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.113940315233747
Encrypted:	false
SSDEEP:	192:RCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPQRD015dHvcqvn7ycIt/F/:RardA0Bzx14r6nDqCdhv+N/
MD5:	587C3A0118B8F7C92C6D66639A6D6815
SHA1:	4BF1F9B0F66BF0C9814B8355675E305959FFDE78
SHA-256:	8776152A8BC78F7D241788C2E31172814604ED88DC5FA7D10F7A5F649EF2AAAF
SHA-512:	0325611B4C17DFB4FC3E77D7CF4C0F394C1AA9420E70A6F8F0605D9B7C3FA3C34CE9142479A73FA111946D18ED1E0A9EE00E1378DDDED34D32F9CBDB2E0D738D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.f.............'...,...\|...,...e...,...\|...%...\|...&...\|...-......-............../....../....../...Rich....................PE..d......g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...\|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	132608
Entropy (8bit):	5.862449818315769
Encrypted:	false
SSDEEP:	3072:z3/yGM9FDwORzlpKHiG4jNvZNWlRVFhLaNzvqqQvmuquXRPDwle:D6J9pNRznKCG6NRIlRVgvqqQ4uXRP
MD5:	70F81DEC61A66E7656916034EEB53654
SHA1:	8739E1BF230B9834649F4DC45C4C42B49F96E5E2
SHA-256:	250CAC5963EB40FC9DFCB1205D9D3CA3E7A0E49C5863B7736D8D4DCB75E3E45E
SHA-512:	39C72DAACECB54BE8E8088038CA9A1629356C6E4B5D723CC2C01E987C848AF97A762A5B16E5020D8BD0FC0B98D0B899621EE9DC3B86A99A45FA537FE1D3AC117
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V.p...p...p.......p.......p.......p.......p.......p.......p.......p.......p...p...q.......p.......p.......p..Rich.p..........................PE..d......g.........." .........................................................P............`.........................................P...............0..\....................@..X....v..T............................;..8............0.........@....................text............................... ..`.rdata..b....0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\win32\win32trace.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.278083154463425
Encrypted:	false
SSDEEP:	384:4eeH8ZmV+zknwMswDuVQO0T8Dmwel2/QE9BfEA45yn9uku1B+:E+zi/uVQZQ/QE9dcUiB
MD5:	A9FA0D374A60D11D2C787A2E6BFC975D
SHA1:	1D085C6242C9E56ED05E27355B4444979A2C56CD
SHA-256:	48F49C4B575042A5BE98A7291CE91FE56B89B368608E6B12DACA3A6F9CB2DD55
SHA-512:	52EF5B9D9AAC9D511A2DDF87F4E213877A7C01241A67A09FDC8AE572DB2BCFAC86692D1EF22D29D1ED469A1251F139B74FAF998A1D801925099F296C8368B2A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)(U.HF..HF..HF..0...HF..=G..HF..=C..HF..=B..HF..=E..HF.(=G..HF.&=G..HF..0G..HF..HG..HF.(=O..HF.(=F..HF.(=D..HF.Rich.HF.........PE..d......g.........." .....,...,.......(....................................................`......................................... Q..T...tQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI47442\win32com\shell\shell.pyd

Download File

Process:	C:\Users\user\Desktop\builded.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	534528
Entropy (8bit):	6.1711213337115405
Encrypted:	false
SSDEEP:	6144:xLf6Z7NtZXLd50J68K7rJZcblgyRCcynKEHnHyzNQMfxaZQufAHqa/IBf7J:xLCZ7NtZ5aJ68EowcRzHfxo9Bf7J
MD5:	E4E10AB85AC3E4BC87E3E8A54AF835BE
SHA1:	5B38DF52339D6DD09519C983ADE87DF6CABC21F8
SHA-256:	6148E9F3AF597A18E7BC89188C878008B6548A95EFDC2F9F3B6A7CD7B9C572A0
SHA-512:	C2B6EE97AAD6F05235AD7322ECB40CD9EE390FBFC51110E725F2D06C0288BC4395D24210F0337520706F36F0C493A96D00AC728CA99437CE98D02990C3D7F469
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{(#t?IM'?IM'?IM'61.'9IM'm<L&;IM'm<H&,IM'm<I&7IM'm<N&;IM't1I&6IM'.<L&=IM'.<L&;IM't1K&>IM't1L&6IM'?IL'.IM'.<D&xIM'.<M&>IM'.<O&>IM'Rich?IM'................PE..d......g.........." .....0................................................................`.............................................L...<...........L.... ..${..............t!......T...............................8............@..(............................text............0.................. ..`.rdata.......@.......4..............@..@.data........@...`...&..............@....pdata..${... ...\|..................@..@.rsrc...L...........................@..@.reloc..t!......."..................@..B........................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.996054152379608
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	builded.exe
File size:	17'318'617 bytes
MD5:	16a4f448219d7e20a80612d03a0a0f5c
SHA1:	4e86a64e2d2df2b6303cc0bcfae8d2feab157e03
SHA256:	c897f350c048329e77eae707fcf6ee75a6a18d75068927005ee1e8450009b394
SHA512:	49fec18937cf61b18673a7cda00dd23d1e5e449af6450c7a13f7e7ad9074a5350ca8cceded8aa317996ca002d866de4354043d7d47434d677fbdfde719d123d5
SSDEEP:	393216:U9Yi2Vlj87dPCt32Iywq3Obs2ClFInEroXq14S2in8hAZk18kArQKuBN:U9Yi2Vl8ZKt32Iywq3ObRqOErUlQfSe0
TLSH:	32073310BEA458FFD6B7593E8535C02891E1BC214BD0C66F27AC922A5FEB2D0BE34D41
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6786EBD7 [Tue Jan 14 22:57:27 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F09C4C9C22Ch
dec eax
add esp, 28h
jmp 00007F09C4C9BE4Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F09C4C9C5F8h
test eax, eax
je 00007F09C4C9BFF3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F09C4C9BFD7h
dec eax
cmp ecx, eax
je 00007F09C4C9BFE6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007F09C4C9BFC0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F09C4C9BFC9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F09C4C9BFD9h
mov byte ptr [000356F5h], 00000001h
call 00007F09C4C9B725h
call 00007F09C4C9CA10h
test al, al
jne 00007F09C4C9BFD6h
xor al, al
jmp 00007F09C4C9BFE6h
call 00007F09C4CA952Fh
test al, al
jne 00007F09C4C9BFDBh
xor ecx, ecx
call 00007F09C4C9CA20h
jmp 00007F09C4C9BFBCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007F09C4C9C039h
cmp ecx, 01h
jnbe 00007F09C4C9C03Ch
call 00007F09C4C9C56Eh
test eax, eax
je 00007F09C4C9BFFAh
test ebx, ebx
jne 00007F09C4C9BFF6h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007F09C4CA9322h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	fffe21ae57aa2d3079a9016c53ea29fc	False	0.524296875	data	5.750798470810524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:01:13.127968073 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.127990007 CET	443	49705	104.21.77.174	192.168.2.5
Jan 15, 2025 10:01:13.128113031 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.129054070 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.129065037 CET	443	49705	104.21.77.174	192.168.2.5
Jan 15, 2025 10:01:13.658318043 CET	443	49705	104.21.77.174	192.168.2.5
Jan 15, 2025 10:01:13.658993959 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.659003019 CET	443	49705	104.21.77.174	192.168.2.5
Jan 15, 2025 10:01:13.661180019 CET	443	49705	104.21.77.174	192.168.2.5
Jan 15, 2025 10:01:13.661262989 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.662739038 CET	49705	443	192.168.2.5	104.21.77.174
Jan 15, 2025 10:01:13.662950039 CET	49705	443	192.168.2.5	104.21.77.174

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:01:13.098102093 CET	51828	53	192.168.2.5	1.1.1.1
Jan 15, 2025 10:01:13.124876022 CET	53	51828	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 10:01:13.098102093 CET	192.168.2.5	1.1.1.1	0xf8d5	Standard query (0)	webhook.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 10:01:13.124876022 CET	1.1.1.1	192.168.2.5	0xf8d5	No error (0)	webhook.my		104.21.77.174	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:01:13.124876022 CET	1.1.1.1	192.168.2.5	0xf8d5	No error (0)	webhook.my		172.67.210.157	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:01:06
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\builded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\builded.exe"
Imagebase:	0x7ff7a3b20000
File size:	17'318'617 bytes
MD5 hash:	16A4F448219D7E20A80612D03A0A0F5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:01:10
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\builded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\builded.exe"
Imagebase:	0x7ff7a3b20000
File size:	17'318'617 bytes
MD5 hash:	16A4F448219D7E20A80612D03A0A0F5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CStealer, Description: Yara detected CStealer, Source: 00000002.00000002.2230768489.00000194031E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:01:11
Start date:	15/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff6257f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:01:11
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF7A3B28BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28C46

Part of subcall function 00007FF7A3B3A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3A500

Part of subcall function 00007FF7A3B3878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B387F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28CD6
CreateProcessW.KERNELBASE ref: 00007FF7A3B28D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28D18

Part of subcall function 00007FF7A3B22C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
Part of subcall function 00007FF7A3B22C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
Part of subcall function 00007FF7A3B22C50: MessageBoxW.USER32 ref: 00007FF7A3B22D99

RegisterClassW.USER32 ref: 00007FF7A3B28D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28D7B
CreateWindowExW.USER32 ref: 00007FF7A3B28DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E05
PeekMessageW.USER32 ref: 00007FF7A3B28E29
TranslateMessage.USER32 ref: 00007FF7A3B28E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E41
PeekMessageW.USER32 ref: 00007FF7A3B28E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF7A3B29009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B29012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B2901F

Strings

Failed to create child process!, xrefs: 00007FF7A3B28D20
CreateProcessW, xrefs: 00007FF7A3B28D27
PyInstaller Onefile Hidden Window, xrefs: 00007FF7A3B28D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7A3B28D44

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: e4fc686783f1129091db99638aa1a1cebffbb8aea9e547f8718db64a03b5cc8e
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: D9D1A432A0AA8286F790EF74E8546A9B762FF84758F810235DADD63AB4DF3DD104C714

Function 00007FF7A3B21000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7A3B23E0A
pyi-contents-directory, xrefs: 00007FF7A3B23B8D
pyi-python-flag, xrefs: 00007FF7A3B23AD6
Failed to convert DLL search path!, xrefs: 00007FF7A3B23DDC
_PYI_ARCHIVE_FILE, xrefs: 00007FF7A3B238D2, 00007FF7A3B239FF
Failed to remove temporary directory: %s, xrefs: 00007FF7A3B23FC3
_PYI_SPLASH_IPC, xrefs: 00007FF7A3B23A23, 00007FF7A3B23EF5
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7A3B23C61
Failed to load splash screen resources!, xrefs: 00007FF7A3B23E85
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7A3B23B32
Could not create temporary directory!, xrefs: 00007FF7A3B23CBF
Py_GIL_DISABLED, xrefs: 00007FF7A3B23AF4
pyi-disable-windowed-traceback, xrefs: 00007FF7A3B23BB2
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7A3B23D12
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7A3B239DE
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7A3B23EBB
VCRUNTIME140.dll, xrefs: 00007FF7A3B23DB1
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7A3B23882, 00007FF7A3B238AF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7A3B23BE8
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7A3B23A0B, 00007FF7A3B23CD4, 00007FF7A3B23F6B
pkg, xrefs: 00007FF7A3B239BE
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7A3B23EA6
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7A3B23971
Failed to start splash screen!, xrefs: 00007FF7A3B23ED4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7A3B23A17, 00007FF7A3B23A2F, 00007FF7A3B23A9B
pyi-runtime-tmpdir, xrefs: 00007FF7A3B23B68
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7A3B23D35
MEI, xrefs: 00007FF7A3B23933

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction ID: 53ce9c9849c80e0d2636dd54c143d3d4c0c5048146af0c50f8aba3672211b58f
Opcode Fuzzy Hash: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction Fuzzy Hash: 3B32C321A0E6C251FA95FFA094557B9A253AF44780FC64232EACD632F6DF3EE554C320

Function 00007FF7A3B45C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B45CB5

Part of subcall function 00007FF7A3B45608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4561C

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

Part of subcall function 00007FF7A3B3A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7A3B3A94F,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3A979
Part of subcall function 00007FF7A3B3A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7A3B3A94F,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3A99E

_get_daylight.LIBCMT ref: 00007FF7A3B45CA4

Part of subcall function 00007FF7A3B45668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4567C

_get_daylight.LIBCMT ref: 00007FF7A3B45F1A
_get_daylight.LIBCMT ref: 00007FF7A3B45F2B
_get_daylight.LIBCMT ref: 00007FF7A3B45F3C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A3B4617C), ref: 00007FF7A3B45F63

Strings

Eastern Summer Time, xrefs: 00007FF7A3B46021
Eastern Standard Time, xrefs: 00007FF7A3B46009

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 3c3bb102c56ebad51b1393ae4929d0a6daf2b151313e9b2413d0e2eda43c5d93
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 27D1F722E0A65245F7A0FF21D4411B9A352FF44784FC68136EA8D67AB6DF3EE441C364

Function 00007FF7A3B469D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B46749
Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B467C7
Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B46818

CreateFileW.KERNELBASE ref: 00007FF7A3B46ADA
CreateFileW.KERNEL32 ref: 00007FF7A3B46B2A
GetLastError.KERNEL32 ref: 00007FF7A3B46B5A
GetFileType.KERNELBASE ref: 00007FF7A3B46B6F
GetLastError.KERNEL32 ref: 00007FF7A3B46B79
CloseHandle.KERNEL32 ref: 00007FF7A3B46BAC
CloseHandle.KERNEL32 ref: 00007FF7A3B46D0F
CreateFileW.KERNEL32 ref: 00007FF7A3B46D44
GetLastError.KERNEL32 ref: 00007FF7A3B46D53

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 9cf020fd2218fdc4c688cda461dca8970ef47dab443255f969903b25981f88fc
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 63C1F236B29A5186FB90EF64C4812AC7762F748B98B424235DFAEA77E4CF39D411C310

Function 00007FF7A3B283B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B2841B
RemoveDirectoryW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B2849E
DeleteFileW.KERNELBASE(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284BD
FindNextFileW.KERNELBASE(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284CB
FindClose.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284DC
RemoveDirectoryW.KERNELBASE(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284E5

Strings

%s\*, xrefs: 00007FF7A3B283E2

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
Instruction ID: 8d1eba053c0aa4e779df41e2a6177281567e3d99fdf5e25ffe1ea993bd01c88c
Opcode Fuzzy Hash: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
Instruction Fuzzy Hash: 4C41C621A1E58282EAB0BFA4E4449B9A362FF94754FC10331D5EEA36E4DF3DD5058710

Function 00007FF7A3B45EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B45F1A

Part of subcall function 00007FF7A3B45668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4567C

_get_daylight.LIBCMT ref: 00007FF7A3B45F2B

Part of subcall function 00007FF7A3B45608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4561C

_get_daylight.LIBCMT ref: 00007FF7A3B45F3C

Part of subcall function 00007FF7A3B45638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4564C

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A3B4617C), ref: 00007FF7A3B45F63

Strings

Eastern Summer Time, xrefs: 00007FF7A3B46021
Eastern Standard Time, xrefs: 00007FF7A3B46009

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: caf97e812170ea314b952396c26f9b2eca3818a770983570dbb9532eb73a0f9a
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 1D517532A0A64286F790FF21D4815A9E762BB48744FC64136EACD637B6DF3EE4408764

Function 00007FF7A3B292F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7A3B29323
FindClose.KERNELBASE ref: 00007FF7A3B29332

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: bcddbf3ea577ed54b8022e2992a5134d83d4a1726061a69f7582b6174296c77d
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 4DF0CD22629781C7F7E09F90B449B66B351AB48324F450335DAED116E4DF3DD1588710

Function 00007FF7A3B40938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 7ec3cee42b5f955a7a508d434ed4ddeb7af7e64d5d76afadd68bbf60dbb84e93
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 0002CF21A1F65240FAD9BF11A401279E692AF45B90FD74634DDDD6ABF2DF3EE4008328

Function 00007FF7A3B21950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B27F80: _fread_nolock.LIBCMT ref: 00007FF7A3B2802A

_fread_nolock.LIBCMT ref: 00007FF7A3B21A1B

Part of subcall function 00007FF7A3B22910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7A3B21B6A), ref: 00007FF7A3B2295E

Strings

malloc, xrefs: 00007FF7A3B21B22
Could not allocate buffer for TOC!, xrefs: 00007FF7A3B21B1B
Error on file., xrefs: 00007FF7A3B21B8D
Failed to seek to cookie position!, xrefs: 00007FF7A3B219EE
fseek, xrefs: 00007FF7A3B219F5
Could not read full TOC!, xrefs: 00007FF7A3B21B55
calloc, xrefs: 00007FF7A3B21A68
Failed to read cookie!, xrefs: 00007FF7A3B21A2B
fread, xrefs: 00007FF7A3B21A32, 00007FF7A3B21B5C
Could not allocate memory for archive structure!, xrefs: 00007FF7A3B21A61
MEI, xrefs: 00007FF7A3B21991

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 2a1d170e840dceaee6f2da0756e3de0371e7b12602e63a76cd509f1e6af33911
Instruction ID: 4c985985b847523fd6c12ff3a3e9cf7e235490be1990d3d1de967c07aaedcfe8
Opcode Fuzzy Hash: 2a1d170e840dceaee6f2da0756e3de0371e7b12602e63a76cd509f1e6af33911
Instruction Fuzzy Hash: 1081C471A0E6C286E7A0FF54D0416F9A3A2EF44780F864131EACD67BB5DE3EE1458720

Function 00007FF7A3B21600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7A3B217CA
fopen, xrefs: 00007FF7A3B21663
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7A3B21742
fwrite, xrefs: 00007FF7A3B217D1
malloc, xrefs: 00007FF7A3B21749
fseek, xrefs: 00007FF7A3B216E1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B217DF
Failed to extract %s: failed to open target file!, xrefs: 00007FF7A3B2165C
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B216DA
fread, xrefs: 00007FF7A3B217E6
Failed to create symbolic link %s!, xrefs: 00007FF7A3B21622
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B216A2

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 79a07ce5d44a4a527e320f9bba7b0693ac174a5d9842ddaaf57a302337259006
Instruction ID: 35bdbcd101cbb3b57b34ac0eb12a3baff017326a6052ad3d75ce3a8f80a5998d
Opcode Fuzzy Hash: 79a07ce5d44a4a527e320f9bba7b0693ac174a5d9842ddaaf57a302337259006
Instruction Fuzzy Hash: 2F51B461B0A68382EA94FF9194005B9E352BF44794FC64231EECC27BB5DF3EE5458720

Function 00007FF7A3B28850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B288F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B288FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B2893C

Part of subcall function 00007FF7A3B28A20: GetEnvironmentVariableW.KERNEL32(00007FF7A3B2388E), ref: 00007FF7A3B28A57
Part of subcall function 00007FF7A3B28A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7A3B28A79

Part of subcall function 00007FF7A3B382A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B382C1

Part of subcall function 00007FF7A3B22810: MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

TMP, xrefs: 00007FF7A3B2888C, 00007FF7A3B28993
TMP, xrefs: 00007FF7A3B288B2
_MEI%d, xrefs: 00007FF7A3B28902
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7A3B2896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7A3B288CC

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 54006214e56b68227c22573bd94779dd78c5d81a9803b0b06714dcbc65b7ce05
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: EC41F811B0B69245F994FFA2A8515F99353AF84780FC60231DD8DA7BF6DD3ED5048320

Function 00007FF7A3B21210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7A3B2141E
1.3.1, xrefs: 00007FF7A3B21249
malloc, xrefs: 00007FF7A3B212C1, 00007FF7A3B212F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7A3B21276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7A3B212EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7A3B212BA

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction ID: abee2a252b6583f0299ea6bfa252d85ab537f802ea849ed4ad626dc088f10ecc
Opcode Fuzzy Hash: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction Fuzzy Hash: BB51E622A0A68281E6A4FF51A4007BAE292BF85794FC54231EDCD67BF5DE3DE505C710

Function 00007FF7A3B3ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7A3B3F11A,?,?,-00000018,00007FF7A3B3ADC3,?,?,?,00007FF7A3B3ACBA,?,?,?,00007FF7A3B35FAE), ref: 00007FF7A3B3EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF7A3B3F11A,?,?,-00000018,00007FF7A3B3ADC3,?,?,?,00007FF7A3B3ACBA,?,?,?,00007FF7A3B35FAE), ref: 00007FF7A3B3EF08

Strings

api-ms-, xrefs: 00007FF7A3B3EE46
ext-ms-, xrefs: 00007FF7A3B3EE59

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: ecaa3ed4eab745445aaf5182c0a324d129e5cb9c75ccc18047256c0c10523a05
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: EA414C22B1B62581FAD9EF169804575A393BF44B90FCA4136DD9D67FA4DE3EE4048320

Function 00007FF7A3B236B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7A3B23804), ref: 00007FF7A3B236E1
GetLastError.KERNEL32(?,00007FF7A3B23804), ref: 00007FF7A3B236EB

Part of subcall function 00007FF7A3B22C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
Part of subcall function 00007FF7A3B22C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
Part of subcall function 00007FF7A3B22C50: MessageBoxW.USER32 ref: 00007FF7A3B22D99

Strings

Failed to obtain executable path., xrefs: 00007FF7A3B236F3
GetModuleFileNameW, xrefs: 00007FF7A3B236FA
Failed to convert executable path to UTF-8., xrefs: 00007FF7A3B23790
\\?\, xrefs: 00007FF7A3B2375A
Failed to resolve full path to executable %ls., xrefs: 00007FF7A3B23739

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: abf5afe994366ca9a260bd1075303f90bb5c3ed1f160f21507332d6845244ae8
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: FC21B651B0E58251FAE0BF60E801BB5A252BF84744FC10332E5DDA65F5EE3EE204C724

Function 00007FF7A3B3BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BEF9

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: 0d4033c6dd48f79de188da7ee29b012e0cc29fe15cba9e53705d7d0bcf761cf7
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: 8CC1D82290E6A6D2E7A8EF1594012BDA752EB41B80FD74131EACD13FB5CF7EE4458320

Function 00007FF7A3B28760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7A3B28780
OpenProcessToken.ADVAPI32 ref: 00007FF7A3B28793
GetTokenInformation.KERNELBASE ref: 00007FF7A3B287B8
GetLastError.KERNEL32 ref: 00007FF7A3B287C2
GetTokenInformation.KERNELBASE ref: 00007FF7A3B28802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A3B2881E
CloseHandle.KERNEL32 ref: 00007FF7A3B28836

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 527189d301cca72a61bdb79b633a837abd7c73eaca583aff99f53ea01ef84adf
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 0D219821A0D68282EB90AF95B450539E3A2FB817A0F950335DAED97BF8DE7DD4448710

Function 00007FF7A3B290E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B28760: GetCurrentProcess.KERNEL32 ref: 00007FF7A3B28780
Part of subcall function 00007FF7A3B28760: OpenProcessToken.ADVAPI32 ref: 00007FF7A3B28793
Part of subcall function 00007FF7A3B28760: GetTokenInformation.KERNELBASE ref: 00007FF7A3B287B8
Part of subcall function 00007FF7A3B28760: GetLastError.KERNEL32 ref: 00007FF7A3B287C2
Part of subcall function 00007FF7A3B28760: GetTokenInformation.KERNELBASE ref: 00007FF7A3B28802
Part of subcall function 00007FF7A3B28760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A3B2881E
Part of subcall function 00007FF7A3B28760: CloseHandle.KERNEL32 ref: 00007FF7A3B28836

LocalFree.KERNEL32(?,00007FF7A3B23C55), ref: 00007FF7A3B2916C
LocalFree.KERNEL32(?,00007FF7A3B23C55), ref: 00007FF7A3B29175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7A3B29183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7A3B29142
D:(A;;FA;;;%s), xrefs: 00007FF7A3B29157
S-1-3-4, xrefs: 00007FF7A3B29121

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction ID: 76fa0d4d3236f4a3ac72b8783aaede26b382819edb2146c9e147ba1ff64f31a7
Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction Fuzzy Hash: 8B218121B0A78285F780BF50E4157EAB252FF88780FC60135EA8D637A6DF3ED4008360

Function 00007FF7A3B27E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF7A3B2352C,?,00000000,00007FF7A3B23F23), ref: 00007FF7A3B27F22

Strings

%.*s, xrefs: 00007FF7A3B27EDB
%s%c, xrefs: 00007FF7A3B27E94
\, xrefs: 00007FF7A3B27E87

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: 2492e31f17411689d10e414d40ead7e851728adc7afc385c6a3e85a54e69eee2
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: BA311A6171AAC145FAA1AF10A451BEAA355EF84BE0F810330EEED577EADE2DD2018710

Function 00007FF7A3B3CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B3CFBB), ref: 00007FF7A3B3D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B3CFBB), ref: 00007FF7A3B3D177

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: dd5283ee3991216c8abba2e56d138b5151f7218a88af6b87100fcd2c8eb3618d
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 5E910832F1976185F794AF6598402BCABA2AB40B84F954139DE8E77EA4CF3ED441C720

Function 00007FF7A3B3F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B3FAEC
_get_daylight.LIBCMT ref: 00007FF7A3B3FAFD
_get_daylight.LIBCMT ref: 00007FF7A3B3FB0E
_isindst.LIBCMT ref: 00007FF7A3B3FBD9

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 98f28aa6dd58ed946582f0688e33363d78f690e73e6a08554a631d900b9d3c91
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 1D513B72F0652186FB58EF2899516BCA763AB10358F920136DD5E63EF5EF3DA401C710

Function 00007FF7A3B357EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF7A3B3581F
GetFileInformationByHandle.KERNELBASE ref: 00007FF7A3B35881
GetLastError.KERNEL32 ref: 00007FF7A3B35912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B35724), ref: 00007FF7A3B3595E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 807ebeca4c7bcb8acf9fb6a2a0a1f33daea53434aebb29fa93c05d8e4440eb87
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 9251E322E052518AFB98EF71D4543BD63A2AB44B58F564536DE8D67EA8DF3DD0408320

Function 00007FF7A3B35698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B356C5
CreateFileW.KERNELBASE ref: 00007FF7A3B35704
CloseHandle.KERNEL32 ref: 00007FF7A3B35739

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: b2ad6f7ccf1f8b659f11f5ecd0274c7e55f7bc816ef0f73c7631ff77c717537c
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: 6141B322E1979183E398EF209514379A261FB94754F518335E6DC13EE1DF6DA4E08760

Function 00007FF7A3B2CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B2CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7A3B2CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7A3B2CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7A3B2CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7A3B2CD91

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 5a408877c1183e3b7325827a07aefd4d4a2805cd0d6e99045ed034c53c1f8c9f
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: C8315D10E0E28245FAE4BFA49421BB9A6839F41384FC60635D6CD676F7DE2FA4058231

Function 00007FF7A3B39AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7A3B39A9C), ref: 00007FF7A3B39AB1
TerminateProcess.KERNEL32(?,?,?,00007FF7A3B39A9C), ref: 00007FF7A3B39ABC
ExitProcess.KERNEL32 ref: 00007FF7A3B39ACB

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: e27601180f1410ffdd5329d3474d7cc339302a179a3e66a97bd19bf7c3082a87
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 71D05E10B1A70687FB887F301C98178A2136F48B40F861438C9CB26BB3ED3EA40C4320

Function 00007FF7A3B301AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B301F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B302E7

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 172dea6ede5df94c3a544b523b10cacb5da7c2b33d1e43a4ed145f88f2f37af7
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: FB510B21B0B66146F7ACAD25940067AE293BF44BA4F964730DDEE23FE5CF3ED5018621

Function 00007FF7A3B3C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7A3B3C33D), ref: 00007FF7A3B3C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7A3B3C33D), ref: 00007FF7A3B3C1FA

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 518ec3352aa66293dd6046cd2a2c2872677ba7b28e54b8fe80f54b2cb4f43246
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 8011E261B09A9181DA94AF65B804069F362AB41BF0F950331EEBD5BFF9CF7DD0058700

Function 00007FF7A3B35994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B358A9), ref: 00007FF7A3B359C7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B358A9), ref: 00007FF7A3B359DD

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: 4a91560b097d395c7ae025bf07b6ca5ae0239ff8e6b3fdef35b1da79572b1213
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 6111C13260D65282EA98AF11A44113AF762FB84771F910236FADD91DF8EF6DD114DB20

Function 00007FF7A3B3A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 1c7ae19908d349c071fba142e6719fed6c9cd6196a60dae7f1d79e823d916529
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 5CE04811E0B11282FF9C7FB2544517852525F84741B860134D99D72AB1DE2D54454320

Function 00007FF7A3B3ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7A3B3AA45,?,?,00000000,00007FF7A3B3AAFA), ref: 00007FF7A3B3AC36
GetLastError.KERNEL32(?,?,?,00007FF7A3B3AA45,?,?,00000000,00007FF7A3B3AAFA), ref: 00007FF7A3B3AC40

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 52ee82a873438b010b68df26915721b14e4560e149e8a6ac5dc5155ed6c28cab
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: FA21FC10F1E66241FED87F25A850279E3835F84790FDA4234D99E57FE2CE6EE4444311

Function 00007FF7A3B3BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BF44

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction ID: a4e8ddff93c1387616c161f10057a8f4fb0cde323ccd38ec5c8d3a6f67380717
Opcode Fuzzy Hash: 77f2f9c0c3853e5df4dc99a11e1b25eaa2aec769d06f52d5773e5caefc843251
Instruction Fuzzy Hash: E141083290A25187EABCEF59A440279F3A2EB55B40F911131D6CE53EE5CF2EE402CB71

Function 00007FF7A3B27F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7A3B2802A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: da6d8642933419ebf05c3617bd1a462a1bcc311e92338bbe222da65283b0d714
Instruction ID: 5bdb8a6e7ec4c738c08a9292d06a3031aa2d05b12a86ed313c70dd4ab39909bc
Opcode Fuzzy Hash: da6d8642933419ebf05c3617bd1a462a1bcc311e92338bbe222da65283b0d714
Instruction Fuzzy Hash: 6D21F811B0A79185FA94BF5264007BBD752BF45BC4FCE4430EE8D67B96CE3EE0418610

Function 00007FF7A3B3B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BA32

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: b7d3c37de9898df05972a5e492cd2bf32b4f69a5b2b6b29bbd9c9dfc766ef411
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: FE31C721919A6286F798BF55840137CAA51AF40B94FC70135D99D23FF2CF7EE4418731

Function 00007FF7A3B399D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A3B399FF

Part of subcall function 00007FF7A3B39AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF7A3B39B1D
Part of subcall function 00007FF7A3B39AF8: GetProcAddress.KERNEL32 ref: 00007FF7A3B39B33
Part of subcall function 00007FF7A3B39AF8: FreeLibrary.KERNEL32 ref: 00007FF7A3B39B5A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: e6a7b8e11369610db55a955a84c8f18c20d8163bdcbe631d056c2c388e94407d
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 72219F32A067918EEBA8AF68C4403EC73A2EB44718F850635D69D26FE5DF3DD444C760

Function 00007FF7A3B36004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B35F69

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 0b5c6c55093ab0d0f26685c1f22ed4525e319fc2daf1e60b35ec3bd51ac9d819
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 18118422A1E66141EAA8FF1194051BDE266AF45B84FD64032EBCC77EB6DF3ED4408720

Function 00007FF7A3B463C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B463E7

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 762c549be86612a9fb3ac974735a73b68ab84d8ee9379a6f55aa030b5878e926
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 5321FC7261968147EBE49F18E440379F762FB84B54F950234D6DD976E5DF3ED8008B10

Function 00007FF7A3B3042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B30480

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 39d7b263bfa548f9cb031719f5733e82c1df9653b112ae5cea5ec08b046ef67d
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: DB01A561A0976140E988EF565901169E6A6AF85FE0F8A4631EEDD27FE6CE3EE1014310

Function 00007FF7A3B37F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B37FAA

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: 9c1d2592db507154769d4c7a0d02045a4a9cb4aa28264b8497d001480188fc0f
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: 6F01A120E0F6A340FAD87F256542179D192BF44790FD64235E9EC62EF6DF3EA4408232

Function 00007FF7A3B382A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B382C1

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 26aa9f545e5f94ba33cb2268b6c6ed39164df3350437cab49e11cd1f382cad23
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: C1E08658E0E61342F69C3EA448831BD95135F45380FC74430DD9876EF3DE2E684C4232

Function 00007FF7A3B3EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7A3B3B39A,?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA), ref: 00007FF7A3B3EC5D

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: c9fb10483adac5a99b9c94501391875d2b0546ba7138d83d0fd37da17080b6f0
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 4EF04F45B0B22655FEDC7E6254513B9D6925F44B80FCE4431C98E67FF1DE2EE4804230

Function 00007FF7A3B3D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7A3B30D00,?,?,?,00007FF7A3B3236A,?,?,?,?,?,00007FF7A3B33B59), ref: 00007FF7A3B3D6AA

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 2ebd327048ff050b603dc9e8c724df69e4f3ea1965146595dbf736838f6aae49
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 2FF03A00B4B36645FAD87EA2580167892A24F547A0F8A0334D9BE65FF2DE2EE4408530

Non-executed Functions

Function 00007FF7A3B25820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25830
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25842
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25879
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2588B
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258A4
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258B6
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258CF
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258E1
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258FD
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2590F
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2592B
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2593D
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25959
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2596B
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25987
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25999
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B259B5
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B259C7

Strings

PyUnicode_Join, xrefs: 00007FF7A3B25F99, 00007FF7A3B25FBB
PyImport_ExecCodeModule, xrefs: 00007FF7A3B25C01, 00007FF7A3B25C23
PyConfig_SetWideStringList, xrefs: 00007FF7A3B25A63, 00007FF7A3B25A85
Py_PreInitialize, xrefs: 00007FF7A3B2594F, 00007FF7A3B25971
PyErr_NormalizeException, xrefs: 00007FF7A3B25AED, 00007FF7A3B25B0F
PyEval_EvalCode, xrefs: 00007FF7A3B25BA5, 00007FF7A3B25BC7
PyErr_Clear, xrefs: 00007FF7A3B25A91, 00007FF7A3B25AB3
PyUnicode_Replace, xrefs: 00007FF7A3B25FC7, 00007FF7A3B25FE9
Py_Finalize, xrefs: 00007FF7A3B258C5, 00007FF7A3B258E7
PyMem_RawFree, xrefs: 00007FF7A3B25C8B, 00007FF7A3B25CAD
Py_DecodeLocale, xrefs: 00007FF7A3B2586F, 00007FF7A3B25891
PyErr_Print, xrefs: 00007FF7A3B25B49, 00007FF7A3B25B6B
PyErr_Fetch, xrefs: 00007FF7A3B25ABF, 00007FF7A3B25AE1
PyObject_CallFunctionObjArgs, xrefs: 00007FF7A3B25D15, 00007FF7A3B25D37
PyErr_Restore, xrefs: 00007FF7A3B25B77, 00007FF7A3B25B99
PySys_GetObject, xrefs: 00007FF7A3B25E57, 00007FF7A3B25E79
PyConfig_SetBytesString, xrefs: 00007FF7A3B25A07, 00007FF7A3B25A29
PyConfig_InitIsolatedConfig, xrefs: 00007FF7A3B259AB, 00007FF7A3B259CD
Py_ExitStatusException, xrefs: 00007FF7A3B2589A, 00007FF7A3B258BC
PyConfig_Read, xrefs: 00007FF7A3B259D9, 00007FF7A3B259FB
PyStatus_Exception, xrefs: 00007FF7A3B25E29, 00007FF7A3B25E4B
PyErr_Occurred, xrefs: 00007FF7A3B25B1B, 00007FF7A3B25B3D
PyUnicode_FromFormat, xrefs: 00007FF7A3B25F3D, 00007FF7A3B25F5F
PyImport_ImportModule, xrefs: 00007FF7A3B25C2F, 00007FF7A3B25C51
PyConfig_SetString, xrefs: 00007FF7A3B25A35, 00007FF7A3B25A57
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7A3B25DCD, 00007FF7A3B25DEF
Py_IsInitialized, xrefs: 00007FF7A3B25921, 00007FF7A3B25943
PySys_SetObject, xrefs: 00007FF7A3B25E85, 00007FF7A3B25EA7
PyObject_CallFunction, xrefs: 00007FF7A3B25CE7, 00007FF7A3B25D09
GetProcAddress, xrefs: 00007FF7A3B25858
Py_DecRef, xrefs: 00007FF7A3B25826, 00007FF7A3B25848
PyObject_GetAttrString, xrefs: 00007FF7A3B25D43, 00007FF7A3B25D65
PyConfig_Clear, xrefs: 00007FF7A3B2597D, 00007FF7A3B2599F
PyUnicode_FromString, xrefs: 00007FF7A3B25F6B, 00007FF7A3B25F8D
PyObject_Str, xrefs: 00007FF7A3B25D9F, 00007FF7A3B25DC1
PyMarshal_ReadObjectFromString, xrefs: 00007FF7A3B25C5D, 00007FF7A3B25C7F
PyUnicode_DecodeFSDefault, xrefs: 00007FF7A3B25F0F, 00007FF7A3B25F31
Py_InitializeFromConfig, xrefs: 00007FF7A3B258F3, 00007FF7A3B25915
PyRun_SimpleStringFlags, xrefs: 00007FF7A3B25DFB, 00007FF7A3B25E1D
PyModule_GetDict, xrefs: 00007FF7A3B25CB9, 00007FF7A3B25CDB
PyUnicode_AsUTF8, xrefs: 00007FF7A3B25EB3, 00007FF7A3B25ED5
PyUnicode_Decode, xrefs: 00007FF7A3B25EE1, 00007FF7A3B25F03
Failed to get address for %hs, xrefs: 00007FF7A3B25851
PyObject_SetAttrString, xrefs: 00007FF7A3B25D71, 00007FF7A3B25D93
PyImport_AddModule, xrefs: 00007FF7A3B25BD3, 00007FF7A3B25BF5

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 6673b4ff94afab7c149fcb68319ab9c0c0169d50e5bf7f93c46953a48c2e96d6
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 5122AA20A0FB4BE2FAD5FF55A814574E366AF04B41BC61136C9DE22370EF7EB5488225

Function 00007FF7A3B4411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7A3B4416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B447D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B44C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B44E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B45067
memcpy_s.LIBCPMT ref: 00007FF7A3B45142
memcpy_s.LIBCPMT ref: 00007FF7A3B451ED
memcpy_s.LIBCPMT ref: 00007FF7A3B452BC

Strings

1#QNAN, xrefs: 00007FF7A3B44283
1#IND, xrefs: 00007FF7A3B44257
1#INF, xrefs: 00007FF7A3B44293
1#SNAN, xrefs: 00007FF7A3B4427A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 31bcf14d118d2d17b2ac506eeae57782f88b28c8c40015f4b0bf42212b213d3a
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: D6B22672E192828BF7A4DE64D4417FCB7A2FB44388F811135DA4E67A94DF3AE900CB54

Function 00007FF7A3B2AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid literal/lengths set, xrefs: 00007FF7A3B2B1A3
invalid bit length repeat, xrefs: 00007FF7A3B2B109
invalid distances set, xrefs: 00007FF7A3B2B210
invalid code -- missing end-of-block, xrefs: 00007FF7A3B2B136
too many length or distance symbols, xrefs: 00007FF7A3B2AEB6
invalid distance too far back, xrefs: 00007FF7A3B2B6E0
invalid literal/length code, xrefs: 00007FF7A3B2B452
invalid distance code, xrefs: 00007FF7A3B2B624
invalid code lengths set, xrefs: 00007FF7A3B2AE9D

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: eaf9a3d5c27cbac04f66165e652513b6f4757bcfbbfb7a98c8b05d81ea3342f2
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: A7521572A156E68BD7949F15C458F7EBBAAFB44340F424239E68A93790DF3ED840CB10

Function 00007FF7A3B2D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7A3B2D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF7A3B2D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A3B2D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A3B2D240
IsDebuggerPresent.KERNEL32 ref: 00007FF7A3B2D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B2D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B2D2BC

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 31bd836aa4dca6d69a12040644bb50667ee2a91fd22fa37bef97dcd48a7377e3
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 91316272A09B8186EBA0DF60E8407EE7365FB84704F454139DB8D57BA5DF39C548C724

Function 00007FF7A3B3A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A3B3A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A3B3A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A3B3A750
IsDebuggerPresent.KERNEL32 ref: 00007FF7A3B3A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B3A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B3A79E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: eb680d5f40c7f7304a559682e9a79a188b4625c66251e004918a7363b85b5e9b
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 1D31B332609B8186EBA0DF24E8407AEB3A5FB88754F950135EACD53BA5DF3DC145CB10

Function 00007FF7A3B418E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B41930
FindFirstFileExW.KERNEL32 ref: 00007FF7A3B41A3A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: fe6692428a1571d5511293155c3455b67f4a27c45399d9a8607adb8416462d1b
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: 9EB1B522F5A69241FAA1EF2194001B9E352EB44BD4F964131DEDE27BF5EE3DE441C314

Function 00007FF7A3B2D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A3B2D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF7A3B2D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF7A3B2D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7A3B2D0D6

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: ce0a79b17b906597ea7843ed9e6c2702f6d943e911a0bcc315884647b985ed4c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: D5118822B15B05CAFB80EF70E8452A973A0FB08718F840E31DAAD927A4DF38D0548390

Function 00007FF7A3B43C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7A3B43CE6
memcpy_s.LIBCPMT ref: 00007FF7A3B43D11

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 47154445209266e21971079a30afdb0941dc0496ab8cadec19fe5d899e34e5a4
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: F2C14B7271A28587E764DF15A0446AAF7A2F794784F868134DB8E53B94DB3EE810CB04

Function 00007FF7A3B2A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7A3B2A535
header crc mismatch, xrefs: 00007FF7A3B2A991
, xrefs: 00007FF7A3B2A5CB

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: dc958f2c7bce2860ccd72032fa9036074b616ad09de9a4d24754bb959ea70745
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 56F19472A1A3C58BE7D5AF558088F3ABBAAEF44740F474634EA89673A0CF39D540C750

Function 00007FF7A3B49798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7A3B499E7
RaiseException.KERNEL32 ref: 00007FF7A3B499F8

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 61f15b781e831d0263723d2fa398a2473c4d71198071fbcd3464410feb77973a
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: E9B17B73A05B898FEB55CF29C8463687BA1F784B88F16C821DA9D837B4CB3AD451C714

Function 00007FF7A3B33A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7A3B33DC4
, xrefs: 00007FF7A3B33B82

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: c63e298121d63e1d1ac623c11de1cef389031c560b13755ff3f113cad3fdb581
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: FBE1B732A0A66641E7ACAE15805013EB362FF45B44F966135EA8E27EF4DF3FE841C710

Function 00007FF7A3B2A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF7A3B2A4CB
invalid window size, xrefs: 00007FF7A3B2A4B2

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: afd268b5280e8e5787930839070af02af8978484ba5d02a1343e350826bbdcf2
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: A091D672A192C68BE7E49F55C448F3E7B9AFB44340F524239DA9A567A0CF39E540CB10

Function 00007FF7A3B3DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7A3B3E0EA
e+000, xrefs: 00007FF7A3B3E06D

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: de21752da740bc6f50050995bc05cc12a141f977207fa94cc374f31ca98e84f8
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 74519A23B196D186E7A89E359801769F792E744B94F8A8232CBD847EE1CF3FE4008710

Function 00007FF7A3B3DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7A3B3DE0E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 4ffea7c49505cad158a04e0c7290e1d362710d7655df435645ba7a475a5cbb95
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: ECA17B63A0A7D586EBA9DF25A0007B9BB92EB50784F828035DECD57FA1DE3ED501C310

Function 00007FF7A3B38804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7A3B38823

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 3c36e7e5524e8e2a9cc002ac473e42e21201eca653e4a2f7ca1e78b72a42a5c6
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 9651BA05F0A26241FADCBE26550117AD2936F44BC4FDA5134DE8DA7FF1EE3EE4094225

Function 00007FF7A3B434F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7A3B434F4

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: f0a1d8162c47af5ad20bb63921c3daa2a9b3cac7d537b07c1c8980536a016f6a
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: FFB09220E07A42C3FE887F216C8221862A67F48700FDA0138C28D60330DE3D20E55B21

Function 00007FF7A3B33610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: f33cae96aec072c897f7039e8f2de4cf83151a7729312f96ec7c2f004c8758d5
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: 25D1FD6690A66285E7EC9E25804067EA352EF05B48F962235DD8D27FF4CF3FE445C710

Function 00007FF7A3B29870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: c527ed40efae7a709d0ca0a67bebcbcdd0c762aaebc67db16e596211e55a4486
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: 98C19C762181E08BD28AEB29E4794BA73E1F78930DBD5416BEF87477C5C63CA414DB20

Function 00007FF7A3B32C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: e3c185e1c4661e6d9aa7bda26158d018141f287b7ad380b66c151695a5f48580
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: CBB1B13290A76585E7A89F29E05013CBBA1E709F48FA60135CB9D5BFA5CF3EE441C760

Function 00007FF7A3B3E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 0ef8aed52283772db3ef67ce35fd13758787ea5c9a7a75715db5750f0c0ae901
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 79810573A0979186E7B8DF19944037ABA92FB45794F914236DACD63FA5CF3EE4008B10

Function 00007FF7A3B46488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction ID: 83074ea7a111ef6fbe73947e064d04b384b0372e10dd290c792770c51f02679b
Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction Fuzzy Hash: B3612E32E0E29646F7E4AD28840437DE693AF40760F974239D69D66AF5DE7FE8008724

Function 00007FF7A3B319B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 1e41a3c163bcf6622b3d39a36aee066c103e305f8c64acec8f1f49c78a542021
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 39519936A1966181E768AF29C040238B365EB44B59F654131CADD27FB4DF3FE843C750

Function 00007FF7A3B321D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 8328201ba925fb511333c3670dae5449b3121847234594c5b0ba2bf21c0b3070
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 6351A732A1966585E7A89F19D440238B3A2EB54B58F654131CEDD2BFB4CB3FE843C750

Function 00007FF7A3B31DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 57efa2353a6a8474507c86236683888ccfd3fa14f43d8a502588583c1e8508c8
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 67516836A1667581E768AF15D0402287366EB58B58F654131CA8D27FB5CF3FE842C750

Function 00007FF7A3B31BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 78a7e588e1e8ef877b6df2d8839841ee6ae35e3660721d40a17c92c2edcead69
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 5751DC32A1966185E7A8AF19C04023877A6EB45B58FA54131CE8C2BFB4CF3FE853C750

Function 00007FF7A3B317B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 7d04d6a2b9ec65eba8853f3895f071994cda8588af27c43630d7aef0d28d36fc
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 5D51B836A1566185E7A8AF18C04023CA3A6EB48B58F654131CE8D27FB4CF3FE853C754

Function 00007FF7A3B31FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 92b193c73db3335132933b8fa7a3d8ca0b3a28b190e20e539a4f444e8edad294
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: AF519636A15A6185E7689F28E44026867A2EB44B58F654131CE9C2BFB4CB3FEC46C750

Function 00007FF7A3B35DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: b4850f1eb43d5063d8d81de4216eaf4882baff991c5a66bf9f5bf5971bf0bdfa
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 6341C97280B6BE44E9EDDD28050C6B8D6829F22BA0DD91272DCD973FE2DD0F69468121

Function 00007FF7A3B39F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: e739f74f17350a11a72453efbc25b72334bd829a4923d988fcd4270f0a21be6d
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 8D411823715A5581EF88DF2AD9141A9B392FB48FD0B9A9033DE4DA7F64DE3ED4418300

Function 00007FF7A3B38154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction ID: 57ee2d786a27d14580da3f220d95299fc66e2d8c5a58f1fce4ed529dfcb7180a
Opcode Fuzzy Hash: 2b8cddb4ee5dd57f1c7573491c8f445712dd312cb7e9e547cfd0f9c072f4c0c7
Instruction Fuzzy Hash: FB31D632B0AB5281E798AF25A84013DE696AB84BD0F954239EADDB3FE5DF3DD0014314

Function 00007FF7A3B495E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 2a472a6df5f995773dc47fddc2ec69487340d1cdbc246f81e99082b73729d732
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 80F06871B192958ADBD89F69A40262977D1F7483C0F848039E5CD83B64DB3DD1618F14

Function 00007FF7A3B2D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: d70541a02c0e414e98af59a4a3ed20f1135072f4a52b921a1f1cfdb60c389857
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 05A00221D0EE4AD1F6C4EF54E890975A732FB50300BD20139E1DD610B09F3EA500D364

Function 00007FF7A3B276B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7A3B276C7
GetLastError.KERNEL32 ref: 00007FF7A3B276D9
GetProcAddress.KERNEL32 ref: 00007FF7A3B27715
GetLastError.KERNEL32 ref: 00007FF7A3B27727
GetProcAddress.KERNEL32 ref: 00007FF7A3B27740
GetLastError.KERNEL32 ref: 00007FF7A3B27752
GetProcAddress.KERNEL32 ref: 00007FF7A3B2776B
GetLastError.KERNEL32 ref: 00007FF7A3B2777D
GetProcAddress.KERNEL32 ref: 00007FF7A3B27799
GetLastError.KERNEL32 ref: 00007FF7A3B277AB
GetProcAddress.KERNEL32 ref: 00007FF7A3B277C7
GetLastError.KERNEL32 ref: 00007FF7A3B277D9
GetProcAddress.KERNEL32 ref: 00007FF7A3B277F5
GetLastError.KERNEL32 ref: 00007FF7A3B27807
GetProcAddress.KERNEL32 ref: 00007FF7A3B27823
GetLastError.KERNEL32 ref: 00007FF7A3B27835
GetProcAddress.KERNEL32 ref: 00007FF7A3B27851
GetLastError.KERNEL32 ref: 00007FF7A3B27863

Strings

Tcl_DoOneEvent, xrefs: 00007FF7A3B27761, 00007FF7A3B27783
Tcl_CreateObjCommand, xrefs: 00007FF7A3B27A6F, 00007FF7A3B27A91
Tcl_ConditionNotify, xrefs: 00007FF7A3B2795B, 00007FF7A3B2797D
Tcl_MutexUnlock, xrefs: 00007FF7A3B278D1, 00007FF7A3B278F3
Tcl_GetString, xrefs: 00007FF7A3B27A9D, 00007FF7A3B27ABF
Tcl_GetObjResult, xrefs: 00007FF7A3B27B55, 00007FF7A3B27B77
Tk_Init, xrefs: 00007FF7A3B27C69, 00007FF7A3B27C8B
Tk_GetNumMainWindows, xrefs: 00007FF7A3B27C97, 00007FF7A3B27CB9
Tcl_EvalObjv, xrefs: 00007FF7A3B27BDF, 00007FF7A3B27C01
Tcl_NewStringObj, xrefs: 00007FF7A3B27ACB, 00007FF7A3B27AED
Tcl_GetVar2, xrefs: 00007FF7A3B27A13, 00007FF7A3B27A35
Tcl_Init, xrefs: 00007FF7A3B276C0, 00007FF7A3B276DF
Tcl_ThreadAlert, xrefs: 00007FF7A3B279E5, 00007FF7A3B27A07
Tcl_ThreadQueueEvent, xrefs: 00007FF7A3B279B7, 00007FF7A3B279D9
Tcl_Alloc, xrefs: 00007FF7A3B27C0D, 00007FF7A3B27C2F
Tcl_MutexFinalize, xrefs: 00007FF7A3B278FF, 00007FF7A3B27921
Tcl_FinalizeThread, xrefs: 00007FF7A3B277BD, 00007FF7A3B277DF
Tcl_MutexLock, xrefs: 00007FF7A3B278A3, 00007FF7A3B278C5
Tcl_ConditionFinalize, xrefs: 00007FF7A3B2792D, 00007FF7A3B2794F
Tcl_Finalize, xrefs: 00007FF7A3B2778F, 00007FF7A3B277B1
GetProcAddress, xrefs: 00007FF7A3B276EF
Tcl_JoinThread, xrefs: 00007FF7A3B27875, 00007FF7A3B27897
Tcl_NewByteArrayObj, xrefs: 00007FF7A3B27AF9, 00007FF7A3B27B1B
Tcl_EvalFile, xrefs: 00007FF7A3B27B83, 00007FF7A3B27BA5
Tcl_Free, xrefs: 00007FF7A3B27C3B, 00007FF7A3B27C5D
Tcl_SetVar2, xrefs: 00007FF7A3B27A41, 00007FF7A3B27A63
Tcl_CreateInterp, xrefs: 00007FF7A3B2770B, 00007FF7A3B2772D
Tcl_SetVar2Ex, xrefs: 00007FF7A3B27B27, 00007FF7A3B27B49
Tcl_GetCurrentThread, xrefs: 00007FF7A3B27847, 00007FF7A3B27869
Tcl_DeleteInterp, xrefs: 00007FF7A3B277EB, 00007FF7A3B2780D
Failed to get address for %hs, xrefs: 00007FF7A3B276E8
Tcl_CreateThread, xrefs: 00007FF7A3B27819, 00007FF7A3B2783B
Tcl_ConditionWait, xrefs: 00007FF7A3B27989, 00007FF7A3B279AB
Tcl_EvalEx, xrefs: 00007FF7A3B27BB1, 00007FF7A3B27BD3
Tcl_FindExecutable, xrefs: 00007FF7A3B27736, 00007FF7A3B27758

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 1ac53beb8b6daae600db178ba1145770c0046f7731d26f2129b81cdd598ba0d5
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 1402C360A0FB47D2FAD5FFA5B810974A267AF04755BC20135C5DE22372EF7EA1498238

Function 00007FF7A3B281C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7A3B288A7,?,?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B2821C

Part of subcall function 00007FF7A3B22810: MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

\, xrefs: 00007FF7A3B28251
CreateDirectory, xrefs: 00007FF7A3B2836C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7A3B28230
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7A3B281F3
%.*s, xrefs: 00007FF7A3B282FC
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7A3B282C9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7A3B2828D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7A3B28363

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: aae6f7088640b49bfebefe2be76b6dcf83b1d188a99ac63895178cfebd8fe714
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: 2B51C911B1B6C281F7D0FF60E841AB9E253AF94780FC64531E5CEE66B5EE2EE1048760

Function 00007FF7A3B22180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7A3B221AB
SelectObject.GDI32 ref: 00007FF7A3B221F2
DrawTextW.USER32 ref: 00007FF7A3B22215
SelectObject.GDI32 ref: 00007FF7A3B2222B
ReleaseDC.USER32 ref: 00007FF7A3B2223B
MoveWindow.USER32 ref: 00007FF7A3B2228B
MoveWindow.USER32 ref: 00007FF7A3B222CB
MoveWindow.USER32 ref: 00007FF7A3B2231E
MoveWindow.USER32 ref: 00007FF7A3B22366

Strings

P%, xrefs: 00007FF7A3B221FF

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 1ec7627d4a297d747e848d78c5bb03259351a33882b051fb626e2e4ead7c5561
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: DD5107266047A187D6749F26F4181BAF7A2F798B61F004125EBDE43794DF3DD045CB20

Function 00007FF7A3B280B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7A3B280EF
GetWindowLongPtrW.USER32 ref: 00007FF7A3B2816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7A3B28182
GetLastError.KERNEL32 ref: 00007FF7A3B2818C
SetWindowLongPtrW.USER32 ref: 00007FF7A3B281A3

Strings

Needs to remove its temporary files., xrefs: 00007FF7A3B28175

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: f104a9650453b30570b59ed0137c8b4a499c81c7d6f425d761a28bcb8ecbddb2
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: A421FD21B0A682C2F785AF76B844579A252EF88B91F8A0230DBDD933F4DE2DD5408220

Function 00007FF7A3B36300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B369CC

Strings

p, xrefs: 00007FF7A3B363F5
p, xrefs: 00007FF7A3B3646D
-, xrefs: 00007FF7A3B363D9
:, xrefs: 00007FF7A3B364FC
f, xrefs: 00007FF7A3B36465

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 19c5a763df3c0a272ae3a9c3607282bf421adc2f9d3900d8f26d7635db8e4304
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 0F12A061E0A16786FBE87E1591843B9F6A2FB40750FC64135D6C927EE4DF3EE5808B20

Function 00007FF7A3B31038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B31078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B31440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B316DF

Strings

p, xrefs: 00007FF7A3B3111D
p, xrefs: 00007FF7A3B31182
f, xrefs: 00007FF7A3B312C5
f, xrefs: 00007FF7A3B3117A
f, xrefs: 00007FF7A3B31110

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 4c614a2131924ee7bccd6680da652f676fdf65ccc8336da5469a055dff04455a
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: A712D321E0E16385FBA8BE55E4142B9F26BFB80754FCA4035D6C952DF4DB7EE5808B20

Function 00007FF7A3B21050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7A3B2110F
fseek, xrefs: 00007FF7A3B210D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B211F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B210CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A3B21108
fread, xrefs: 00007FF7A3B211FD
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B21098

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: d71e4b7b1744fd061dd4f171bedf68f3ca03f3e9821f53b1d0028571ae7a1026
Instruction ID: 6176e9408c872933f1e92b44e48565602e616a2c402e7b92ea6083bf4fe4adf9
Opcode Fuzzy Hash: d71e4b7b1744fd061dd4f171bedf68f3ca03f3e9821f53b1d0028571ae7a1026
Instruction Fuzzy Hash: 30419521B0A59282FA84FF52A8019B9E392BF44BC4FC64531EDCD27BB5DE3EE1018750

Function 00007FF7A3B21470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7A3B2151F
fseek, xrefs: 00007FF7A3B214E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B215DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B214DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A3B21518
fread, xrefs: 00007FF7A3B215E6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B2149F

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 17e152b10182aed67a72398ac85b67c0f98998c656add469577b8d559d4f932d
Instruction ID: ad35dd374e3baea934981cd4a80ac7685fa018567c2b24dca1834469d9454788
Opcode Fuzzy Hash: 17e152b10182aed67a72398ac85b67c0f98998c656add469577b8d559d4f932d
Instruction Fuzzy Hash: 4C41A521A0A59286FA80EF6194015F9E392FF44784FC54532EECD27BB9DE3EE5018724

Function 00007FF7A3B2EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7A3B2EAD5

Part of subcall function 00007FF7A3B2FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7A3B2FA6F
Part of subcall function 00007FF7A3B2FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7A3B2FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7A3B2EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7A3B2EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7A3B2EF08

Strings

csm, xrefs: 00007FF7A3B2EBD0
csm, xrefs: 00007FF7A3B2EB56
csm, xrefs: 00007FF7A3B2EAEF

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: ba31fc5c217dc89364841d4547c9f7909d081c00a6cd28b20192846c05cd7f07
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: DBD1B33290978186EBA0AFA6D4447ADB7A5FB45788F510235EE8D67BA5CF3DE040C720

Function 00007FF7A3B22C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
MessageBoxW.USER32 ref: 00007FF7A3B22D99

Strings

Error, xrefs: 00007FF7A3B22D8C
%ls: , xrefs: 00007FF7A3B22D22
<FormatMessageW failed.>, xrefs: 00007FF7A3B22D70
[PYI-%d:ERROR] , xrefs: 00007FF7A3B22CA6

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 9953abd0e9de15fb65e3609415924e242d38217421590934457cc39a6ef49d0d
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 1331093370968042E660BF61B8006ABA692BF847C4F820236DFCDA7769DE3DD506C310

Function 00007FF7A3B2DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDBD
GetLastError.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DE63
GetProcAddress.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DE6F

Strings

api-ms-, xrefs: 00007FF7A3B2DDDD

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 75be4bf83acf7697c6f0d62b0b4acd68e7dc02a87a9d0d6da660a22aeacd38ec
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: CC31E921B0B78581EE91FF529800975A395FF58B90F8A4639DDAD27360DF3DE4408320

Function 00007FF7A3B26350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF7A3B26497
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7A3B263B7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7A3B263F7
ucrtbase.dll, xrefs: 00007FF7A3B263CD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7A3B26446
LoadLibrary, xrefs: 00007FF7A3B2649E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: 3f06120c831e08775c9ce2f50d5e9c12b6e621684da2b095997ca2333ae2b92a
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: A441A521A1EAC691EA91FF50E4156E9A312FF54340FC10232DADC676B5EF3DE505C760

Function 00007FF7A3B22A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7A3B2351A,?,00000000,00007FF7A3B23F23), ref: 00007FF7A3B22AA0

Strings

0, xrefs: 00007FF7A3B22B16
Warning, xrefs: 00007FF7A3B22B1E
WARNING, xrefs: 00007FF7A3B22AAF
Warning [ANSI Fallback], xrefs: 00007FF7A3B22B0F
[PYI-%d:%s] , xrefs: 00007FF7A3B22AA8

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 9f3724fc4777d82f1d36e9bf3eccec85cd9920f351572f9bdfd332f1ed592fe2
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 5021A63261978192E650EF51B4817E6A355FB883C4F810232EECC63669DF3DD1458750

Function 00007FF7A3B3B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7A3B3B1CF
FlsGetValue.KERNEL32 ref: 00007FF7A3B3B1E4
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B205
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B232
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B243
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B254
SetLastError.KERNEL32 ref: 00007FF7A3B3B26F

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: fa9419698329e8c4fc0e948954b561092306fc9e1a1c8e2e9ee73743c346d851
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: CE218120F0E66682F6DCBF615A5117DE1435F447A0F924335E9BE66EFADE2EA4004360

Function 00007FF7A3B47DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7A3B47E0D
GetLastError.KERNEL32 ref: 00007FF7A3B47E19
CloseHandle.KERNEL32 ref: 00007FF7A3B47E31
CreateFileW.KERNEL32 ref: 00007FF7A3B47E5C
WriteConsoleW.KERNEL32 ref: 00007FF7A3B47E7B

Strings

CONOUT$, xrefs: 00007FF7A3B47E3D

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 742c174c99961a48832bf96d10bb7500a292cf94ea762cb1af6aca6c92c77708
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: D511A221B19A4182F790AF16E844329A6A5BB88BE4F410234DA9E977A4CF3DD8018754

Function 00007FF7A3B28560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B28592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B285E9

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B28678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B286E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B286F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B2870A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: 4bc1dad00278bfedbf1bc8f36c050beb1c17289a93db50fd000ea6a7d0f56332
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 6941DD2271A6D245E6B0AF51A440AB6A396FF44BC4F860231DFCDB7BA5DE3DD401C720

Function 00007FF7A3B3B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B347
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B37D
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3CC
SetLastError.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3E7

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 1819e64c9c3bb0543c3b1b44a847ef4a880bbcafd1ee569b635b399332d58b07
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: AF119220B0E66282F7DCBF25564117DE1435F447A0FD24335E8AEA6FFADE6EA4018321

Function 00007FF7A3B22910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7A3B21B6A), ref: 00007FF7A3B2295E

Strings

Error, xrefs: 00007FF7A3B22A0E
%s: %s, xrefs: 00007FF7A3B229E8
[PYI-%d:ERROR] , xrefs: 00007FF7A3B22966
Error [ANSI Fallback], xrefs: 00007FF7A3B229FF

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: b6417ff4dc99a11801b2f32d068d60586c54ec74e41b741cb01756880fa0de2a
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: B3313723B0A68152E750FF61B8416E6A292BF887D4F820232EECCA3765DF3DD1468210

Function 00007FF7A3B22390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A3B223C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7A3B2248E
DeleteObject.GDI32 ref: 00007FF7A3B224C1
DestroyIcon.USER32 ref: 00007FF7A3B224D3

Strings

Unhandled exception in script, xrefs: 00007FF7A3B223F8

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 9502c7688f716fa3c1f4d6947e7fb8ef7ca1b3fcfca7718b23df5389a3b580cc
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: D631953260A68189EBA4EF61F8556F9A361FF88784F850235EA8D5BF69DF3DC104C710

Function 00007FF7A3B22B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7A3B2918F,?,00007FF7A3B23C55), ref: 00007FF7A3B22BA0
MessageBoxW.USER32 ref: 00007FF7A3B22C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF7A3B22BA8
Warning, xrefs: 00007FF7A3B22C1D
WARNING, xrefs: 00007FF7A3B22BAF

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 029b6d3e6d81850db34f88e13fde10a3fd2e68bd5727a21d2e2debf6f0b4378b
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 4721B122709B8182E691EF54F8457EAA365FB88780F814132EACD67666DE3DD205C750

Function 00007FF7A3B22710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7A3B21B99), ref: 00007FF7A3B22760

Strings

ERROR, xrefs: 00007FF7A3B2276F
Error, xrefs: 00007FF7A3B227DE
Error [ANSI Fallback], xrefs: 00007FF7A3B227CF
[PYI-%d:%s] , xrefs: 00007FF7A3B22768

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: a142615334a08d40bbd4ff4dd9e9bd6931b376a65bebaf5a47195d6d00d6082c
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 6D21A332A1A78192E690EF50B8417E6A395EB88384F810231EECC63669DF3DD5458750

Function 00007FF7A3B39AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7A3B39B1D
GetProcAddress.KERNEL32 ref: 00007FF7A3B39B33
FreeLibrary.KERNEL32 ref: 00007FF7A3B39B5A

Strings

mscoree.dll, xrefs: 00007FF7A3B39B14
CorExitProcess, xrefs: 00007FF7A3B39B2C

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 022d1891b741e92b2fb70c7e450ca37ea52a64f87c3aafd83518e6aa9ced8e1e
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 14F0C221B0B70682FB94AF24E444339A322AF88761F850235CBEE56AF4DF3ED444C324

Function 00007FF7A3B493D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7A3B49400
_set_statfp.LIBCMT ref: 00007FF7A3B4941B
_set_statfp.LIBCMT ref: 00007FF7A3B49437
_set_statfp.LIBCMT ref: 00007FF7A3B49473

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c74ca89f358b4b356d11b32bb88f130a1fff18ac3febdf6f8050113ba688bed1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 3C11B262E0DA1309F6F43928F456375B0466F98370F86C634EAEE262F68E2E6D41412D

Function 00007FF7A3B3B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B41F
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B43E
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B466
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B477
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B488

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 26cd80a8410da237365f220afdb8f74b394166ec3e82d3120ee7ed448435d4a9
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: B4116620B0A65282F5DCBF255651179E2435F847B0FD64335E8BD66EFADE2EE4018320

Function 00007FF7A3B3B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7A3B3B2A5
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2C4
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2EC
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2FD
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B30E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: edd9b08be0a71f8ad7f839499045b92168a5afdc530680317978077d22bb670a
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: 47110A10E0F62682FADCBE2549111B9E1434F45320FD64735E9BE6AEF6DD2EB8014261

Function 00007FF7A3B36010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3622C

Strings

verbose, xrefs: 00007FF7A3B36020

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 70054ae9cbd952bac33ed049bac66be63b1f3c719a32c11e9c64c9c91d3f225c
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: EF91E722A0EA5641E7E9AE24D89137DB792AB00B54FC64135DACD63FE5DF3EE4058320

Function 00007FF7A3B3FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3FF17

Part of subcall function 00007FF7A3B37AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B37AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF7A3B3FEB5
ccs, xrefs: 00007FF7A3B3FE52
UTF-8, xrefs: 00007FF7A3B3FE96

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 04bb89e0989f4d341c241b54083c8f4ecd27ddb8e21abc1977336968a995237a
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 8C81C732D0BA7385F7EC6E258104278B6A2AB11744FD74036DA8977EB5CB3FA9018321

Function 00007FF7A3B2D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A3B2D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A3B2D77A
RtlUnwindEx.KERNEL32 ref: 00007FF7A3B2D7D4

Strings

csm, xrefs: 00007FF7A3B2D761

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: bd7dbfc6ff3dbbd0b29ba1b1ab33ddf74b0b8d80f43ccc614e9c8c4c73d70b24
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 2A51B432B1A7818ADB94AF55D004A78A392EB44B94F924238DEEE57774DF3EE841C710

Function 00007FF7A3B2F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A3B2F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7A3B2F408

Strings

csm, xrefs: 00007FF7A3B2F342
csm, xrefs: 00007FF7A3B2F45A

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 89943d34ba9c8239cf65c59947f8fe832c22dab1325f43ec24cb92fb45c2e8bc
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: F351D6325093C28AEBA4AF619044B68B7A1FB54B84F964336DADC677A5CF3DE450CB10

Function 00007FF7A3B2EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7A3B2EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7A3B2EFF3

Strings

MOC, xrefs: 00007FF7A3B2EFBB
RCC, xrefs: 00007FF7A3B2EFC3

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 5328b2cf955713a8988c099e0ffa33b44f64ec3392a600ccac7bdefa6107ab2e
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 7061A132909BC581EBA09F55E440BAAB7A1FB84B84F854326EBDC17B65CF7DD190CB10

Function 00007FF7A3B22810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF7A3B22868
Error, xrefs: 00007FF7A3B228DD
ERROR, xrefs: 00007FF7A3B2286F

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: e4bd206f0e03ce20c52509a245c2ed27afc31417aebad2fdebdf6dfdba407619
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: F021E122B09B8182E690EF54F4457EAA3A1FB88780F810132EECD67666DE3DD205C710

Function 00007FF7A3B3C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7A3B3C68F
WriteFile.KERNEL32 ref: 00007FF7A3B3C957
WriteFile.KERNEL32 ref: 00007FF7A3B3C99D
GetLastError.KERNEL32 ref: 00007FF7A3B3CA53

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 97c9252dc580f2e7a38fda5d3af445bd9e7e9fe503792695819b16e9dd43d11b
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 65D15672B09A908AE754DFB4D4401ACB7B2FB04798B818235CE9DA7FA9DE3DD406C710

Function 00007FF7A3B220C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7A3B220F4
SetWindowLongPtrW.USER32 ref: 00007FF7A3B22116
GetWindowLongPtrW.USER32 ref: 00007FF7A3B22140
InvalidateRect.USER32 ref: 00007FF7A3B22160

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 4f2fe7bf57d7ec6af8949d7980db37fddbd0c1a08da4ba10f89bfb1a3c12935f
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: F211E921B0D18282F6D4AFAAF545A7A9253EB88780FC54130DFC95BBA9CD3ED4918214

Function 00007FF7A3B45B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B417D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B41803

_get_daylight.LIBCMT ref: 00007FF7A3B45CA4
_get_daylight.LIBCMT ref: 00007FF7A3B45CB5

Strings

?, xrefs: 00007FF7A3B45C35

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: b754ec3cff778f279a54610a46712aa21427f3d1f85a6ef5ad805f537329bb12
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: 3C417B12A0AA8642F7A4EF259401379D652EF80BA4F954236EEDC12AF6DF3ED040C714

Function 00007FF7A3B39084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B390B6

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7A3B2CC15), ref: 00007FF7A3B390D4

Strings

C:\Users\user\Desktop\builded.exe, xrefs: 00007FF7A3B390C2

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\builded.exe
API String ID: 3580290477-3059520164
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 8b647c6e1be784f76e23b3b4dd09b9445e77fa43f6ac83a45dbf65d0c43d5752
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 37419635A0AB2289F798FF25A4401BCB7A6EB447C0BD64035E98D67FA5DF3EE4418310

Function 00007FF7A3B3CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7A3B3CDBF
GetLastError.KERNEL32 ref: 00007FF7A3B3CDE1

Strings

U, xrefs: 00007FF7A3B3CD6B

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: a800494ad174def5a51bd4159de8a0fe1e05862edc97d9ae002e485caf732ca1
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: D741D432B19A9181EBA0EF65E4443B9A761FB88784F814131EE8D97BA8EF3DD401C750

Function 00007FF7A3B3F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A3B3F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A3B3F6BA

Strings

:, xrefs: 00007FF7A3B3F67E

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: a2f69d312bd63d49a7180fa1d1f7cfe748b2af91fc9b9e43f3015c3d6386025d
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: 3C21F722A0969182FBA4AF15D04426DB3B3FB84B84FD64036D6CD63EA4DF7ED944C760

Function 00007FF7A3B2FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7A3B2FE08
RaiseException.KERNEL32 ref: 00007FF7A3B2FE49

Strings

csm, xrefs: 00007FF7A3B2FE36

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: a2c359cddbdd7a7450ccb7e33ddbfb3309b2d44bae56f35279c8d796e1ee927c
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 45115B32609B8582EBA1DF25F40026AB7E1FB88B84F994231DBCD17769DF3DD5518B00

Function 00007FF7A3B407AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B407DC
GetDriveTypeW.KERNEL32 ref: 00007FF7A3B4081C

Strings

:, xrefs: 00007FF7A3B40805

Memory Dump Source

Source File: 00000000.00000002.2246109303.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000000.00000002.2246070886.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246165452.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246221911.00007FF7A3B62000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246303498.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: ed59c37109db945ea4bfcff21c099e1cafeb23a3d5449d0ba034455fa7f7c1c8
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: CB01A72291E20386F7A4BF60946627EE3A1EF44744FC60136D5CD62AA1DF3EE5048B39

Analysis Process: builded.exePID: 6496, Parent PID: 4744COMMON

Executed Functions

Function 00007FF7A3B21000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not create temporary directory!, xrefs: 00007FF7A3B23CBF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7A3B23971
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7A3B239DE
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7A3B23BE8
_PYI_ARCHIVE_FILE, xrefs: 00007FF7A3B238D2, 00007FF7A3B239FF
Failed to start splash screen!, xrefs: 00007FF7A3B23ED4
Failed to load splash screen resources!, xrefs: 00007FF7A3B23E85
_PYI_SPLASH_IPC, xrefs: 00007FF7A3B23A23, 00007FF7A3B23EF5
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7A3B23A17, 00007FF7A3B23A2F, 00007FF7A3B23A9B
pyi-contents-directory, xrefs: 00007FF7A3B23B8D
Py_GIL_DISABLED, xrefs: 00007FF7A3B23AF4
Failed to convert DLL search path!, xrefs: 00007FF7A3B23DDC
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7A3B23EA6
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7A3B23D12
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7A3B23A0B, 00007FF7A3B23CD4, 00007FF7A3B23F6B
pyi-runtime-tmpdir, xrefs: 00007FF7A3B23B68
Failed to remove temporary directory: %s, xrefs: 00007FF7A3B23FC3
pyi-disable-windowed-traceback, xrefs: 00007FF7A3B23BB2
pyi-python-flag, xrefs: 00007FF7A3B23AD6
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7A3B23EBB
pkg, xrefs: 00007FF7A3B239BE
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7A3B23B32
VCRUNTIME140.dll, xrefs: 00007FF7A3B23DB1
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7A3B23882, 00007FF7A3B238AF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7A3B23C61
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7A3B23E0A
MEI, xrefs: 00007FF7A3B23933
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7A3B23D35

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction ID: 53ce9c9849c80e0d2636dd54c143d3d4c0c5048146af0c50f8aba3672211b58f
Opcode Fuzzy Hash: c0a66ebca772141f760a29a0dd77fc68e5502f7a94feb123d2d63e937376cc0c
Instruction Fuzzy Hash: 3B32C321A0E6C251FA95FFA094557B9A253AF44780FC64232EACD632F6DF3EE554C320

Function 00007FF8B6171956 Relevance: 44.5, APIs: 18, Strings: 7, Instructions: 785COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6180414
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8B618041C
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8B61805F9
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B6180601
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8B618066D

Strings

PUT , xrefs: 00007FF8B6180CE6
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8B6180499, 00007FF8B6180D1A, 00007FF8B6180DC2
HEAD , xrefs: 00007FF8B6180CC7
, xrefs: 00007FF8B618057F
GET , xrefs: 00007FF8B6180C86
POST , xrefs: 00007FF8B6180CA9
CONNE, xrefs: 00007FF8B6180CFA

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_sizeO_memcmpR_flagsX_cipherX_md
String ID: $..\s\ssl\record\ssl3_record.c$CONNE$GET $HEAD $POST $PUT
API String ID: 2456506815-3985260174
Opcode ID: ff63ad79296eaf92fcf052475543cb04908749e2f6ca8c1875eeda6e67615c47
Instruction ID: 8b9fb621b0aa5b665f54e60fc4fb164516e5b97568cfa14f795cd48c9b13eff1
Opcode Fuzzy Hash: ff63ad79296eaf92fcf052475543cb04908749e2f6ca8c1875eeda6e67615c47
Instruction Fuzzy Hash: BB72AD72B0864A86FB608F19D4447BA37A9EB84BC9F184175DB8D4BB96CF7DE580C700

Function 00007FF8B6172207 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6194D7D
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6194DCF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6194DF4

Strings

ssl3-md5, xrefs: 00007FF8B6194F97
..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6194D73, 00007FF8B6194DBF, 00007FF8B6194DDF, 00007FF8B6194E1E, 00007FF8B6194E7E, 00007FF8B6194EA4, 00007FF8B6195033
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FF8B6194F57
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256, xrefs: 00007FF8B6194F25
ssl3-sha1, xrefs: 00007FF8B6194FBF

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ssl3-md5$ssl3-sha1
API String ID: 1767461275-1115027282
Opcode ID: f52f689ef5e56a451a8d4ca604dbf800eb249abd5a24eef8a10b397656324fe4
Instruction ID: 589fb54e3fb95a502b1faac8571b7c8bbc5226830cdf713669c331ac5d6fcd04
Opcode Fuzzy Hash: f52f689ef5e56a451a8d4ca604dbf800eb249abd5a24eef8a10b397656324fe4
Instruction Fuzzy Hash: E6A14972A0AB8281FB60DF29E4553B826A0EF44B88F4801B5DB8D5B7D6EF3CE555C310

Function 00007FF8B617214E Relevance: 36.8, APIs: 20, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194910
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194934
CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FF8B619496B
OPENSSL_LH_free.LIBCRYPTO-1_1 ref: 00007FF8B6194974
X509_STORE_free.LIBCRYPTO-1_1 ref: 00007FF8B619497D
CTLOG_STORE_free.LIBCRYPTO-1_1 ref: 00007FF8B6194989
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8B6194992
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8B619499B
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8B61949A4
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61949C3
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61949D6
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61949E9
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A00
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B6194A14
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A2D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A46
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A5F
CRYPTO_secure_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A78
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A84
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6194A99

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6194903, 00007FF8B619491C, 00007FF8B6194A20, 00007FF8B6194A39, 00007FF8B6194A52, 00007FF8B6194A6B, 00007FF8B6194A8F

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$L_sk_free$L_sk_pop_free$E_free$D_lock_freeE_finishH_freeO_free_ex_dataO_secure_freeX509_
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4271332762-1080266419
Opcode ID: 7a1cef35fcc74aa7a62b6b196fe9f4732b55003a8abf51a64f85266db3aec730
Instruction ID: 3ebd7cb8ce3997da4a6c5a5c5751ce9553dc9d5e8cbc81de596f1f8bcb5716a0
Opcode Fuzzy Hash: 7a1cef35fcc74aa7a62b6b196fe9f4732b55003a8abf51a64f85266db3aec730
Instruction Fuzzy Hash: C3410C62E1AA8291EB64EF3ED4557FC2321EB84BC8F0451B1EF0D4F2A6CE6CE5458350

Function 00007FF8B6171393 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8B61BE957
d2i_X509.LIBCRYPTO-1_1 ref: 00007FF8B61BEA7B
X509_free.LIBCRYPTO-1_1 ref: 00007FF8B61BEEE9
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61BEEF8

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61BEA17, 00007FF8B61BEEC4

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1068509327-1507966698
Opcode ID: 7d81409ced07da4c62dc47a3620ad54cac8200b5420088f0f84b8d5179918789
Instruction ID: bea5f374661f47692837368625ec6aa049e2664c7a2ea388ce17664a9805aaa6
Opcode Fuzzy Hash: 7d81409ced07da4c62dc47a3620ad54cac8200b5420088f0f84b8d5179918789
Instruction Fuzzy Hash: 1EE1B072B08A8186E760DB1AE4406AD7BA9EB84BD4F0C4175EF8C4BB95DF3DE551CB00

Function 00007FF7A3B469D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B46749
Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B467C7
Part of subcall function 00007FF7A3B46708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B46818

CreateFileW.KERNEL32 ref: 00007FF7A3B46ADA
CreateFileW.KERNEL32 ref: 00007FF7A3B46B2A
GetLastError.KERNEL32 ref: 00007FF7A3B46B5A
GetFileType.KERNEL32 ref: 00007FF7A3B46B6F
GetLastError.KERNEL32 ref: 00007FF7A3B46B79
CloseHandle.KERNEL32 ref: 00007FF7A3B46BAC
CloseHandle.KERNEL32 ref: 00007FF7A3B46D0F
CreateFileW.KERNEL32 ref: 00007FF7A3B46D44
GetLastError.KERNEL32 ref: 00007FF7A3B46D53

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 9cf020fd2218fdc4c688cda461dca8970ef47dab443255f969903b25981f88fc
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 63C1F236B29A5186FB90EF64C4812AC7762F748B98B424235DFAEA77E4CF39D411C310

Function 00007FF8B6171073 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619341A
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8B6193459
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8B6193484
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8B61934AD

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FF8B61933F5

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_run_once$R_put_error
String ID: ..\s\ssl\ssl_init.c
API String ID: 511881677-1166085723
Opcode ID: fd329f3d3c4ac018813aac7fd218cde1706058dba49e64e5e4a2f582db8a53f4
Instruction ID: 12fa457ac9f9b8e34aed84265c3294ad33973386110f6274d2b174e64c309b1b
Opcode Fuzzy Hash: fd329f3d3c4ac018813aac7fd218cde1706058dba49e64e5e4a2f582db8a53f4
Instruction Fuzzy Hash: C22126A9F096039AFA119B2DE8442B926A1AFD03C4F4541B5DB0D832E5EF3DE9568B00

Function 00007FF7A3B292F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7A3B29323
FindClose.KERNEL32 ref: 00007FF7A3B29332

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: bcddbf3ea577ed54b8022e2992a5134d83d4a1726061a69f7582b6174296c77d
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 4DF0CD22629781C7F7E09F90B449B66B351AB48324F450335DAED116E4DF3DD1588710

Function 00007FF8B7832110 Relevance: 172.6, APIs: 97, Strings: 1, Instructions: 1123COMMON

Download Yara Rule

APIs

PyImport_Import.PYTHON310(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B7828F29), ref: 00007FF8B7832132
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B7828F29), ref: 00007FF8B783215D
_Py_Dealloc.PYTHON310(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B7828F29), ref: 00007FF8B78321A5

Strings

<module>, xrefs: 00007FF8B783236D, 00007FF8B7832509, 00007FF8B7832686, 00007FF8B7832803, 00007FF8B7832987, 00007FF8B7832B0B, 00007FF8B7832CE3, 00007FF8B7832E60, 00007FF8B7833014, 00007FF8B7833191, 00007FF8B78332C7, 00007FF8B78333FB, 00007FF8B783347F

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc$ImportImport_
String ID: <module>
API String ID: 2397823689-217463007
Opcode ID: 4b8dbb5d4d9357086519af80a4166a2e12286026398b66c1b9eb52724a73e3ac
Instruction ID: 351309aea59f036158d1b16c0cf8c7eda7142c81a700c387eb5798f0483473a0
Opcode Fuzzy Hash: 4b8dbb5d4d9357086519af80a4166a2e12286026398b66c1b9eb52724a73e3ac
Instruction Fuzzy Hash: E6C2F165B89B4785FA119B2DE8542BC2BA0BF4CBD6F464835EB4D177B0EF3CA5418308

Function 00007FF8B7828E50 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyModule_Create2.PYTHON310 ref: 00007FF8B7828E84
PyObject_GetAttrString.PYTHON310 ref: 00007FF8B7828EA4
PyModule_GetDict.PYTHON310 ref: 00007FF8B7828EB4
_Py_Dealloc.PYTHON310 ref: 00007FF8B7828F36

Strings

__name__, xrefs: 00007FF8B7828E9D

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Module_$AttrCreate2DeallocDictObject_String
String ID: __name__
API String ID: 2272293537-3954359393
Opcode ID: 2b567a7c881d963cd7303037faac8015580bb144e77f0881aa286837176c8575
Instruction ID: 7a24180b85561587ac8da444b42a460bdbc63fd725e2a561f28bbbde41eb6415
Opcode Fuzzy Hash: 2b567a7c881d963cd7303037faac8015580bb144e77f0881aa286837176c8575
Instruction Fuzzy Hash: B571D235F8AB0685FE558B6DB84423C3BA4BF98BD2F4A4935EB1D52670DF3DA4418308

Function 00007FF8B7824800 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON310 ref: 00007FF8B7824831
PyObject_GetAttr.PYTHON310 ref: 00007FF8B782487D
PyUnicode_FromFormat.PYTHON310 ref: 00007FF8B782489D
PyObject_GetItem.PYTHON310 ref: 00007FF8B78248B5
_Py_Dealloc.PYTHON310 ref: 00007FF8B78248C7
PyDict_SetItem.PYTHON310 ref: 00007FF8B78248E8
PyObject_SetItem.PYTHON310 ref: 00007FF8B78248F0
_Py_Dealloc.PYTHON310 ref: 00007FF8B7824901
PyErr_Clear.PYTHON310 ref: 00007FF8B7824931
PyModule_GetFilenameObject.PYTHON310 ref: 00007FF8B782493A
PyUnicode_FromFormat.PYTHON310 ref: 00007FF8B7824958
PyErr_SetImportError.PYTHON310 ref: 00007FF8B782496F
_Py_Dealloc.PYTHON310 ref: 00007FF8B782497E
_Py_Dealloc.PYTHON310 ref: 00007FF8B782498D
_Py_Dealloc.PYTHON310 ref: 00007FF8B782499C

Strings

%U.%U, xrefs: 00007FF8B7824893
cannot import name %R from %R (%S), xrefs: 00007FF8B7824948

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: b9d92fd51dd81396953d85bf7560aa1763baa6a1e8264a02926bb4c6a25205f7
Instruction ID: 5b24b8b9d667e197236939eaed76432445b1d26dd1fd1bc585b3b0ddab3f1e49
Opcode Fuzzy Hash: b9d92fd51dd81396953d85bf7560aa1763baa6a1e8264a02926bb4c6a25205f7
Instruction Fuzzy Hash: EB418E62B49B8281EA149B2EA80467E6BA0FB49FC6F554434DF4D47774DF3CE8458318

Function 00007FF7A3B21950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A3B27F80: _fread_nolock.LIBCMT ref: 00007FF7A3B2802A

_fread_nolock.LIBCMT ref: 00007FF7A3B21A1B

Part of subcall function 00007FF7A3B22910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7A3B21B6A), ref: 00007FF7A3B2295E

Strings

Failed to seek to cookie position!, xrefs: 00007FF7A3B219EE
fseek, xrefs: 00007FF7A3B219F5
Could not allocate memory for archive structure!, xrefs: 00007FF7A3B21A61
malloc, xrefs: 00007FF7A3B21B22
calloc, xrefs: 00007FF7A3B21A68
Could not read full TOC!, xrefs: 00007FF7A3B21B55
fread, xrefs: 00007FF7A3B21A32, 00007FF7A3B21B5C
Error on file., xrefs: 00007FF7A3B21B8D
MEI, xrefs: 00007FF7A3B21991
Could not allocate buffer for TOC!, xrefs: 00007FF7A3B21B1B
Failed to read cookie!, xrefs: 00007FF7A3B21A2B

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: c8a0a089e3ca590a9fb52c076af70129de3e5917c30b35a6c99145ef6d8afee0
Instruction ID: 4c985985b847523fd6c12ff3a3e9cf7e235490be1990d3d1de967c07aaedcfe8
Opcode Fuzzy Hash: c8a0a089e3ca590a9fb52c076af70129de3e5917c30b35a6c99145ef6d8afee0
Instruction Fuzzy Hash: 1081C471A0E6C286E7A0FF54D0416F9A3A2EF44780F864131EACD67BB5DE3EE1458720

Function 00007FF7A3B22180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 00007FF7A3B221AB
SelectObject.GDI32 ref: 00007FF7A3B221F2
DrawTextW.USER32 ref: 00007FF7A3B22215
SelectObject.GDI32 ref: 00007FF7A3B2222B
ReleaseDC.USER32 ref: 00007FF7A3B2223B
MoveWindow.USER32 ref: 00007FF7A3B2228B
MoveWindow.USER32 ref: 00007FF7A3B222CB
MoveWindow.USER32 ref: 00007FF7A3B2231E
MoveWindow.USER32 ref: 00007FF7A3B22366

Strings

P%, xrefs: 00007FF7A3B221FF

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 1ec7627d4a297d747e848d78c5bb03259351a33882b051fb626e2e4ead7c5561
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: DD5107266047A187D6749F26F4181BAF7A2F798B61F004125EBDE43794DF3DD045CB20

Function 00007FF8B6171CF3 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8B61B67BA
SetLastError.KERNEL32 ref: 00007FF8B61B67C1
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61B68C7
BUF_MEM_grow.LIBCRYPTO-1_1 ref: 00007FF8B61B6952
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61B6999
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61B6ABF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61B6B12
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8B61B6B20

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8B61B68B7, 00007FF8B61B6989, 00007FF8B61B6AAF, 00007FF8B61B6B02

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error$ErrorLastM_freeM_growR_clear_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 2562538362-2512360314
Opcode ID: c423cf16d77320108833097ff1234d8dd5fd3483e75dff8cff7ba81126dd7a66
Instruction ID: 59b0fb237d0dcdfb32fec8fc8da66f37ec29d3996283a384d4e0fc8265a6395e
Opcode Fuzzy Hash: c423cf16d77320108833097ff1234d8dd5fd3483e75dff8cff7ba81126dd7a66
Instruction Fuzzy Hash: FAB17D72A08B4286FB649F29C4403B937A9EB51BC8F1C80B5DB4947695CF3DE885DB81

Function 00007FF8B6171B45 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 571COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8B617C807
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8B617C814
memcpy.VCRUNTIME140 ref: 00007FF8B617C857
memcpy.VCRUNTIME140 ref: 00007FF8B617C9FD

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8B617C401, 00007FF8B617CB1A
SSL alert number , xrefs: 00007FF8B617CB4E

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: memcpy$O_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number
API String ID: 1692547093-34800109
Opcode ID: 3f7b08efb40acede6e7db4cb099754d1f20ad0c872ddb133913668b6976d7c20
Instruction ID: 7f02ed5938fb81c693fae1bde30a5934b3277b477f97f06d44f9e95c4c4482a1
Opcode Fuzzy Hash: 3f7b08efb40acede6e7db4cb099754d1f20ad0c872ddb133913668b6976d7c20
Instruction Fuzzy Hash: 5B42ACB2B086828AEB788F19E5407BE7AA0FB457E4F144175DB9E47B90DF3DE4918700

Function 00007FF7A3B21470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF7A3B214E5
malloc, xrefs: 00007FF7A3B2151F
fread, xrefs: 00007FF7A3B215E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A3B21518
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B215DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B2149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B214DE

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 689d6d22bbbe0075ee184b511634bee4b9e22409f5343f22a468899a6fe372b6
Instruction ID: ad35dd374e3baea934981cd4a80ac7685fa018567c2b24dca1834469d9454788
Opcode Fuzzy Hash: 689d6d22bbbe0075ee184b511634bee4b9e22409f5343f22a468899a6fe372b6
Instruction Fuzzy Hash: 4C41A521A0A59286FA80EF6194015F9E392FF44784FC54532EECD27BB9DE3EE5018724

Function 00007FF7A3B21210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7A3B212C1, 00007FF7A3B212F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7A3B21276
1.3.1, xrefs: 00007FF7A3B21249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7A3B212BA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7A3B2141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7A3B212EF

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 6d5808cc0d1dceb6cab22bc5ec620fda501ad4cc24dd5ec08cb7c541ead490ed
Instruction ID: abee2a252b6583f0299ea6bfa252d85ab537f802ea849ed4ad626dc088f10ecc
Opcode Fuzzy Hash: 6d5808cc0d1dceb6cab22bc5ec620fda501ad4cc24dd5ec08cb7c541ead490ed
Instruction Fuzzy Hash: BB51E622A0A68281E6A4FF51A4007BAE292BF85794FC54231EDCD67BF5DE3DE505C710

Function 00007FF7A3B236B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7A3B23804), ref: 00007FF7A3B236E1
GetLastError.KERNEL32(?,00007FF7A3B23804), ref: 00007FF7A3B236EB

Part of subcall function 00007FF7A3B22C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
Part of subcall function 00007FF7A3B22C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
Part of subcall function 00007FF7A3B22C50: MessageBoxW.USER32 ref: 00007FF7A3B22D99

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7A3B23790
\\?\, xrefs: 00007FF7A3B2375A
GetModuleFileNameW, xrefs: 00007FF7A3B236FA
Failed to obtain executable path., xrefs: 00007FF7A3B236F3
Failed to resolve full path to executable %ls., xrefs: 00007FF7A3B23739

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: abf5afe994366ca9a260bd1075303f90bb5c3ed1f160f21507332d6845244ae8
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: FC21B651B0E58251FAE0BF60E801BB5A252BF84744FC10332E5DDA65F5EE3EE204C724

Function 00007FF7A3B3BACC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BEF9

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: 0d4033c6dd48f79de188da7ee29b012e0cc29fe15cba9e53705d7d0bcf761cf7
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: 8CC1D82290E6A6D2E7A8EF1594012BDA752EB41B80FD74131EACD13FB5CF7EE4458320

Function 00007FF7A3B26350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7A3B263F7
Failed to load Python DLL '%ls'., xrefs: 00007FF7A3B26497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7A3B26446
ucrtbase.dll, xrefs: 00007FF7A3B263CD
LoadLibrary, xrefs: 00007FF7A3B2649E
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7A3B263B7

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 3f06120c831e08775c9ce2f50d5e9c12b6e621684da2b095997ca2333ae2b92a
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: A441A521A1EAC691EA91FF50E4156E9A312FF54340FC10232DADC676B5EF3DE505C760

Function 00007FF8B6171497 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B617D01A
memcpy.VCRUNTIME140 ref: 00007FF8B617D079
SetLastError.KERNEL32 ref: 00007FF8B617D175
BIO_read.LIBCRYPTO-1_1 ref: 00007FF8B617D198

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8B617D125, 00007FF8B617D210

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: memcpy$ErrorLastO_read
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1958097105-2209325370
Opcode ID: 83668bf32006c5783a5dc4ffc212bfc49eadf443eaa9813d3b7cb11514e49313
Instruction ID: 0c4e9ecc119274225a26284b4cf75665db1bfd594d4f6dce1650119c687b6f15
Opcode Fuzzy Hash: 83668bf32006c5783a5dc4ffc212bfc49eadf443eaa9813d3b7cb11514e49313
Instruction Fuzzy Hash: 00818FB2E0BA9985EB509E29D4443B92BA5FB40FE8F584176DF8C47B88DF39D446C340

Function 00007FF7A3B22390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A3B223C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7A3B2248E
DeleteObject.GDI32 ref: 00007FF7A3B224C1
DestroyIcon.USER32 ref: 00007FF7A3B224D3

Strings

Unhandled exception in script, xrefs: 00007FF7A3B223F8

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction ID: 9502c7688f716fa3c1f4d6947e7fb8ef7ca1b3fcfca7718b23df5389a3b580cc
Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction Fuzzy Hash: D631953260A68189EBA4EF61F8556F9A361FF88784F850235EA8D5BF69DF3DC104C710

Function 00007FF8B61B6290 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-1_1(?,?,?,00000000,?,-00000031,00007FF8B61B6A4D), ref: 00007FF8B61B6431

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8B61B652B, 00007FF8B61B65F4

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: M_grow_clean
String ID: ..\s\ssl\statem\statem.c
API String ID: 964628749-2512360314
Opcode ID: 7a77c42f21e6545b3253a2a35eacc0d4b118e17c4845b2e3276a665ed4b67177
Instruction ID: 5fceaa9e1f47045863e7ddf06c5bdebbdce1d27e3ef510c560be45c76e8052ff
Opcode Fuzzy Hash: 7a77c42f21e6545b3253a2a35eacc0d4b118e17c4845b2e3276a665ed4b67177
Instruction Fuzzy Hash: 48A19A72A08A8285EB60DF29D4443B92BA5FB54BD8F1C41B6CB4D47799CF3DE885CB40

Function 00007FF7A3B35698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B356C5
CreateFileW.KERNEL32 ref: 00007FF7A3B35704
CloseHandle.KERNEL32 ref: 00007FF7A3B35739

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: b2ad6f7ccf1f8b659f11f5ecd0274c7e55f7bc816ef0f73c7631ff77c717537c
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 6141B322E1979183E398EF209514379A261FB94754F518335E6DC13EE1DF6DA4E08760

Function 00007FF7A3B220C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7A3B220F4
SetWindowLongPtrW.USER32 ref: 00007FF7A3B22116
GetWindowLongPtrW.USER32 ref: 00007FF7A3B22140
InvalidateRect.USER32 ref: 00007FF7A3B22160

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 4f2fe7bf57d7ec6af8949d7980db37fddbd0c1a08da4ba10f89bfb1a3c12935f
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: F211E921B0D18282F6D4AFAAF545A7A9253EB88780FC54130DFC95BBA9CD3ED4918214

Function 00007FF8B6197120 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6197159
ASYNC_get_current_job.LIBCRYPTO-1_1 ref: 00007FF8B61971A6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6197140

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: C_get_current_jobR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4281227279-1080266419
Opcode ID: 8cd2e79bd01e4c605c840c68644f3601f27a72c746b1b2c873290dc5c8e684b8
Instruction ID: c2d6c92e1445de30219cc14aa9eb1a9a0d6d55e9b178ab154812f6d4043c37f0
Opcode Fuzzy Hash: 8cd2e79bd01e4c605c840c68644f3601f27a72c746b1b2c873290dc5c8e684b8
Instruction Fuzzy Hash: 8C216732B0864283EB50EF29E4012AD23A0EF89BD4F880171EF0D47786EF3CE5468A10

Function 00007FF7A3B2CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B2CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7A3B2CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7A3B2CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7A3B2CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7A3B2CD91

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 5a408877c1183e3b7325827a07aefd4d4a2805cd0d6e99045ed034c53c1f8c9f
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: C8315D10E0E28245FAE4BFA49421BB9A6839F41384FC60635D6CD676F7DE2FA4058231

Function 00007FF7A3B39AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7A3B39A9C), ref: 00007FF7A3B39AB1
TerminateProcess.KERNEL32(?,?,?,00007FF7A3B39A9C), ref: 00007FF7A3B39ABC
ExitProcess.KERNEL32 ref: 00007FF7A3B39ACB

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: e27601180f1410ffdd5329d3474d7cc339302a179a3e66a97bd19bf7c3082a87
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 71D05E10B1A70687FB887F301C98178A2136F48B40F861438C9CB26BB3ED3EA40C4320

Function 00007FF8A8612FB8 Relevance: 3.9, APIs: 3, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A87AA6E2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A87AA747

Memory Dump Source

Source File: 00000002.00000002.2233773817.00007FF8A8611000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8610000, based on PE: true

Associated: 00000002.00000002.2233719326.00007FF8A8610000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A861D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A8675000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A8689000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A869A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A86A0000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A86AD000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A885B000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A8888000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A88B9000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A88DF000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A8905000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235131968.00007FF8A892C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235224863.00007FF8A8932000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8934000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8950000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8954000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8610000_builded.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6864a761944ec2654b58eae12ae0b32c8dbe35088e837abbc3cabeeea62e08e4
Instruction ID: e64b290b60fd700b8aace884af3d5ff4aaed55215fa84296dd5021e994a14c30
Opcode Fuzzy Hash: 6864a761944ec2654b58eae12ae0b32c8dbe35088e837abbc3cabeeea62e08e4
Instruction Fuzzy Hash: 1F316021B1B68255EE94CB46B55413AD7A4EF89BC0F4C1435EE4E07B4ADF2CE8418B18

Function 00007FF8B61B6D40 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,?,00007FF8B61B6A65), ref: 00007FF8B61B70C8

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8B61B70B7

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 1767461275-2512360314
Opcode ID: bd53e6fc818244c25e435d994b3a884f1f165cbe6141e99f021bcfac66b9e287
Instruction ID: 2cc10b3c9af344c51fe52ee90d5c48b5b9f6aaa8fd23a45b4855761c9e502689
Opcode Fuzzy Hash: bd53e6fc818244c25e435d994b3a884f1f165cbe6141e99f021bcfac66b9e287
Instruction Fuzzy Hash: 5A918B72A08A4286EB64DF2DD4543B927A4FB45BC8F0C017ADB4D87A94CF3EE945CB50

Function 00007FF8B61B6668 Relevance: 3.3, APIs: 2, Instructions: 316COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8B61B67BA
SetLastError.KERNEL32 ref: 00007FF8B61B67C1
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8B61B6B20

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: d91c353022e18e8c7fba8ab01a5b39995b184d47e2ab8ef492f61c0125e03bd4
Instruction ID: 33c637f190e3a7a7ddaf1c44500d37dd66f86816be61bda2b3901dc61af227f1
Opcode Fuzzy Hash: d91c353022e18e8c7fba8ab01a5b39995b184d47e2ab8ef492f61c0125e03bd4
Instruction Fuzzy Hash: 79219D72A08B02C6FB649F29944123D37E8EB21BC4F2C84B4DB0D53295CF38E881DB91

Function 00007FF7A3B301AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B301F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B302E7

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 172dea6ede5df94c3a544b523b10cacb5da7c2b33d1e43a4ed145f88f2f37af7
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: FB510B21B0B66146F7ACAD25940067AE293BF44BA4F964730DDEE23FE5CF3ED5018621

Function 00007FF8B61B5F80 Relevance: 3.1, APIs: 2, Instructions: 60COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8B61B67BA
SetLastError.KERNEL32 ref: 00007FF8B61B67C1
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8B61B6B20

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: dd87c8fa57a67f30e78edd1cda4d61b8500bc7ecdac66fbb42d91985a94daee1
Instruction ID: 405b26bdf919f3b6ec684f27d7b62a713ab52b9a637768b443b40153386b0d68
Opcode Fuzzy Hash: dd87c8fa57a67f30e78edd1cda4d61b8500bc7ecdac66fbb42d91985a94daee1
Instruction Fuzzy Hash: 0F214C32A08A42C6EB649F29944127D37A8EF65BC4F1C84B5EB0D56295CE38E881DB91

Function 00007FF7A3B3C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF7A3B3C33D), ref: 00007FF7A3B3C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7A3B3C33D), ref: 00007FF7A3B3C1FA

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 518ec3352aa66293dd6046cd2a2c2872677ba7b28e54b8fe80f54b2cb4f43246
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 8011E261B09A9181DA94AF65B804069F362AB41BF0F950331EEBD5BFF9CF7DD0058700

Function 00007FF7A3B3A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 1c7ae19908d349c071fba142e6719fed6c9cd6196a60dae7f1d79e823d916529
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 5CE04811E0B11282FF9C7FB2544517852525F84741B860134D99D72AB1DE2D54454320

Function 00007FF7A3B3ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF7A3B3AA45,?,?,00000000,00007FF7A3B3AAFA), ref: 00007FF7A3B3AC36
GetLastError.KERNEL32(?,?,?,00007FF7A3B3AA45,?,?,00000000,00007FF7A3B3AAFA), ref: 00007FF7A3B3AC40

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 52ee82a873438b010b68df26915721b14e4560e149e8a6ac5dc5155ed6c28cab
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: FA21FC10F1E66241FED87F25A850279E3835F84790FDA4234D99E57FE2CE6EE4444311

Function 00007FF7A3B3BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BF44

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: a4e8ddff93c1387616c161f10057a8f4fb0cde323ccd38ec5c8d3a6f67380717
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: E141083290A25187EABCEF59A440279F3A2EB55B40F911131D6CE53EE5CF2EE402CB71

Function 00007FF7A3B27F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7A3B2802A

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: e68f7924d8d775e7cfc988c1acc5ef8cb841fcb1ab7bf70469a3d80c82781ba4
Instruction ID: 5bdb8a6e7ec4c738c08a9292d06a3031aa2d05b12a86ed313c70dd4ab39909bc
Opcode Fuzzy Hash: e68f7924d8d775e7cfc988c1acc5ef8cb841fcb1ab7bf70469a3d80c82781ba4
Instruction Fuzzy Hash: 6D21F811B0A79185FA94BF5264007BBD752BF45BC4FCE4430EE8D67B96CE3EE0418610

Function 00007FF7A3B3B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3BA32

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: b7d3c37de9898df05972a5e492cd2bf32b4f69a5b2b6b29bbd9c9dfc766ef411
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: FE31C721919A6286F798BF55840137CAA51AF40B94FC70135D99D23FF2CF7EE4418731

Function 00007FF8B6171E33 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B6188F03

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 1593eff19503944649c9bc9665cf5f1527ef5e121e216453edb142883cf065e3
Instruction ID: e3a8d12cbbc784712996b6481dfdcfbba00e2b80b042387f2a32597ead07408d
Opcode Fuzzy Hash: 1593eff19503944649c9bc9665cf5f1527ef5e121e216453edb142883cf065e3
Instruction Fuzzy Hash: A7318E32618B8586D7908F6AE440BED77A0F789B88F084176EF8C4BB59CF79C1458B10

Function 00007FF7A3B399D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A3B399FF

Part of subcall function 00007FF7A3B39AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF7A3B39B1D
Part of subcall function 00007FF7A3B39AF8: GetProcAddress.KERNEL32 ref: 00007FF7A3B39B33
Part of subcall function 00007FF7A3B39AF8: FreeLibrary.KERNEL32 ref: 00007FF7A3B39B5A

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: e6a7b8e11369610db55a955a84c8f18c20d8163bdcbe631d056c2c388e94407d
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 72219F32A067918EEBA8AF68C4403EC73A2EB44718F850635D69D26FE5DF3DD444C760

Function 00007FF7A3B36004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B35F69

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 0b5c6c55093ab0d0f26685c1f22ed4525e319fc2daf1e60b35ec3bd51ac9d819
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 18118422A1E66141EAA8FF1194051BDE266AF45B84FD64032EBCC77EB6DF3ED4408720

Function 00007FF7A3B463C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B463E7

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 762c549be86612a9fb3ac974735a73b68ab84d8ee9379a6f55aa030b5878e926
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 5321FC7261968147EBE49F18E440379F762FB84B54F950234D6DD976E5DF3ED8008B10

Function 00007FF7A3B3042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B30480

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 39d7b263bfa548f9cb031719f5733e82c1df9653b112ae5cea5ec08b046ef67d
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: DB01A561A0976140E988EF565901169E6A6AF85FE0F8A4631EEDD27FE6CE3EE1014310

Function 00007FF8B61B6130 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61B6166

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID:
API String ID: 1767461275-0
Opcode ID: 4f48c1642cd8e079b41de6a7940bea788ae535b90593227ebd844b7e21ca7648
Instruction ID: 9b65226a497e5ac9331158598a9926bd728e16dc561e9f264575e2c339c166c2
Opcode Fuzzy Hash: 4f48c1642cd8e079b41de6a7940bea788ae535b90593227ebd844b7e21ca7648
Instruction Fuzzy Hash: 6F01817261864186E7649F2DD40537966A4FBC5BDCF1C0175EF5847BEACA3DD880CB40

Function 00007FF8B6171C53 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61B6D06

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 185a4590cae240f77e7eedd31c7c89c79780733dc315fcf5ce2bcf5490361713
Instruction ID: 0c0dbaca4e123fdbafb5440f626e19be6c58ae33c2108da837475cdad61a7bfd
Opcode Fuzzy Hash: 185a4590cae240f77e7eedd31c7c89c79780733dc315fcf5ce2bcf5490361713
Instruction Fuzzy Hash: 8BE048F2F0550246F7605B7D9446B6816A0EB58754F7C1070DF0CC6682E6ADE8D68744

Function 00007FF7A3B29070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

LoadLibraryExW.KERNEL32(?,00007FF7A3B26466,?,00007FF7A3B2336E), ref: 00007FF7A3B29092

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: b7c0ab472eafdec2db0daefeba6f46b9164864673f0ce6c64f459fd24cf8c88d
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 10D08C11B2929542FA98BB67BA466799252ABC9BC0F888035EE9D03B6ADC3DD0514B00

Function 00007FF8A8612B53 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32 ref: 00007FF8A880753F

Memory Dump Source

Source File: 00000002.00000002.2233773817.00007FF8A8611000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A8610000, based on PE: true

Associated: 00000002.00000002.2233719326.00007FF8A8610000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A861D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A8675000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A8689000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A869A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A86A0000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A86AD000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2233773817.00007FF8A885B000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A885D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A8888000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A88B9000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A88DF000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2234341395.00007FF8A8905000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235131968.00007FF8A892C000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235224863.00007FF8A8932000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8934000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8950000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2235276694.00007FF8A8954000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8610000_builded.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 0f56840c3668eef90e64ac72c1166a1ce6f4bd6752172c29d911233d513c3bc9
Instruction ID: fe6e379b30c23b09a235b87b7078b1d5144297355f34c72681e4b2578e889964
Opcode Fuzzy Hash: 0f56840c3668eef90e64ac72c1166a1ce6f4bd6752172c29d911233d513c3bc9
Instruction Fuzzy Hash: B0C01225F0700357F7482378A85A1691150DF44351F905034E00EC2AD1DE0C98598714

Function 00007FF7A3B3D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7A3B30D00,?,?,?,00007FF7A3B3236A,?,?,?,?,?,00007FF7A3B33B59), ref: 00007FF7A3B3D6AA

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 2ebd327048ff050b603dc9e8c724df69e4f3ea1965146595dbf736838f6aae49
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 2FF03A00B4B36645FAD87EA2580167892A24F547A0F8A0334D9BE65FF2DE2EE4408530

Non-executed Functions

Function 00007FF7A3B28BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28C46

Part of subcall function 00007FF7A3B3A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3A500

Part of subcall function 00007FF7A3B3878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B387F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28CD6
CreateProcessW.KERNEL32 ref: 00007FF7A3B28D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28D18

Part of subcall function 00007FF7A3B22C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
Part of subcall function 00007FF7A3B22C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
Part of subcall function 00007FF7A3B22C50: MessageBoxW.USER32 ref: 00007FF7A3B22D99

RegisterClassW.USER32 ref: 00007FF7A3B28D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28D7B
CreateWindowExW.USER32 ref: 00007FF7A3B28DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E05
PeekMessageW.USER32 ref: 00007FF7A3B28E29
TranslateMessage.USER32 ref: 00007FF7A3B28E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E41
PeekMessageW.USER32 ref: 00007FF7A3B28E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B28FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF7A3B29009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B29012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7A3B23F7F), ref: 00007FF7A3B2901F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF7A3B28D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7A3B28D44
CreateProcessW, xrefs: 00007FF7A3B28D27
Failed to create child process!, xrefs: 00007FF7A3B28D20

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: e4fc686783f1129091db99638aa1a1cebffbb8aea9e547f8718db64a03b5cc8e
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: D9D1A432A0AA8286F790EF74E8546A9B762FF84758F810235DADD63AB4DF3DD104C714

Function 00007FF8B61715B4 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 207COMMON

Download Yara Rule

APIs

OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8B6191031
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FF8B6191039
OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8B6191077
EVP_get_digestbyname.LIBCRYPTO-1_1 ref: 00007FF8B619107F
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B619109E
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B6191101
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191121
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B6191135
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B6191173
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191193
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B61911A7
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B61911E8
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191208
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B619121C
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B6191248
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191268
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B619127C
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B61912A8
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B61912C8
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B61912DC

Strings

gost-mac-12, xrefs: 00007FF8B6191165
`, xrefs: 00007FF8B61910BD
gost2012_256, xrefs: 00007FF8B619123A
gost2001, xrefs: 00007FF8B61911DA
gost-mac, xrefs: 00007FF8B61910E9
gost2012_512, xrefs: 00007FF8B619129A

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: E_finishY_asn1_find_strY_asn1_get0_info$J_nid2sn$D_sizeP_get_cipherbynameP_get_digestbyname
String ID: `$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512
API String ID: 3257371973-344903700
Opcode ID: 066e596aa8e7a13275792c1bb4411d9b9abffa1e93482a02e3ed91d017f7f1b9
Instruction ID: c0b5929f70eebf47d15f282faadac0842b6058942ebbec5f8477d4a3ca1f8742
Opcode Fuzzy Hash: 066e596aa8e7a13275792c1bb4411d9b9abffa1e93482a02e3ed91d017f7f1b9
Instruction Fuzzy Hash: 8DA15172E097528AF720DF28E8516A936A4FB487D8F45027AEB4D83AE4DF3CE141C744

Function 00007FF8B61C7530 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B61C7573
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FF8B61C75D3
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C7A3E
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61C7A58
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C7A69

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B61C7580, 00007FF8B61C75B1, 00007FF8B61C7802, 00007FF8B61C7849, 00007FF8B61C79D3, 00007FF8B61C7A05, 00007FF8B61C7A21

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$X509_get0_pubkeyX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 1476775391-2839845709
Opcode ID: 6caa239500de3fba0d39ec1ca4584f65b0517aa0fe9eccf951fd18664870877a
Instruction ID: 82e7c44c38daad40f99e1ec515661a8aaa6f25f1aa96f7916d55244b0af2bdc2
Opcode Fuzzy Hash: 6caa239500de3fba0d39ec1ca4584f65b0517aa0fe9eccf951fd18664870877a
Instruction Fuzzy Hash: 50E1AE32A0868286EB24CB2AE4447BD77A0FB84BC4F544171DB8D4BB95DFBCE649C714

Function 00007FF8B617254F Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 296COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8B61A0FB6
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B61A0FBE
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61A0FEB
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A1321
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A1337
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A134D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A1363
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A1378
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A1380

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A11A9, 00007FF8B61A11F8, 00007FF8B61A1218, 00007FF8B61A1232, 00007FF8B61A1310, 00007FF8B61A132A, 00007FF8B61A1340, 00007FF8B61A1356, 00007FF8B61A136E

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$O_ctrlO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 775051240-2723262194
Opcode ID: cf6e5f718dc7574cbe193d1a8e0e408ca73411cb6cc2fbe5df2a4a56f1d01eb7
Instruction ID: 67e200f98aee7cfe31e38abc21a7ce18c8fe325566407152a2aa215abc90cad6
Opcode Fuzzy Hash: cf6e5f718dc7574cbe193d1a8e0e408ca73411cb6cc2fbe5df2a4a56f1d01eb7
Instruction Fuzzy Hash: 50C1DD62F186569AFB20CF69D4412BD27A5AF457C8F0041BAEF5E97B89DE3CE605C300

Function 00007FF8B617177B Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 430COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B61B312A
EVP_PKEY_new_raw_private_key.LIBCRYPTO-1_1 ref: 00007FF8B61B314B
EVP_sha256.LIBCRYPTO-1_1 ref: 00007FF8B61B316E
EVP_DigestSignInit.LIBCRYPTO-1_1 ref: 00007FF8B61B3183
EVP_DigestSign.LIBCRYPTO-1_1 ref: 00007FF8B61B31A4
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61B31C0
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61B31C8
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8B61B31DA
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61B3752
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61B375A
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61B3775
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61B377D

Strings

, xrefs: 00007FF8B61B31B1
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8B61B37B0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: X_freeY_free$DigestSign$InitO_memcmpP_sha256X_newY_new_raw_private_key
String ID: $..\s\ssl\statem\extensions_srvr.c
API String ID: 1001666065-1533168471
Opcode ID: d2b9715834416d6d4f95a1464492f4c599caee1008d219036fd75b5297f730aa
Instruction ID: ad1c23e58d171adcf569037414cbb0b8d557584bb13a16eb1a9056ecaf555bb2
Opcode Fuzzy Hash: d2b9715834416d6d4f95a1464492f4c599caee1008d219036fd75b5297f730aa
Instruction Fuzzy Hash: 691207A2B1CA8282FB609B29D4546BE6BA9EF807C4F5C4071EB4D47AD5DF3CE615C700

Function 00007FF8B61717BD Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8B61D078E
d2i_X509.LIBCRYPTO-1_1 ref: 00007FF8B61D0911
X509_free.LIBCRYPTO-1_1 ref: 00007FF8B61D0B11
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61D0B20

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8B61D07B2, 00007FF8B61D08AC, 00007FF8B61D0DD9

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1068509327-348624464
Opcode ID: 8bc3a8f7366ee703e66a327b67079a6235c503054a1eef628dfa69fe8cf9d49e
Instruction ID: 00986e81420922f83049cb4f6e8bf667ceb6e58d84f087813be07f1fa2419bfa
Opcode Fuzzy Hash: 8bc3a8f7366ee703e66a327b67079a6235c503054a1eef628dfa69fe8cf9d49e
Instruction Fuzzy Hash: 8DF1CE32A0C68685EB70CF29E4443BA77A5EB84BD9F144175EB8D4BA99DF3CE581C700

Function 00007FF8B6199720 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6199752
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6199782

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6199744, 00007FF8B6199772, 00007FF8B6199794, 00007FF8B61997DF, 00007FF8B6199807, 00007FF8B6199AA9, 00007FF8B6199AF4, 00007FF8B6199B4D

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 77fddfaab2726cf9ca24b8fc7edc8787aa8e96df839b77dbf3d0aa5cd5c50d16
Instruction ID: 56d74ad28f8359a48980f8048483b8a9255551b2ad98a1d2111d75d483d307c1
Opcode Fuzzy Hash: 77fddfaab2726cf9ca24b8fc7edc8787aa8e96df839b77dbf3d0aa5cd5c50d16
Instruction Fuzzy Hash: 79E1F876A06B81D6EB98CF29D5803E973A4FB48B98F084176DF5C4B395DF38A161CB10

Function 00007FF8B61715C8 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B61C63E2
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C6676
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61C667E

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B61C6376

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 419883019-2839845709
Opcode ID: d97a1175b1084a4846ecaf81ad5bde1a474ccb26e35fb4fcca7df6fdb31c2ae9
Instruction ID: e4eea9d65e333a1cd682ae4c92875b333935fc11edb12cee4634ff03bed464df
Opcode Fuzzy Hash: d97a1175b1084a4846ecaf81ad5bde1a474ccb26e35fb4fcca7df6fdb31c2ae9
Instruction Fuzzy Hash: 0F91C171A0CA8281FB60DB1AE4117BE6BA1EB84BD8F140075EF4D4BB99DF3CD5498B44

Function 00007FF8B61A3730 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FF8B61A376F
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8B61A377D
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8B61A378E
X509_free.LIBCRYPTO-1_1 ref: 00007FF8B61A379A
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8B61A37AD
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A37C6
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A37DF
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A37F8
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A3811
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A382A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A3843
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A385C
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FF8B61A3868
CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FF8B61A3882

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FF8B61A37B9, 00007FF8B61A37D2, 00007FF8B61A37EB, 00007FF8B61A3804, 00007FF8B61A381D, 00007FF8B61A3836, 00007FF8B61A384F, 00007FF8B61A3873

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$L_cleanse$D_lock_freeL_sk_pop_freeO_clear_freeO_free_ex_dataX509_free
String ID: ..\s\ssl\ssl_sess.c
API String ID: 4155952050-2868363209
Opcode ID: 75faa34386be25a96ca77000f6802a203e63b0ccb9e7bb91d5e6fdf8a61245fe
Instruction ID: fffcaac5d0df9c95c6edd52d0660b2753b6fad24a095a260d50719eae7c85c17
Opcode Fuzzy Hash: 75faa34386be25a96ca77000f6802a203e63b0ccb9e7bb91d5e6fdf8a61245fe
Instruction Fuzzy Hash: F7312C61F1A64391FB15EB6EE8557FC2321EB85BD8F4410B2DE0C4B296DE2DE249C360

Function 00007FF8B61716F4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8B61A5868
CRYPTO_THREAD_lock_new.LIBCRYPTO-1_1 ref: 00007FF8B61A598C
X509_up_ref.LIBCRYPTO-1_1 ref: 00007FF8B61A59C8
X509_chain_up_ref.LIBCRYPTO-1_1 ref: 00007FF8B61A59EF
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5A1D
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5A4B
CRYPTO_dup_ex_data.LIBCRYPTO-1_1 ref: 00007FF8B61A5A6F
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5A91
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5AC6
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A5AF4
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5B4C
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5B7A
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8B61A5BAF

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FF8B61A585C, 00007FF8B61A5A16, 00007FF8B61A5A44, 00007FF8B61A5A8A, 00007FF8B61A5AB9, 00007FF8B61A5AE4, 00007FF8B61A5B3F, 00007FF8B61A5B73, 00007FF8B61A5BA2

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_strdup$O_memdup$D_lock_newO_dup_ex_dataO_mallocR_put_errorX509_chain_up_refX509_up_ref
String ID: ..\s\ssl\ssl_sess.c
API String ID: 101854310-2868363209
Opcode ID: d17860a991c12f4e7e514c101f9d794b8aebc88e1213757499e89d27d893f965
Instruction ID: 9904b6469748609697a83658d291eda2cb36d7d8959445116bec842a28a5dac5
Opcode Fuzzy Hash: d17860a991c12f4e7e514c101f9d794b8aebc88e1213757499e89d27d893f965
Instruction Fuzzy Hash: 11A12E22A1ABC282EB55DF28E5503F833A0FF54788F085275DF5C16666EF38E194D720

Function 00007FF8B617256D Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 314COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_iv_length.LIBCRYPTO-1_1 ref: 00007FF8B6182466
memcpy.VCRUNTIME140 ref: 00007FF8B6182885

Strings

M, xrefs: 00007FF8B6182847
..\s\ssl\record\ssl3_record_tls13.c, xrefs: 00007FF8B61823E2, 00007FF8B6182827, 00007FF8B6182854

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: X_iv_lengthmemcpy
String ID: ..\s\ssl\record\ssl3_record_tls13.c$M
API String ID: 544732426-1371881060
Opcode ID: e4a604075973763b4b1902fee18603d5bb49197ad29112221864013e394e681a
Instruction ID: 82dd6beed79c6e07e80e1fe91f71ab226b0c1250984d6c3ab5f5efdb7229f012
Opcode Fuzzy Hash: e4a604075973763b4b1902fee18603d5bb49197ad29112221864013e394e681a
Instruction Fuzzy Hash: DAE1BC62B086828AFB218F6AD4503BE3BA1FB597C8F084175DF4D47A9ADF38E551C740

Function 00007FF8B61BB720 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

X509_get0_pubkey.LIBCRYPTO-1_1(?,?,?,?,?,..\s\ssl\statem\statem_clnt.c,?,?,?,00007FF8B61BC337), ref: 00007FF8B61BB78F

Strings

0, xrefs: 00007FF8B61BB94B
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61BB724, 00007FF8B61BB756, 00007FF8B61BB79F

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c$0
API String ID: 2698272274-513810425
Opcode ID: 5b5233d38ecf0693e14eb18ebbde31e011178da0152cfead48d5034e06c2f492
Instruction ID: b609cd7ad4e6ed1d2a96e6247ca487fc38cf2af06aff3cad2b17192e83d8af6d
Opcode Fuzzy Hash: 5b5233d38ecf0693e14eb18ebbde31e011178da0152cfead48d5034e06c2f492
Instruction Fuzzy Hash: 3671A272A09A4286EB20DB1AE5107BA7B94EB85BD8F4C4075DF8D47B85DF3CE2058B00

Function 00007FF8B6171523 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61DBFC3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61DBFDC
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DBFE8
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DBFF4
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC000
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC00C
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC018
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC024
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC030
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61DC03C

Strings

..\s\ssl\tls_srp.c, xrefs: 00007FF8B61DBFB6, 00007FF8B61DBFCF

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: N_free$O_free
String ID: ..\s\ssl\tls_srp.c
API String ID: 3506937590-1778748169
Opcode ID: 75fbdc94c779b8318019f97e81634c190a6ec1d97ae7336c15588027b7e3bf52
Instruction ID: 45a4dadcd4e8731dfc6db2aeb85ff9919d7137e351acdbb03959e3c49049e88b
Opcode Fuzzy Hash: 75fbdc94c779b8318019f97e81634c190a6ec1d97ae7336c15588027b7e3bf52
Instruction Fuzzy Hash: D8212162E1AB8682E715DF35C8513F81324EB95B88F485275FF0D4A267DFA8A3C18350

Function 00007FF8B61C1620 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FF8B61C09B8), ref: 00007FF8B61C165B
ERR_put_error.LIBCRYPTO-1_1(?,00007FF8B61C09B8), ref: 00007FF8B61C1683
CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FF8B61C09B8), ref: 00007FF8B61C16A4
ERR_put_error.LIBCRYPTO-1_1(?,00007FF8B61C09B8), ref: 00007FF8B61C16CC
CRYPTO_free.LIBCRYPTO-1_1(?,00007FF8B61C09B8), ref: 00007FF8B61C16DF

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8B61C164D, 00007FF8B61C1668, 00007FF8B61C169A, 00007FF8B61C16B1, 00007FF8B61C16D5, 00007FF8B61C16FF, 00007FF8B61C1713, 00007FF8B61C173A
R, xrefs: 00007FF8B61C171A

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_mallocR_put_error$O_free
String ID: ..\s\ssl\statem\statem_dtls.c$R
API String ID: 1091011155-469809446
Opcode ID: e68bbd5e43c3f9b40fc4de909b540b2ee8b1db909ec6226f1868466ca6cc50d0
Instruction ID: 8fa94be285c76a8b49b8d17e9365fe0b7ac41c2e3a5c4c5fb8004adec364b788
Opcode Fuzzy Hash: e68bbd5e43c3f9b40fc4de909b540b2ee8b1db909ec6226f1868466ca6cc50d0
Instruction Fuzzy Hash: 31319032A0964296E720EF1AE4012A97364FB447C4F844471EB4D47B99EF7DF608CB04

Function 00007FF8A84F12F0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A84F18D0: PyMem_Malloc.PYTHON310 ref: 00007FF8A84F193B
Part of subcall function 00007FF8A84F18D0: PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F1A1D
Part of subcall function 00007FF8A84F18D0: PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F1A7A

PyMem_Malloc.PYTHON310 ref: 00007FF8A84F1372
PyMem_Free.PYTHON310 ref: 00007FF8A84F14B6
PyErr_NoMemory.PYTHON310 ref: 00007FF8A84F38E9
_Py_Dealloc.PYTHON310 ref: 00007FF8A84F38F9

Strings

0, xrefs: 00007FF8A84F1346

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID: 0
API String ID: 4139299733-4108050209
Opcode ID: 9f9c89dfe89939c84336a20baca6dfd687e87eebe8aa8381b46da653639d6d15
Instruction ID: dab535da099eec71162e1d013b61b307ce6a1445dc51c847e668ce83d3f48a9f
Opcode Fuzzy Hash: 9f9c89dfe89939c84336a20baca6dfd687e87eebe8aa8381b46da653639d6d15
Instruction Fuzzy Hash: 23E1D072E0F592A5EA698B15D40867A73E5FB44FC4F144139EA8E82784DFBCEC41C728

Function 00007FF8A84F18D0 Relevance: 13.9, APIs: 9, Instructions: 435COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310 ref: 00007FF8A84F193B
PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F1A1D
PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F1A7A
PyUnicode_FromKindAndData.PYTHON310 ref: 00007FF8A84F1B4E
PyMem_Free.PYTHON310 ref: 00007FF8A84F1B5A
PyMem_Realloc.PYTHON310 ref: 00007FF8A84F1C39
PyMem_Free.PYTHON310 ref: 00007FF8A84F3A6B
PyErr_NoMemory.PYTHON310 ref: 00007FF8A84F3A71

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Mem_$FreeSubtypeType_$DataErr_FromKindMallocMemoryReallocUnicode_
String ID:
API String ID: 3719493655-0
Opcode ID: a6f8d227c04c96ee92d3327cf4cee3c09afe3ee40d30a4d34132af5cf80b64b2
Instruction ID: 896ef1a50a9c935deb9398bba22edd5b41da8b10e39f46cc571bdce607ee781b
Opcode Fuzzy Hash: a6f8d227c04c96ee92d3327cf4cee3c09afe3ee40d30a4d34132af5cf80b64b2
Instruction Fuzzy Hash: 7D023372F0F692A2EB698B15D41467936A5EB84FC4F04413DDA8E467D4EFADEC40C328

Function 00007FF8A84F3068 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A84F3084
memset.VCRUNTIME140 ref: 00007FF8A84F30A8
RtlCaptureContext.KERNEL32 ref: 00007FF8A84F30B1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A84F30CB
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A84F310C
memset.VCRUNTIME140 ref: 00007FF8A84F313F
IsDebuggerPresent.KERNEL32 ref: 00007FF8A84F3160
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A84F3181
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A84F318C

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 00f1522312bfcd982374d2b7872c5ef4cc0ec29a30735505d4bf24cc2f66f2d8
Instruction ID: c31a239137050c05305cd6589d6c57b76c16a8508c8087b29a5660f902e9ce97
Opcode Fuzzy Hash: 00f1522312bfcd982374d2b7872c5ef4cc0ec29a30735505d4bf24cc2f66f2d8
Instruction Fuzzy Hash: 3431627260AB8199EB64CF60E8407ED3361FB84B84F44403EDA4E47798EF78C948C728

Function 00007FF8B61C2820 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61C2890
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61C2899
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C28AF
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C28C5
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61C28DA
memcpy.VCRUNTIME140 ref: 00007FF8B61C294B

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8B61C28A2, 00007FF8B61C28B8, 00007FF8B61C28D0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$X_free$memcpy
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 1711549817-3140652063
Opcode ID: 3c0d4046dcd5efa6f57721ad595d4f812cd9634dc63155fda5099db59d012e40
Instruction ID: 1b381017d80fff7961bd8de494eda35e736cdb06d93cdcd68d6c4acb73314ea4
Opcode Fuzzy Hash: 3c0d4046dcd5efa6f57721ad595d4f812cd9634dc63155fda5099db59d012e40
Instruction Fuzzy Hash: 92416862A0864282EA24EF2ED4523BD27A1FB85FD4F084471DF4D4B796DE7DD886C304

Function 00007FF7A3B283B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B2841B
RemoveDirectoryW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B2849E
DeleteFileW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284BD
FindNextFileW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284CB
FindClose.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284DC
RemoveDirectoryW.KERNEL32(?,00007FF7A3B28B09,00007FF7A3B23FA5), ref: 00007FF7A3B284E5

Strings

%s\*, xrefs: 00007FF7A3B283E2

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 8d1eba053c0aa4e779df41e2a6177281567e3d99fdf5e25ffe1ea993bd01c88c
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 4C41C621A1E58282EAB0BFA4E4449B9A362FF94754FC10331D5EEA36E4DF3DD5058710

Function 00007FF8B6174690 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-1_1 ref: 00007FF8B61746B4
BIO_get_shutdown.LIBCRYPTO-1_1 ref: 00007FF8B61746CC
BIO_get_init.LIBCRYPTO-1_1 ref: 00007FF8B61746D8
BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8B61746F1
BIO_set_init.LIBCRYPTO-1_1 ref: 00007FF8B61746FB
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6174710

Strings

..\s\ssl\bio_ssl.c, xrefs: 00007FF8B6174706

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_clear_flagsO_freeO_get_dataO_get_initO_get_shutdownO_set_init
String ID: ..\s\ssl\bio_ssl.c
API String ID: 3531300166-4039210333
Opcode ID: 95d8aa021e220a86cb42fc1fa28408fcca7b1e0d037d70d08795db5f3bff898b
Instruction ID: 1648d45b82bd39b192c4b4596347dfe3e718cc48a979310c0b61320c4c96329e
Opcode Fuzzy Hash: 95d8aa021e220a86cb42fc1fa28408fcca7b1e0d037d70d08795db5f3bff898b
Instruction Fuzzy Hash: 88014F91F1A68341FA64FB7F995227916819F867E0F0811B0FF1E867C6EE1CE5854710

Function 00007FF8B61714FB Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

EVP_PKEY_get1_tls_encodedpoint.LIBCRYPTO-1_1 ref: 00007FF8B61B1EA6
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61B1EDC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61B1F1B
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61B1F7E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61B1F91

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8B61B1D7E, 00007FF8B61B1E5E, 00007FF8B61B1EB0, 00007FF8B61B1F0E, 00007FF8B61B1F5D

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeY_free$Y_get1_tls_encodedpoint
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 3595761781-1853348325
Opcode ID: fa503a48aac962b92e37a8efb8bf717dca5e93b649bd7648712d72c2813d0840
Instruction ID: 79c0fb5dfaf18b06c809205f6b09149b1a868e1d99eb8a2a5506e9ef8d1377e4
Opcode Fuzzy Hash: fa503a48aac962b92e37a8efb8bf717dca5e93b649bd7648712d72c2813d0840
Instruction Fuzzy Hash: C571CE61B0CA4285FB609B1AE5427BD67A5EF85BD4F4C00B1EF4D47B8ACF2CE5058B00

Function 00007FF8B61D0570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1 ref: 00007FF8B61D05D8
BN_ucmp.LIBCRYPTO-1_1 ref: 00007FF8B61D0607
BN_is_zero.LIBCRYPTO-1_1 ref: 00007FF8B61D061B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61D0646
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61D065B

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8B61D062F, 00007FF8B61D06D9

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: N_bin2bnN_is_zeroN_ucmpO_freeO_strdup
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 3996552382-348624464
Opcode ID: e663218e5bc5cb7894182549be65a187b552d419c64a41ca055cca23d52581a7
Instruction ID: b59dd437fe7955274d454f24943f48a6574fe507f90ba0f72379b63eb94e2374
Opcode Fuzzy Hash: e663218e5bc5cb7894182549be65a187b552d419c64a41ca055cca23d52581a7
Instruction Fuzzy Hash: 9441F332B08A8281EB609F29E454BBD67A5EB84BD8F144275DF5D4BB94DF3CD5C18B00

Function 00007FF7A3B2D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7A3B2D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF7A3B2D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A3B2D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A3B2D240
IsDebuggerPresent.KERNEL32 ref: 00007FF7A3B2D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B2D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B2D2BC

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 31bd836aa4dca6d69a12040644bb50667ee2a91fd22fa37bef97dcd48a7377e3
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 91316272A09B8186EBA0DF60E8407EE7365FB84704F454139DB8D57BA5DF39C548C724

Function 00007FF7A3B45C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B45CB5

Part of subcall function 00007FF7A3B45608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4561C

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

Part of subcall function 00007FF7A3B3A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7A3B3A94F,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3A979
Part of subcall function 00007FF7A3B3A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7A3B3A94F,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3A99E

_get_daylight.LIBCMT ref: 00007FF7A3B45CA4

Part of subcall function 00007FF7A3B45668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4567C

_get_daylight.LIBCMT ref: 00007FF7A3B45F1A
_get_daylight.LIBCMT ref: 00007FF7A3B45F2B
_get_daylight.LIBCMT ref: 00007FF7A3B45F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A3B4617C), ref: 00007FF7A3B45F63

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: 3c3bb102c56ebad51b1393ae4929d0a6daf2b151313e9b2413d0e2eda43c5d93
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: 27D1F722E0A65245F7A0FF21D4411B9A352FF44784FC68136EA8D67AB6DF3EE441C364

Function 00007FF7A3B3A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A3B3A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A3B3A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A3B3A750
IsDebuggerPresent.KERNEL32 ref: 00007FF7A3B3A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B3A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7A3B3A79E

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: eb680d5f40c7f7304a559682e9a79a188b4625c66251e004918a7363b85b5e9b
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 1D31B332609B8186EBA0DF24E8407AEB3A5FB88754F950135EACD53BA5DF3DC145CB10

Function 00007FF8B617176C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61AD978
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8B61AD988

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8B61AD8CB, 00007FF8B61AD961, 00007FF8B61ADB03

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_malloc
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2609694610-592572767
Opcode ID: a2ce6b5e007f25030ca70bab99670ce1a3035366a3f223e86b5bb5c92eae3966
Instruction ID: 21a68b58c72dc1f6a9c2d5be29bd057ca11149f550b50852b135759f27a463ae
Opcode Fuzzy Hash: a2ce6b5e007f25030ca70bab99670ce1a3035366a3f223e86b5bb5c92eae3966
Instruction Fuzzy Hash: B0618C72A09B8185EB608F19E4942AD77A5EB85BD8F088275DF9C47BA4CF7CD2918700

Function 00007FF8B6171762 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6194627
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FF8B619467B
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FF8B61946B0
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61946DA

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619460C, 00007FF8B6194674, 00007FF8B6194699, 00007FF8B61946CA

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_reallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1389097454-1080266419
Opcode ID: b330547daaa1f886599e092ee754333c3e7c8a3a100f5c4aead87d2254576b0c
Instruction ID: 20d49baef62c9e673c43141dd05da002904be8ae045036b2d8a0cda113f82d08
Opcode Fuzzy Hash: b330547daaa1f886599e092ee754333c3e7c8a3a100f5c4aead87d2254576b0c
Instruction Fuzzy Hash: 1F41D073B097C6A7E626CB29A9002AAA790FB45BD8F444171EF9C03790DF3CE566C700

Function 00007FF8B61AA8B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

EVP_PKEY_get1_tls_encodedpoint.LIBCRYPTO-1_1 ref: 00007FF8B61AA94D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61AA9C1
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61AAA0F
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61AAA22

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8B61AA906, 00007FF8B61AA99A, 00007FF8B61AA9DC

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$Y_freeY_get1_tls_encodedpoint
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 4042585043-592572767
Opcode ID: de9781925f92abacbd6d7d16ef06a0f73eb5c048de4f1134ebcfadaa8664293f
Instruction ID: a78ea56d18a74ad8e2b500fb820b93124764be873ad774ca85d1afd266497a71
Opcode Fuzzy Hash: de9781925f92abacbd6d7d16ef06a0f73eb5c048de4f1134ebcfadaa8664293f
Instruction Fuzzy Hash: B541D171B0EB5181EB609B1AE44437A6BA1FB85BD0F044071EF8C07B96CF3DD5458704

Function 00007FF7A3B418E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B41930
FindFirstFileExW.KERNEL32 ref: 00007FF7A3B41A3A

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: fe6692428a1571d5511293155c3455b67f4a27c45399d9a8607adb8416462d1b
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: 9EB1B522F5A69241FAA1EF2194001B9E352EB44BD4F964131DEDE27BF5EE3DE441C314

Function 00007FF8B61AF8F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

CRYPTO_realloc.LIBCRYPTO-1_1(?,?,?,00007FF8B61AFC0A,?,?,?,00007FF8B61AF6DE), ref: 00007FF8B61AFA05

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FF8B61AF9FE
t3, xrefs: 00007FF8B61AF975
3, xrefs: 00007FF8B61AF97F

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_realloc
String ID: ..\s\ssl\statem\extensions_cust.c$3$t3
API String ID: 3931833713-171970420
Opcode ID: 35ff359d2387d8de8349f39b0a6f1015210611ba30c35afaa5d98352b1cdd542
Instruction ID: 2ff19ebf4de59662ee76a9496767427a9ad64cfd3c54ad2b2063f75f7a08b989
Opcode Fuzzy Hash: 35ff359d2387d8de8349f39b0a6f1015210611ba30c35afaa5d98352b1cdd542
Instruction Fuzzy Hash: 26418D72A08B8299EAA48F1D9580239A7A4EB48BD4F144172EF9D437A4DF3DE496C700

Function 00007FF8B6191790 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B619183C
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B6191851

Part of subcall function 00007FF8B6172090: ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8B61A2C93
Part of subcall function 00007FF8B6172090: BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8B61A2CBB
Part of subcall function 00007FF8B6172090: BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B61A2CC3
Part of subcall function 00007FF8B6172090: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A2CEB
Part of subcall function 00007FF8B6172090: X509_free.LIBCRYPTO-1_1 ref: 00007FF8B61A2E60
Part of subcall function 00007FF8B6172090: BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A2E68

Strings

gfffffff, xrefs: 00007FF8B619180D
..\s\ssl\ssl_conf.c, xrefs: 00007FF8B6191835, 00007FF8B6191847

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free$O_newO_s_fileO_strdupR_clear_errorR_put_errorX509_free
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 3738848979-4123734156
Opcode ID: 49680231bb8a1bcf174b3ca4e19a91868c58b19882ede3bea0cb7ddf647a651c
Instruction ID: 48673c11a5a938c3464c57a87499c145dbe6fa332ce6d47776eb5a42906f46e1
Opcode Fuzzy Hash: 49680231bb8a1bcf174b3ca4e19a91868c58b19882ede3bea0cb7ddf647a651c
Instruction Fuzzy Hash: 63219AA6B1AB4685EE58DF2BE44126927A1EB88FC0F184075EF0E87799DE28E4418341

Function 00007FF8B6172522 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6195E71
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B6195E9E
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B6195EB8

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6195E61, 00007FF8B6195E8A, 00007FF8B6195EAE

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_strdupR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 626504629-1080266419
Opcode ID: e75fc668dfe08f2d24baa60ae2701a799fd2acbc2ae01f3f5409286b6e126fa7
Instruction ID: 9e66ff5d3f13484e9f4ee51550578ef6e2016eac6641409753d36a322bcf076a
Opcode Fuzzy Hash: e75fc668dfe08f2d24baa60ae2701a799fd2acbc2ae01f3f5409286b6e126fa7
Instruction Fuzzy Hash: 65218E72F1868185FB918B2EE4483F8A7A0EB88BC0F584471DB5C87792DF2ED5968300

Function 00007FF8B61716D1 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8B6178AB7
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6178AE0

Strings

b, xrefs: 00007FF8B6178ACC
..\s\ssl\packet.c, xrefs: 00007FF8B6178AA9, 00007FF8B6178AC5

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_zallocR_put_error
String ID: ..\s\ssl\packet.c$b
API String ID: 2718799170-1717309047
Opcode ID: 0f14f4ad167ac08be25c75ef66c831664656dfee04c6cf2c542470f16a6606a0
Instruction ID: f3d567ad9374f6f2574326897bf38bd80874e3cb75f0761a13588d52f8914445
Opcode Fuzzy Hash: 0f14f4ad167ac08be25c75ef66c831664656dfee04c6cf2c542470f16a6606a0
Instruction Fuzzy Hash: 5921F0B2F09B0286EB948B19E4413B932A0EB047E4F604234DB5C473D0EF3CD54AC740

Function 00007FF8B61795F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8B6179614
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B617963C

Strings

..\s\ssl\record\rec_layer_d1.c, xrefs: 00007FF8B617960D, 00007FF8B6179621, 00007FF8B61796B2

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: ..\s\ssl\record\rec_layer_d1.c
API String ID: 2513334388-1306860146
Opcode ID: 58419fce4abdfd0c58543621b2fff55def53cc6ebb3db6fbfc314d8b9ba85277
Instruction ID: bd7e2eda48c878e2be2c4391edb0389d3c586d0303a15662e467b3f46ff0ad85
Opcode Fuzzy Hash: 58419fce4abdfd0c58543621b2fff55def53cc6ebb3db6fbfc314d8b9ba85277
Instruction Fuzzy Hash: FB21AC62A1974285EB50DF29E0413BD77A0EF84BA8F480475EB4C47386EF3DE994C740

Function 00007FF7A3B45EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B45F1A

Part of subcall function 00007FF7A3B45668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4567C

_get_daylight.LIBCMT ref: 00007FF7A3B45F2B

Part of subcall function 00007FF7A3B45608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4561C

_get_daylight.LIBCMT ref: 00007FF7A3B45F3C

Part of subcall function 00007FF7A3B45638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B4564C

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7A3B4617C), ref: 00007FF7A3B45F63

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: caf97e812170ea314b952396c26f9b2eca3818a770983570dbb9532eb73a0f9a
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: 1D517532A0A64286F790FF21D4815A9E762BB48744FC64136EACD637B6DF3EE4408764

Function 00007FF8B61A4820 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8B61A4870
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FF8B61A487C
OPENSSL_LH_delete.LIBCRYPTO-1_1 ref: 00007FF8B61A4895
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8B61A48BE

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_unlockD_write_lockH_deleteH_retrieve
String ID:
API String ID: 3040165603-0
Opcode ID: bdd71cfd702ffaa37004c839deb72ce7121d3a5acd699e7697b6de798a848261
Instruction ID: 896e9a65d5c897b6d065a045a111af0ed7f5055fdfe40a2e0707288363c033bb
Opcode Fuzzy Hash: bdd71cfd702ffaa37004c839deb72ce7121d3a5acd699e7697b6de798a848261
Instruction Fuzzy Hash: E5219362B19B8285EB65DB5AA410279A2A1EF84FC4F0C4171EF5D5BB8ADF3CE4019740

Function 00007FF8B617160E Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8B61A3482
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FF8B61A348E
OPENSSL_LH_delete.LIBCRYPTO-1_1 ref: 00007FF8B61A34A7
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8B61A34CB

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_unlockD_write_lockH_deleteH_retrieve
String ID:
API String ID: 3040165603-0
Opcode ID: ee1179067d4f7e6bd437950be642053309cdfdfb317ecdc10c49836d33f1c959
Instruction ID: c9ce220eecde993c08bde84255a39f1f7257bc61f62e35c07f1822dd2d8012d2
Opcode Fuzzy Hash: ee1179067d4f7e6bd437950be642053309cdfdfb317ecdc10c49836d33f1c959
Instruction Fuzzy Hash: D511B761B0978146EA65DB5AA054269E390FF49BD0F084071FF5D87B86DF2DE4418700

Function 00007FF8B617163B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61AEDC5
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8B61AEDEF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8B61AEDAE, 00007FF8B61AEE92

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_malloc
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2609694610-592572767
Opcode ID: 270676c743cf9cebe5723e4ecffaaefb02965fe37da9dfe55016d576b4148a45
Instruction ID: 0f8cf3117607b3af6e6ca7625162b9f947a90fe3631707ff5d1bf01e98c5a1bd
Opcode Fuzzy Hash: 270676c743cf9cebe5723e4ecffaaefb02965fe37da9dfe55016d576b4148a45
Instruction Fuzzy Hash: 6B31AD31A09F8285E770CF1AE40036A67A1EB84BC4F184475EF4C57B98DF3DE5529B04

Function 00007FF8B6195327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8B61953EF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6195417

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B61953E6, 00007FF8B61953FC

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_memdupR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1048774365-1080266419
Opcode ID: 9c6f3255b7e0ce66675522fd8876ece689a027c7e4635377238b0b8549612180
Instruction ID: 8accba65c4bd4790d41d74279fec479fd302dd4007345ffc2fcbd37f60a224f0
Opcode Fuzzy Hash: 9c6f3255b7e0ce66675522fd8876ece689a027c7e4635377238b0b8549612180
Instruction Fuzzy Hash: 1521D835A09782C3E7648B19A0086B97BA1EF81BC4F6841B1CB4827BC4EF2DE5138B00

Function 00007FF8B61BD840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61BD949
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61BD990

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61BD862, 00007FF8B61BD93C

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 2581946324-1507966698
Opcode ID: 079e4b86e6df4411b7a8ee29d5e6c66cdeddd75ef592b8aaf04caabef2017aa8
Instruction ID: 658b407a374b92069fd3a14705327fc9559ec4b3c3bf71c2311350e4649bd000
Opcode Fuzzy Hash: 079e4b86e6df4411b7a8ee29d5e6c66cdeddd75ef592b8aaf04caabef2017aa8
Instruction Fuzzy Hash: 1131AC62A28B8181E7608B59F4413AAB7A4F7847E8F485234FBDD06A99DF7DD1948B00

Function 00007FF8B61B85D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FF8B61B866F

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61B85DE
;, xrefs: 00007FF8B61B861A

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_clear_free
String ID: ..\s\ssl\statem\statem_clnt.c$;
API String ID: 2011826501-2335744092
Opcode ID: ed070525a0f97445b50aea7bfdeb4a089066b748b600bf91f8fd690816d75b5e
Instruction ID: 3d9bab6c4b84ce15bae8de80e1a95378e41a38a649b08ece4f71744e681c1920
Opcode Fuzzy Hash: ed070525a0f97445b50aea7bfdeb4a089066b748b600bf91f8fd690816d75b5e
Instruction Fuzzy Hash: 52215C21B18B8689E7908F1AD9856B96765FB49FD4F0C40B2DF8D17B95CF3CE4418300

Function 00007FF8B61B0620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61B066C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61B0682

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FF8B61B065F, 00007FF8B61B0675, 00007FF8B61B06A7

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 2581946324-3973221358
Opcode ID: cb93981deca7adcdd00091efa4fe982654f8a1cb5e491437d2663ad194458034
Instruction ID: 565604a6afd444622d4d089f5daee50ca59bbea9ee3373ab3ce8ce7884f52598
Opcode Fuzzy Hash: cb93981deca7adcdd00091efa4fe982654f8a1cb5e491437d2663ad194458034
Instruction Fuzzy Hash: 64018072F29E4295E7A0DB1EE0801A96765FB84BC4F185072EF8D47BA9DE3CD191C740

Function 00007FF8B61B7760 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1(?,00007FF8B61BD3BC), ref: 00007FF8B61B7797
CRYPTO_memdup.LIBCRYPTO-1_1(?,00007FF8B61BD3BC), ref: 00007FF8B61B77C0

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FF8B61B7787, 00007FF8B61B77B0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: f547aab25135d2f984ae19c677ca94e6a2ae4f30b03d999a9ba4bab457863762
Instruction ID: e5d720134d272c90672c274061b4dbc67bcf7631e9041c65c4774f5ea06a386f
Opcode Fuzzy Hash: f547aab25135d2f984ae19c677ca94e6a2ae4f30b03d999a9ba4bab457863762
Instruction Fuzzy Hash: DF01E872B16B8281EB90CF1AF98569967A4FB99BC0F089071EF8C87B55DE3CD561C700

Function 00007FF8B61AA690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61AA6C7
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8B61AA6F0

Strings

D:\_w\1\s\ssl\packet_local.h, xrefs: 00007FF8B61AA6B7, 00007FF8B61AA6E0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_memdup
String ID: D:\_w\1\s\ssl\packet_local.h
API String ID: 3962629258-1466776524
Opcode ID: f64130a14c74b157dfded520b8f41c41d0afd7e259d45b1080870da86f7cf7b0
Instruction ID: 6ec432fa5520d4f73314beca6df40a1e1039dc0d8f01a82409c655d96fac379a
Opcode Fuzzy Hash: f64130a14c74b157dfded520b8f41c41d0afd7e259d45b1080870da86f7cf7b0
Instruction Fuzzy Hash: 68012C36B26B8281EB90CF1AF8846596764FB98BC0F088071EF9C87B49DE3CD551C700

Function 00007FF8B617189D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8B6178CA7
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6178CCF

Strings

..\s\ssl\pqueue.c, xrefs: 00007FF8B6178C9D, 00007FF8B6178CB4

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: ..\s\ssl\pqueue.c
API String ID: 2513334388-354262084
Opcode ID: bc5d62d087c81a1d4f5185042bd4d3a69c1519d4abd72ed1bb3a9994725f11d5
Instruction ID: 70f2892772f55be5291f03eef2705bfd88327203097d7cff4605196699c02171
Opcode Fuzzy Hash: bc5d62d087c81a1d4f5185042bd4d3a69c1519d4abd72ed1bb3a9994725f11d5
Instruction Fuzzy Hash: B201AD72B1A60286EB908B18F4403B973A0EB48BD4F544072DF6C03B95EF3CE658CB00

Function 00007FF8B617258B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A3EBD
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61A3EEE

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FF8B61A3EB0, 00007FF8B61A3EE4

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 2148955802-2868363209
Opcode ID: 2df8f823dee3a4e6103b78dbbd3d7b57c140bcc93bbcb049701e9a1bf888716e
Instruction ID: 062915080589a47d1c0dd9f883c4e544feba6906e2dfe5801e753d3339e4a92d
Opcode Fuzzy Hash: 2df8f823dee3a4e6103b78dbbd3d7b57c140bcc93bbcb049701e9a1bf888716e
Instruction Fuzzy Hash: 50F02821B1864181EB94CB2EF9482BC6391DF88BD0F188030EF5C83B56EE2CD5918300

Function 00007FF8B6171802 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8B61AEFFF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8B61AEF7A, 00007FF8B61AEFBE, 00007FF8B61AEFDB

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_strdup
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 1296259186-592572767
Opcode ID: 341e3771f4aad3f09f7e211aea58c9862a56f43484323c9c39dac2e580676f59
Instruction ID: 07663ff6f1954f5c7152f3955d859152b33f534836227225fa511c8da6d4c23e
Opcode Fuzzy Hash: 341e3771f4aad3f09f7e211aea58c9862a56f43484323c9c39dac2e580676f59
Instruction Fuzzy Hash: 6121A132A08A4285EBA0CF09F4443BE67A1E744BC8F684175EB5C4BA95CF7DD686CB40

Function 00007FF8B61716F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B617DF80

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8B617DF73

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\record\ssl3_buffer.c
API String ID: 2581946324-837614940
Opcode ID: 9bef89b4933329271a9007a90ab2eccc7ab417357871830a37ef1605a604b937
Instruction ID: 9e5fb9b4db97da9c492de9a4c7c2c9c85969ef019f72df78a70c0fd9416557c5
Opcode Fuzzy Hash: 9bef89b4933329271a9007a90ab2eccc7ab417357871830a37ef1605a604b937
Instruction Fuzzy Hash: 7D019272A26B52C1E6509F19E4401EC77A4FB497D8F591035FB8C5B759CF38D162C740

Function 00007FF8B61A7860 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A7886

Strings

..\s\ssl\statem\extensions.c, xrefs: 00007FF8B61A7872

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions.c
API String ID: 2581946324-1165805907
Opcode ID: 6fcf97e0e485f858be2a418afd2634a575a1e3c18819c7da17e24f1c4680f394
Instruction ID: 2242435fbb14a2a6f86621b7ceabd3dc7c2a1f05ede862c989d7b5d3527e7ce1
Opcode Fuzzy Hash: 6fcf97e0e485f858be2a418afd2634a575a1e3c18819c7da17e24f1c4680f394
Instruction Fuzzy Hash: DAE012A2F03A4049E7D09B69D84639422A5EB4D794F580070DF0CC7B82EE3A85A58314

Function 00007FF8B61718DE Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8B61959C0
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8B61959D3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_unlockD_write_lock
String ID:
API String ID: 1724170673-0
Opcode ID: 4f8bad9adfda131536376350bb6b9145db97e2bd6f149847afcdee69e0a3b2eb
Instruction ID: db8e6772da6714a689603a0ca01a377fbfa25997feed0ab7ec8f31f2bde3b821
Opcode Fuzzy Hash: 4f8bad9adfda131536376350bb6b9145db97e2bd6f149847afcdee69e0a3b2eb
Instruction Fuzzy Hash: 09E08662F1968292E7599B29E5592B86224FB8C7C0F584070FF5D87792DE28E5618300

Function 00007FF8B61C8720 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8B61C873D

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: fd7f3047172d3ad62f625afd67d83b8d4831cbab27d22cc9d9314919d5c5ee02
Instruction ID: b2337fe816f0bf6aa25e97b2aef89e62dfb2e40184642034060cb9219035fa2c
Opcode Fuzzy Hash: fd7f3047172d3ad62f625afd67d83b8d4831cbab27d22cc9d9314919d5c5ee02
Instruction Fuzzy Hash: 6AD0A916F0750282EA98B73E899B0A802C0AB807D0FA880B4EA0DC2A81DD0CD8AB4601

Function 00007FF8B61B08D0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8B61B08ED

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: fd7f3047172d3ad62f625afd67d83b8d4831cbab27d22cc9d9314919d5c5ee02
Instruction ID: 5e3cf13f836e0c6b50a615915792b5317295fffba3f88006e4363002b6607142
Opcode Fuzzy Hash: fd7f3047172d3ad62f625afd67d83b8d4831cbab27d22cc9d9314919d5c5ee02
Instruction Fuzzy Hash: 6DD0C916F4750282E698B77E89AB1A902D49B847D0FA880B4EA0DC2A91DD1DE9AB5601

Function 00007FF7A3B25820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25830
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25842
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25879
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2588B
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258A4
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258B6
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258CF
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258E1
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B258FD
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2590F
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2592B
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2593D
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25959
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B2596B
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25987
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B25999
GetProcAddress.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B259B5
GetLastError.KERNEL32(?,00007FF7A3B264BF,?,00007FF7A3B2336E), ref: 00007FF7A3B259C7

Strings

PyErr_Print, xrefs: 00007FF7A3B25B49, 00007FF7A3B25B6B
PyConfig_SetWideStringList, xrefs: 00007FF7A3B25A63, 00007FF7A3B25A85
PyConfig_SetBytesString, xrefs: 00007FF7A3B25A07, 00007FF7A3B25A29
PyEval_EvalCode, xrefs: 00007FF7A3B25BA5, 00007FF7A3B25BC7
PyImport_ExecCodeModule, xrefs: 00007FF7A3B25C01, 00007FF7A3B25C23
Py_IsInitialized, xrefs: 00007FF7A3B25921, 00007FF7A3B25943
PyUnicode_FromString, xrefs: 00007FF7A3B25F6B, 00007FF7A3B25F8D
PyUnicode_Replace, xrefs: 00007FF7A3B25FC7, 00007FF7A3B25FE9
Py_InitializeFromConfig, xrefs: 00007FF7A3B258F3, 00007FF7A3B25915
PyUnicode_FromFormat, xrefs: 00007FF7A3B25F3D, 00007FF7A3B25F5F
PyMarshal_ReadObjectFromString, xrefs: 00007FF7A3B25C5D, 00007FF7A3B25C7F
Py_Finalize, xrefs: 00007FF7A3B258C5, 00007FF7A3B258E7
PyObject_Str, xrefs: 00007FF7A3B25D9F, 00007FF7A3B25DC1
PyUnicode_Join, xrefs: 00007FF7A3B25F99, 00007FF7A3B25FBB
PyImport_ImportModule, xrefs: 00007FF7A3B25C2F, 00007FF7A3B25C51
PyUnicode_DecodeFSDefault, xrefs: 00007FF7A3B25F0F, 00007FF7A3B25F31
PyUnicode_AsUTF8, xrefs: 00007FF7A3B25EB3, 00007FF7A3B25ED5
PyErr_Restore, xrefs: 00007FF7A3B25B77, 00007FF7A3B25B99
GetProcAddress, xrefs: 00007FF7A3B25858
PyErr_Occurred, xrefs: 00007FF7A3B25B1B, 00007FF7A3B25B3D
PyObject_CallFunction, xrefs: 00007FF7A3B25CE7, 00007FF7A3B25D09
PyConfig_Read, xrefs: 00007FF7A3B259D9, 00007FF7A3B259FB
Py_PreInitialize, xrefs: 00007FF7A3B2594F, 00007FF7A3B25971
PyMem_RawFree, xrefs: 00007FF7A3B25C8B, 00007FF7A3B25CAD
PySys_GetObject, xrefs: 00007FF7A3B25E57, 00007FF7A3B25E79
PyUnicode_Decode, xrefs: 00007FF7A3B25EE1, 00007FF7A3B25F03
PyErr_Fetch, xrefs: 00007FF7A3B25ABF, 00007FF7A3B25AE1
Failed to get address for %hs, xrefs: 00007FF7A3B25851
PyConfig_InitIsolatedConfig, xrefs: 00007FF7A3B259AB, 00007FF7A3B259CD
PyObject_CallFunctionObjArgs, xrefs: 00007FF7A3B25D15, 00007FF7A3B25D37
PyErr_NormalizeException, xrefs: 00007FF7A3B25AED, 00007FF7A3B25B0F
PySys_SetObject, xrefs: 00007FF7A3B25E85, 00007FF7A3B25EA7
Py_DecRef, xrefs: 00007FF7A3B25826, 00007FF7A3B25848
PyConfig_SetString, xrefs: 00007FF7A3B25A35, 00007FF7A3B25A57
PyConfig_Clear, xrefs: 00007FF7A3B2597D, 00007FF7A3B2599F
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7A3B25DCD, 00007FF7A3B25DEF
Py_DecodeLocale, xrefs: 00007FF7A3B2586F, 00007FF7A3B25891
Py_ExitStatusException, xrefs: 00007FF7A3B2589A, 00007FF7A3B258BC
PyModule_GetDict, xrefs: 00007FF7A3B25CB9, 00007FF7A3B25CDB
PyErr_Clear, xrefs: 00007FF7A3B25A91, 00007FF7A3B25AB3
PyStatus_Exception, xrefs: 00007FF7A3B25E29, 00007FF7A3B25E4B
PyRun_SimpleStringFlags, xrefs: 00007FF7A3B25DFB, 00007FF7A3B25E1D
PyObject_GetAttrString, xrefs: 00007FF7A3B25D43, 00007FF7A3B25D65
PyImport_AddModule, xrefs: 00007FF7A3B25BD3, 00007FF7A3B25BF5
PyObject_SetAttrString, xrefs: 00007FF7A3B25D71, 00007FF7A3B25D93

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 6673b4ff94afab7c149fcb68319ab9c0c0169d50e5bf7f93c46953a48c2e96d6
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 5122AA20A0FB4BE2FAD5FF55A814574E366AF04B41BC61136C9DE22370EF7EB5488225

Function 00007FF7A3B276B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7A3B276C7
GetLastError.KERNEL32 ref: 00007FF7A3B276D9
GetProcAddress.KERNEL32 ref: 00007FF7A3B27715
GetLastError.KERNEL32 ref: 00007FF7A3B27727
GetProcAddress.KERNEL32 ref: 00007FF7A3B27740
GetLastError.KERNEL32 ref: 00007FF7A3B27752
GetProcAddress.KERNEL32 ref: 00007FF7A3B2776B
GetLastError.KERNEL32 ref: 00007FF7A3B2777D
GetProcAddress.KERNEL32 ref: 00007FF7A3B27799
GetLastError.KERNEL32 ref: 00007FF7A3B277AB
GetProcAddress.KERNEL32 ref: 00007FF7A3B277C7
GetLastError.KERNEL32 ref: 00007FF7A3B277D9
GetProcAddress.KERNEL32 ref: 00007FF7A3B277F5
GetLastError.KERNEL32 ref: 00007FF7A3B27807
GetProcAddress.KERNEL32 ref: 00007FF7A3B27823
GetLastError.KERNEL32 ref: 00007FF7A3B27835
GetProcAddress.KERNEL32 ref: 00007FF7A3B27851
GetLastError.KERNEL32 ref: 00007FF7A3B27863

Strings

Tcl_EvalFile, xrefs: 00007FF7A3B27B83, 00007FF7A3B27BA5
Tcl_GetVar2, xrefs: 00007FF7A3B27A13, 00007FF7A3B27A35
Tcl_FinalizeThread, xrefs: 00007FF7A3B277BD, 00007FF7A3B277DF
Tcl_ConditionNotify, xrefs: 00007FF7A3B2795B, 00007FF7A3B2797D
Tcl_MutexLock, xrefs: 00007FF7A3B278A3, 00007FF7A3B278C5
Tcl_CreateObjCommand, xrefs: 00007FF7A3B27A6F, 00007FF7A3B27A91
Tcl_ConditionWait, xrefs: 00007FF7A3B27989, 00007FF7A3B279AB
Tcl_DoOneEvent, xrefs: 00007FF7A3B27761, 00007FF7A3B27783
Tcl_EvalObjv, xrefs: 00007FF7A3B27BDF, 00007FF7A3B27C01
Tk_GetNumMainWindows, xrefs: 00007FF7A3B27C97, 00007FF7A3B27CB9
Tcl_ThreadAlert, xrefs: 00007FF7A3B279E5, 00007FF7A3B27A07
Tcl_JoinThread, xrefs: 00007FF7A3B27875, 00007FF7A3B27897
Tcl_SetVar2, xrefs: 00007FF7A3B27A41, 00007FF7A3B27A63
Tcl_FindExecutable, xrefs: 00007FF7A3B27736, 00007FF7A3B27758
Tcl_GetObjResult, xrefs: 00007FF7A3B27B55, 00007FF7A3B27B77
Tcl_GetString, xrefs: 00007FF7A3B27A9D, 00007FF7A3B27ABF
GetProcAddress, xrefs: 00007FF7A3B276EF
Tcl_MutexFinalize, xrefs: 00007FF7A3B278FF, 00007FF7A3B27921
Tcl_GetCurrentThread, xrefs: 00007FF7A3B27847, 00007FF7A3B27869
Tcl_Init, xrefs: 00007FF7A3B276C0, 00007FF7A3B276DF
Tcl_DeleteInterp, xrefs: 00007FF7A3B277EB, 00007FF7A3B2780D
Tcl_Free, xrefs: 00007FF7A3B27C3B, 00007FF7A3B27C5D
Tcl_ConditionFinalize, xrefs: 00007FF7A3B2792D, 00007FF7A3B2794F
Tcl_SetVar2Ex, xrefs: 00007FF7A3B27B27, 00007FF7A3B27B49
Tcl_ThreadQueueEvent, xrefs: 00007FF7A3B279B7, 00007FF7A3B279D9
Tcl_Alloc, xrefs: 00007FF7A3B27C0D, 00007FF7A3B27C2F
Failed to get address for %hs, xrefs: 00007FF7A3B276E8
Tk_Init, xrefs: 00007FF7A3B27C69, 00007FF7A3B27C8B
Tcl_Finalize, xrefs: 00007FF7A3B2778F, 00007FF7A3B277B1
Tcl_NewByteArrayObj, xrefs: 00007FF7A3B27AF9, 00007FF7A3B27B1B
Tcl_NewStringObj, xrefs: 00007FF7A3B27ACB, 00007FF7A3B27AED
Tcl_CreateThread, xrefs: 00007FF7A3B27819, 00007FF7A3B2783B
Tcl_EvalEx, xrefs: 00007FF7A3B27BB1, 00007FF7A3B27BD3
Tcl_MutexUnlock, xrefs: 00007FF7A3B278D1, 00007FF7A3B278F3
Tcl_CreateInterp, xrefs: 00007FF7A3B2770B, 00007FF7A3B2772D

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 1ac53beb8b6daae600db178ba1145770c0046f7731d26f2129b81cdd598ba0d5
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 1402C360A0FB47D2FAD5FFA5B810974A267AF04755BC20135C5DE22372EF7EA1498238

Function 00007FF8B61935B0 Relevance: 71.9, APIs: 35, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61935D2
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61935DF
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61935EC
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61935F9
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193606
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193613
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193620
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B619362D
EVP_aes_256_cbc.LIBCRYPTO-1_1 ref: 00007FF8B6193632
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B619363A
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193647
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193654
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193661
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B619366E
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B619367B
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193688
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B6193695
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936A2
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936AF
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936BC
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936C9
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936D6
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936E3
EVP_add_cipher.LIBCRYPTO-1_1 ref: 00007FF8B61936F0
EVP_md5.LIBCRYPTO-1_1 ref: 00007FF8B61936F5
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B6193722
EVP_sha1.LIBCRYPTO-1_1 ref: 00007FF8B6193727
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B619372F
OBJ_NAME_add.LIBCRYPTO-1_1 ref: 00007FF8B6193747
OBJ_NAME_add.LIBCRYPTO-1_1 ref: 00007FF8B619375F
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B619376C
EVP_sha256.LIBCRYPTO-1_1 ref: 00007FF8B6193771
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B6193779
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B6193786
EVP_add_digest.LIBCRYPTO-1_1 ref: 00007FF8B6193793

Part of subcall function 00007FF8B617129E: CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8B618D99B

Part of subcall function 00007FF8B61715B4: OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8B6191077
Part of subcall function 00007FF8B61715B4: EVP_get_digestbyname.LIBCRYPTO-1_1 ref: 00007FF8B619107F
Part of subcall function 00007FF8B61715B4: EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B6191101
Part of subcall function 00007FF8B61715B4: EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191121
Part of subcall function 00007FF8B61715B4: ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B6191135
Part of subcall function 00007FF8B61715B4: EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8B6191173
Part of subcall function 00007FF8B61715B4: EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8B6191193
Part of subcall function 00007FF8B61715B4: ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8B61911A7

Strings

RSA-SHA1, xrefs: 00007FF8B619374C
ssl3-md5, xrefs: 00007FF8B619370E
SHA1, xrefs: 00007FF8B6193734
RSA-SHA1-2, xrefs: 00007FF8B6193758
MD5, xrefs: 00007FF8B6193702
ssl3-sha1, xrefs: 00007FF8B6193740

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: P_add_cipher$P_add_digest$E_addE_finishY_asn1_find_strY_asn1_get0_info$D_run_onceJ_nid2snP_aes_256_cbcP_get_digestbynameP_md5P_sha1P_sha256
String ID: MD5$RSA-SHA1$RSA-SHA1-2$SHA1$ssl3-md5$ssl3-sha1
API String ID: 802802306-3803824401
Opcode ID: dd0c58f311492a1553c6b7797a71e91fa4e10be650a935932a2d9aa04cf1e641
Instruction ID: 70fa655d97ff1ae1285adbb15150a0cdb66507ac5eb6f229382cedb2705bd319
Opcode Fuzzy Hash: dd0c58f311492a1553c6b7797a71e91fa4e10be650a935932a2d9aa04cf1e641
Instruction Fuzzy Hash: 57411054E0F28750FAA9BBFE64262F802505F827D0F4020F5EB9E562D7ED2EB0095761

Function 00007FF8B78228A0 Relevance: 44.2, APIs: 12, Strings: 13, Instructions: 411COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON310 ref: 00007FF8B7822A3E
PyErr_Format.PYTHON310 ref: 00007FF8B7822ACB
PyErr_Format.PYTHON310 ref: 00007FF8B7822CD6
PyErr_Format.PYTHON310 ref: 00007FF8B7822D09
PyTuple_New.PYTHON310 ref: 00007FF8B7822D2A
PyDict_New.PYTHON310 ref: 00007FF8B7822DC4
PySequence_Contains.PYTHON310 ref: 00007FF8B7822E4B
PyDict_SetItem.PYTHON310 ref: 00007FF8B7822E6A
PyErr_Format.PYTHON310 ref: 00007FF8B7822EBB
PyErr_Format.PYTHON310 ref: 00007FF8B7822F00
_Py_Dealloc.PYTHON310 ref: 00007FF8B7822F1E
_Py_Dealloc.PYTHON310 ref: 00007FF8B7822F44

Strings

%.200s%s missing required keyword-only argument '%U', xrefs: 00007FF8B7822CBD
'%S' is an invalid keyword argument for %.200s%s, xrefs: 00007FF8B7822EE6
function, xrefs: 00007FF8B7822990, 00007FF8B7822A1B, 00007FF8B7822A62, 00007FF8B7822C2E, 00007FF8B7822C92, 00007FF8B7822E94
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF8B78229BB
at most, xrefs: 00007FF8B7822A7C
exactly, xrefs: 00007FF8B7822A86, 00007FF8B7822C57
%.200s%s takes no positional arguments, xrefs: 00007FF8B7822A2C
argument for %.200s%s given by name ('%U') and position (%d), xrefs: 00007FF8B7822EAD
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF8B7822AB4
this function, xrefs: 00007FF8B7822EDF
at least, xrefs: 00007FF8B7822C4C
%.200s%s missing required argument '%U' (pos %d), xrefs: 00007FF8B7822CFB
keyword , xrefs: 00007FF8B78229B0

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Err_Format$DeallocDict_$ContainsItemSequence_Tuple_
String ID: %.200s%s missing required argument '%U' (pos %d)$%.200s%s missing required keyword-only argument '%U'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%S' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%U') and position (%d)$at least$at most$exactly$function$keyword $this function
API String ID: 4272797680-3030676885
Opcode ID: b2e98c56b0206e109a11d3cbbff435fe297a28d55b8d7a015c9a434af2272ab6
Instruction ID: 1d77829a8976c5aec865ec356908a42141f33c4b0bd3cdea9e80e8179cefb2fe
Opcode Fuzzy Hash: b2e98c56b0206e109a11d3cbbff435fe297a28d55b8d7a015c9a434af2272ab6
Instruction Fuzzy Hash: EB026B22B09B8685DA64CF19E4402AD7BA0FB48BD6F864436EB4E57B74DF3CE644C704

Function 00007FF8B61A2670 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A26E6
OPENSSL_sk_num.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A270B
OPENSSL_sk_value.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2719
OPENSSL_sk_num.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A273E
X509_get_pubkey.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2752
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A27A1
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A27C7
EVP_PKEY_missing_parameters.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A27D4
EVP_PKEY_missing_parameters.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A27E0
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2808
EVP_PKEY_missing_parameters.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A281A
EVP_PKEY_copy_parameters.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2829
EVP_PKEY_cmp.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2834
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2861
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A28B5
X509_chain_up_ref.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A28C7
ERR_put_error.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A28F1
OPENSSL_sk_pop_free.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2913
X509_free.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A293F
X509_up_ref.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2947
EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A296E
EVP_PKEY_up_ref.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A2976
EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,?,?,?,00007FF8B61A1AE7), ref: 00007FF8B61A29BA

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A26CA, 00007FF8B61A2784, 00007FF8B61A27AB, 00007FF8B61A27E9, 00007FF8B61A2842, 00007FF8B61A2896, 00007FF8B61A28D6

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error$Y_missing_parameters$L_sk_numY_free$L_sk_pop_freeL_sk_valueX509_chain_up_refX509_freeX509_get_pubkeyX509_up_refY_cmpY_copy_parametersY_up_ref
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2437944788-2723262194
Opcode ID: 619245754bb659d5122f7d9154dec4fb32eec282ca408cb8d922b41d08fb004e
Instruction ID: 397ccfb1e5f4f604263bedf26dcbfd31bb26a07cd953517968c571eda5901d17
Opcode Fuzzy Hash: 619245754bb659d5122f7d9154dec4fb32eec282ca408cb8d922b41d08fb004e
Instruction Fuzzy Hash: CE91AF71E0968281EA20EB19E4547BE63A0FB84BC4F584176EF5D47B86DF3CE505D700

Function 00007FF8B6171631 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8B617F579
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B617F581
EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8B617F5B6
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8B617F5BE
memcpy.VCRUNTIME140 ref: 00007FF8B617F5F1
memcpy.VCRUNTIME140 ref: 00007FF8B617F608
EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B617F682
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FF8B617F6B1
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F6C9
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F6E3
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F6FC
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F717
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F730
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F748
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FF8B617F75E
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FF8B617F76D
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F781
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F797
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B617F7AB
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FF8B617F7BF
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B617F7CB
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B617F7E2

Strings

666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\, xrefs: 00007FF8B617F601, 00007FF8B617F6D9

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: Digest$Update$Final_exX_copy_exX_freememcpy$D_sizeR_flagsX_cipherX_mdX_new
String ID: 666666666666666666666666666666666666666666666666\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
API String ID: 3621087735-2009547811
Opcode ID: 94b4598ae1dd732c0c64b589e13abd56bf9e7141cd83c843d7812ca1a9cb7814
Instruction ID: 81f5f9b7cad56e40f0c9a3ed73bdeb9a62e3dc3bc64b333a64f24d2d10ff8755
Opcode Fuzzy Hash: 94b4598ae1dd732c0c64b589e13abd56bf9e7141cd83c843d7812ca1a9cb7814
Instruction Fuzzy Hash: A371F896B0D78344FA20EF2EA8112FA6B95EF45BE8F4441B5EF4D47B96DE2CE4448700

Function 00007FF8B61DB770 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 218COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FF8B61DB7C6
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61DB820
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61DB842
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B61DB84A
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B61DB857
EVP_PKEY_derive_init.LIBCRYPTO-1_1 ref: 00007FF8B61DB956
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61DB982
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61DB9AA
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61DB9D8
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61DBA08

Strings

..\s\ssl\tls13_enc.c, xrefs: 00007FF8B61DB7F0, 00007FF8B61DBA41, 00007FF8B61DBAB9
tls13 , xrefs: 00007FF8B61DB8BE
U, xrefs: 00007FF8B61DBAC7
W, xrefs: 00007FF8B61DBAED

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: X_ctrl$X_free$D_sizeR_put_errorX_new_idY_derive_init
String ID: ..\s\ssl\tls13_enc.c$U$W$tls13
API String ID: 2176224248-2595563013
Opcode ID: 2fdd5425c142218ec4561aaaf078cdcfb5673f3bba546d20a6ff61655d6c2612
Instruction ID: e27525a274a5dabc026ca21cc2445850c54d8819ddce2454d3253b1cc27ac887
Opcode Fuzzy Hash: 2fdd5425c142218ec4561aaaf078cdcfb5673f3bba546d20a6ff61655d6c2612
Instruction Fuzzy Hash: BC918C72B0C68282FA30AF2AE4417BA6755AB857C4F444171EF4E47AD9DF3DE905CB40

Function 00007FF8B7829820 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B78214F0: PyNumber_Add.PYTHON310 ref: 00007FF8B7821584
Part of subcall function 00007FF8B78214F0: _Py_Dealloc.PYTHON310 ref: 00007FF8B782159B
Part of subcall function 00007FF8B78214F0: _Py_Dealloc.PYTHON310 ref: 00007FF8B78215AA

PyObject_RichCompare.PYTHON310 ref: 00007FF8B7829868
_Py_Dealloc.PYTHON310 ref: 00007FF8B782987A
_Py_Dealloc.PYTHON310 ref: 00007FF8B78298C5
PyType_IsSubtype.PYTHON310 ref: 00007FF8B7829910
PySet_Contains.PYTHON310 ref: 00007FF8B7829952
_Py_Dealloc.PYTHON310 ref: 00007FF8B7829963
_Py_Dealloc.PYTHON310 ref: 00007FF8B78299C4
_Py_Dealloc.PYTHON310 ref: 00007FF8B7829A04
PyObject_VectorcallMethod.PYTHON310 ref: 00007FF8B7829A37
_Py_Dealloc.PYTHON310 ref: 00007FF8B7829C79

Part of subcall function 00007FF8B78239A0: PyErr_Format.PYTHON310 ref: 00007FF8B78239D4

Strings

feed, xrefs: 00007FF8B7829931, 00007FF8B7829BED
set, xrefs: 00007FF8B782991A
bool, xrefs: 00007FF8B78298A0, 00007FF8B78299DF, 00007FF8B7829A60, 00007FF8B7829B18, 00007FF8B7829BAF

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc$Object_$CompareContainsErr_FormatMethodNumber_RichSet_SubtypeType_Vectorcall
String ID: bool$feed$set
API String ID: 3730914188-561237756
Opcode ID: 05957306e2c15c5e5116d921c832dc42546ddd8f0aba6945885f23b1ba1ca97d
Instruction ID: a3b441f8b8da3610ce56efa0d4e2f61128f204e559eedb833e014760a96eb603
Opcode Fuzzy Hash: 05957306e2c15c5e5116d921c832dc42546ddd8f0aba6945885f23b1ba1ca97d
Instruction Fuzzy Hash: 45C16D21B4DB0681FA608B2EE85127E6B95AF49BD3F494435EF4E177B5DE2CE4408348

Function 00007FF8A84F1150 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 188COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F11DF
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F11F7
PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F121A

Part of subcall function 00007FF8A84F12F0: PyMem_Malloc.PYTHON310 ref: 00007FF8A84F1372

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F3617
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F362D
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F3644
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F36AD
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F3771

Strings

invalid normalization form, xrefs: 00007FF8A84F373D
argument 1, xrefs: 00007FF8A84F375C
argument 2, xrefs: 00007FF8A84F3753
str, xrefs: 00007FF8A84F3763
normalize, xrefs: 00007FF8A84F360A, 00007FF8A84F376A

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Unicode_$Equal$Arg_Ready$ArgumentCheckMallocMem_PositionalSubtypeType_
String ID: argument 1$argument 2$invalid normalization form$normalize$str
API String ID: 3079088272-4140678229
Opcode ID: b3368b4d5ebc76702a08d31141259cd441a1b31ece55319e5db85749e5f54646
Instruction ID: 9583d6ced4ca2137d26a7fe553c7ca6c886252f65c7a44b285d5878b23c2ba94
Opcode Fuzzy Hash: b3368b4d5ebc76702a08d31141259cd441a1b31ece55319e5db85749e5f54646
Instruction Fuzzy Hash: 0C81CD30A0F682A1FB658B9299003792391FF45FC4F458239DD8E97795EFADEC018328

Function 00007FF7A3B281C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7A3B288A7,?,?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B2821C

Part of subcall function 00007FF7A3B22810: MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7A3B282C9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7A3B281F3
\, xrefs: 00007FF7A3B28251
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7A3B2828D
CreateDirectory, xrefs: 00007FF7A3B2836C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7A3B28230
%.*s, xrefs: 00007FF7A3B282FC
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7A3B28363

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction ID: aae6f7088640b49bfebefe2be76b6dcf83b1d188a99ac63895178cfebd8fe714
Opcode Fuzzy Hash: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction Fuzzy Hash: 2B51C911B1B6C281F7D0FF60E841AB9E253AF94780FC64531E5CEE66B5EE2EE1048760

Function 00007FF8B617179E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-1_1 ref: 00007FF8B619AD5D
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B619AD65
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619AD8D
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B619ADB1
BIO_next.LIBCRYPTO-1_1 ref: 00007FF8B619ADC5
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FF8B619ADDC
BIO_pop.LIBCRYPTO-1_1 ref: 00007FF8B619ADF4
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8B619AE01
BIO_push.LIBCRYPTO-1_1 ref: 00007FF8B619AE16

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619AD72

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free_allO_int_ctrlO_newO_nextO_popO_pushO_s_socketO_up_refR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2360723678-1080266419
Opcode ID: c079e88b0310191bac4f2b0d2aeb6e16197105a1133e95d39aa7da32c9600f36
Instruction ID: 68d7973d0c5360d40eee359983016b3369bea2aea6882d2b307dd692d6d466e5
Opcode Fuzzy Hash: c079e88b0310191bac4f2b0d2aeb6e16197105a1133e95d39aa7da32c9600f36
Instruction Fuzzy Hash: 59413C22A0B602C1EB68EF2AD15117D63A0EF84BC8F5445B1EF4E47BD9DF2CE8568341

Function 00007FF7A3B21600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7A3B216E1
malloc, xrefs: 00007FF7A3B21749
fread, xrefs: 00007FF7A3B217E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B217DF
Failed to create symbolic link %s!, xrefs: 00007FF7A3B21622
fwrite, xrefs: 00007FF7A3B217D1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B216A2
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7A3B21742
Failed to extract %s: failed to open target file!, xrefs: 00007FF7A3B2165C
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7A3B217CA
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B216DA
fopen, xrefs: 00007FF7A3B21663

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: b438ac9593aa65caaca4b757467b05afc463448879c6b570786e287927310b36
Instruction ID: 35bdbcd101cbb3b57b34ac0eb12a3baff017326a6052ad3d75ce3a8f80a5998d
Opcode Fuzzy Hash: b438ac9593aa65caaca4b757467b05afc463448879c6b570786e287927310b36
Instruction Fuzzy Hash: 2F51B461B0A68382EA94FF9194005B9E352BF44794FC64231EECC27BB5DF3EE5458720

Function 00007FF8B7824090 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON310 ref: 00007FF8B78240B9
PyErr_SetString.PYTHON310 ref: 00007FF8B78240E8
_Py_Dealloc.PYTHON310 ref: 00007FF8B78240F7
_Py_Dealloc.PYTHON310 ref: 00007FF8B782410B
PyDict_New.PYTHON310 ref: 00007FF8B782412A
PyObject_GetAttr.PYTHON310 ref: 00007FF8B7824159
PyErr_ExceptionMatches.PYTHON310 ref: 00007FF8B7824171
PyErr_Clear.PYTHON310 ref: 00007FF8B782417F
PyDict_SetItem.PYTHON310 ref: 00007FF8B7824190
_Py_Dealloc.PYTHON310 ref: 00007FF8B78241A1
_Py_Dealloc.PYTHON310 ref: 00007FF8B78241C7

Strings

__mypyc_attrs__, xrefs: 00007FF8B78240A9
__mypyc_attrs__ is not a tuple, xrefs: 00007FF8B78240DE

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc$Err_$AttrDict_Object_String$ClearExceptionItemMatches
String ID: __mypyc_attrs__$__mypyc_attrs__ is not a tuple
API String ID: 2346549887-4201147154
Opcode ID: 7c1e50ad8ddd95ffc3f7bdf20bdb18ec67bd1bf23086ccb602c5d9f808a5bfde
Instruction ID: 5b6fdadbc97c67260c599fce24f42b67edaf25c83133eb6aa2809dcfaaf9d976
Opcode Fuzzy Hash: 7c1e50ad8ddd95ffc3f7bdf20bdb18ec67bd1bf23086ccb602c5d9f808a5bfde
Instruction Fuzzy Hash: BD316621B48B1681EA559F2EE80427E7BA0BF58FD6F568431DF1E42770EE3CE8448318

Function 00007FF8A84F2500 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON310 ref: 00007FF8A84F2520
PyType_FromSpec.PYTHON310 ref: 00007FF8A84F2535
PyModule_AddType.PYTHON310 ref: 00007FF8A84F254D
_Py_Dealloc.PYTHON310 ref: 00007FF8A84F3F0D

Part of subcall function 00007FF8A84F2650: _PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A84F2563), ref: 00007FF8A84F2656
Part of subcall function 00007FF8A84F2650: PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A84F2563), ref: 00007FF8A84F2688

PyModule_AddObject.PYTHON310 ref: 00007FF8A84F2582
PyModule_AddObjectRef.PYTHON310 ref: 00007FF8A84F25AA
_Py_Dealloc.PYTHON310 ref: 00007FF8A84F3F1C
_Py_Dealloc.PYTHON310 ref: 00007FF8A84F3F3A

Part of subcall function 00007FF8A84F25E0: PyMem_Malloc.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F25EB
Part of subcall function 00007FF8A84F25E0: PyCapsule_New.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F2628

Strings

unidata_version, xrefs: 00007FF8A84F2519
ucd_3_2_0, xrefs: 00007FF8A84F2578
13.0.0, xrefs: 00007FF8A84F250F
_ucnhash_CAPI, xrefs: 00007FF8A84F25A0

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
String ID: 13.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 288921926-2302946913
Opcode ID: 7bbd23ebe987af1e45d56d99bc958bd3be6f45c1a216322346f2f04b6fdbad98
Instruction ID: a4d60509b6a0004046a59751ef8ce2f88435ae489e30b886f37663b5a13fffc9
Opcode Fuzzy Hash: 7bbd23ebe987af1e45d56d99bc958bd3be6f45c1a216322346f2f04b6fdbad98
Instruction Fuzzy Hash: B5216D30E0FA13A1FA149B61A91017962A4FF49FD1F48513CE94F86796DFADEC448338

Function 00007FF8A84F4744 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F4777
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F47AC
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F47BF
_PyUnicode_ToDigit.PYTHON310 ref: 00007FF8A84F485D
PyErr_SetString.PYTHON310 ref: 00007FF8A84F487D
PyLong_FromLong.PYTHON310 ref: 00007FF8A84F4891

Strings

digit, xrefs: 00007FF8A84F4770, 00007FF8A84F479E
a unicode character, xrefs: 00007FF8A84F4797
not a digit, xrefs: 00007FF8A84F4873
argument 1, xrefs: 00007FF8A84F47A5

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_Unicode_$ArgumentCheckDigitErr_FromLongLong_PositionalReadyString
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 2437920334-4278345224
Opcode ID: 6012816ae349b313dbb15cfef4038f2eb10e94937778e0669fc45add8e2586e3
Instruction ID: 99563653ce16d6a9044d1da0ce368c399f3a0b562fa7e158f995cdf2e14a7afe
Opcode Fuzzy Hash: 6012816ae349b313dbb15cfef4038f2eb10e94937778e0669fc45add8e2586e3
Instruction Fuzzy Hash: A0417935B0B686A1FB508B55D95023923A1FF84FD4F54C539CA0E876A4DFADEC46C328

Function 00007FF7A3B280B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7A3B280EF
GetWindowLongPtrW.USER32 ref: 00007FF7A3B2816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7A3B28182
GetLastError.KERNEL32 ref: 00007FF7A3B2818C
SetWindowLongPtrW.USER32 ref: 00007FF7A3B281A3

Strings

Needs to remove its temporary files., xrefs: 00007FF7A3B28175

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: f104a9650453b30570b59ed0137c8b4a499c81c7d6f425d761a28bcb8ecbddb2
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: A421FD21B0A682C2F785AF76B844579A252EF88B91F8A0230DBDD933F4DE2DD5408220

Function 00007FF8B61A1760 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A1799
EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FF8B61A17B0
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A17D8

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A177E, 00007FF8B61A17BD
o, xrefs: 00007FF8B61A17C4

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error$Y_new
String ID: ..\s\ssl\ssl_rsa.c$o
API String ID: 2632022502-2060984337
Opcode ID: ee4d282efca08494247b446af9466003bc83b21e6ed35efd7bb29353271e6409
Instruction ID: db69138be3da828082b7d63744482495f4d4f539cf37cfbce9c59f5b1dfc1a27
Opcode Fuzzy Hash: ee4d282efca08494247b446af9466003bc83b21e6ed35efd7bb29353271e6409
Instruction Fuzzy Hash: 03218322F0954282EA50EB69F5412FE67A1EF89BC8F484070EF5D47B86DF2DE9558B00

Function 00007FF8A84F2740 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A84F2768
__scrt_initialize_crt.LIBCMT ref: 00007FF8A84F27AD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A84F27BA
_RTC_Initialize.LIBCMT ref: 00007FF8A84F27E8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A84F280E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A84F2839

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: d9075fb2b0ba11a0ca4eca901d47b6c9aa6f7dca5772fbcecca27907c885e73c
Instruction ID: cd97cfd5353474429632a03e1b7a569420d129dfe326a6340752f5412c0a1c3b
Opcode Fuzzy Hash: d9075fb2b0ba11a0ca4eca901d47b6c9aa6f7dca5772fbcecca27907c885e73c
Instruction Fuzzy Hash: 2D81BF30E0F663A6FAA4AB6594412B92691EF85FC0F14813DD94C437A6DFBCEC458738

Function 00007FF8B61CF570 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,00007FF8B61D17C2), ref: 00007FF8B61CF742

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8B61CF6D7, 00007FF8B61CF725

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: Y_free
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1282063954-348624464
Opcode ID: 10967db8b4a0ecacf490d994dfcd3eb33a1f965117082bcd42c523ea3f665768
Instruction ID: 9ae1107213cb9b6e69b5789353716cdf386e7276d0cff13091535645fe99fb74
Opcode Fuzzy Hash: 10967db8b4a0ecacf490d994dfcd3eb33a1f965117082bcd42c523ea3f665768
Instruction Fuzzy Hash: 07419932B09B8289EA209F1AA45077E77A0EF84BD4F484175EF8D0BB95CF3CE1499704

Function 00007FF8A84F4AFC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4B29
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F4B5B
PyUnicode_Compare.PYTHON310 ref: 00007FF8A84F4BBE
_Py_Dealloc.PYTHON310 ref: 00007FF8A84F4BCF
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F4BE3
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F4C03
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A84F4C1B
PyErr_SetString.PYTHON310 ref: 00007FF8A84F4C3E

Strings

invalid normalization form, xrefs: 00007FF8A84F4C34

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
String ID: invalid normalization form
API String ID: 3010910608-2281882113
Opcode ID: db7500ed328ea89a7218ce296b7fc290dacc1b6cdf2a18ecf46c4dd9d09d4559
Instruction ID: e532ddecc936c2919972f03495eaf4886148543ee2beca0ef7244dd6a7a3f212
Opcode Fuzzy Hash: db7500ed328ea89a7218ce296b7fc290dacc1b6cdf2a18ecf46c4dd9d09d4559
Instruction Fuzzy Hash: A6417721A0FA42A5FA548B52A94033923A0FF58FC4F85853DDD4E877A5DFADE8048328

Function 00007FF8A84F4A10 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F4A3C
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4A71
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4A81
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4AC0
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4AD0

Strings

is_normalized, xrefs: 00007FF8A84F4A2F, 00007FF8A84F4A63, 00007FF8A84F4AB2
argument 2, xrefs: 00007FF8A84F4AB9
argument 1, xrefs: 00007FF8A84F4A6A
str, xrefs: 00007FF8A84F4A5C, 00007FF8A84F4AAB

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: b950980b051188fd453917d274be7701766f47d4e60d3c5bfe9a1c2cbcee6fba
Instruction ID: 7491bce368a928dfc5b2b0f02a126b6176aeb085d694a32dfc4a0d55010eaf0d
Opcode Fuzzy Hash: b950980b051188fd453917d274be7701766f47d4e60d3c5bfe9a1c2cbcee6fba
Instruction Fuzzy Hash: E6216D21E1BB86A5EB508B65E8402792360FF44FD8F449239DD1D476A4DFACEC06C32C

Function 00007FF7A3B36300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B369CC

Strings

p, xrefs: 00007FF7A3B363F5
p, xrefs: 00007FF7A3B3646D
:, xrefs: 00007FF7A3B364FC
-, xrefs: 00007FF7A3B363D9
f, xrefs: 00007FF7A3B36465

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 19c5a763df3c0a272ae3a9c3607282bf421adc2f9d3900d8f26d7635db8e4304
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 0F12A061E0A16786FBE87E1591843B9F6A2FB40750FC64135D6C927EE4DF3EE5808B20

Function 00007FF7A3B31038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B31078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B31440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B316DF

Strings

p, xrefs: 00007FF7A3B3111D
f, xrefs: 00007FF7A3B3117A
f, xrefs: 00007FF7A3B312C5
p, xrefs: 00007FF7A3B31182
f, xrefs: 00007FF7A3B31110

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 4c614a2131924ee7bccd6680da652f676fdf65ccc8336da5469a055dff04455a
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: A712D321E0E16385FBA8BE55E4142B9F26BFB80754FCA4035D6C952DF4DB7EE5808B20

Function 00007FF8B618F550 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 340stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B618F6DA

Strings

SECLEVEL=, xrefs: 00007FF8B618F9E7
..\s\ssl\ssl_ciph.c, xrefs: 00007FF8B618F95C, 00007FF8B618FA2D
STRENGTH, xrefs: 00007FF8B618F9AC

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: strncmp
String ID: ..\s\ssl\ssl_ciph.c$SECLEVEL=$STRENGTH
API String ID: 1114863663-3120971754
Opcode ID: dc5b341e1da973bb5e32f42e555693f9dd922a46156202e334d8255a21db2461
Instruction ID: c10b8e382730abd7387af0053ad2c0c8d9b44a6d28466c453d254c98424fa727
Opcode Fuzzy Hash: dc5b341e1da973bb5e32f42e555693f9dd922a46156202e334d8255a21db2461
Instruction Fuzzy Hash: 84E16D76A0C6868EE7708F1EA04037AB7A1FB857D4F144175DB9D876AADF3CE8419B00

Function 00007FF8B6192740 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619277E

Strings

, value=, xrefs: 00007FF8B61928B2
cmd=, xrefs: 00007FF8B61928B9, 00007FF8B6192908
..\s\ssl\ssl_conf.c, xrefs: 00007FF8B6192770, 00007FF8B6192898, 00007FF8B61928EE

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: , value=$..\s\ssl\ssl_conf.c$cmd=
API String ID: 1767461275-2539137415
Opcode ID: 931b6308100c0c735360a67d08023accb56f8525ad1edf0bfe1c16d29ab47f40
Instruction ID: bfe245bf21544b2d72bf506d45e97cad5ae3544b0d551b23b7805209e3a5fab0
Opcode Fuzzy Hash: 931b6308100c0c735360a67d08023accb56f8525ad1edf0bfe1c16d29ab47f40
Instruction Fuzzy Hash: E6517B62B18602C2FB548B1DE4402A963A1FB84BC4F584176EB5C07BEADF3CE9968700

Function 00007FF7A3B21050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

fseek, xrefs: 00007FF7A3B210D3
malloc, xrefs: 00007FF7A3B2110F
fread, xrefs: 00007FF7A3B211FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7A3B21108
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7A3B211F6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7A3B21098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7A3B210CC

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 6c44fc12f90ac9abec2ec16274bdf5e9c83ab404e8f3d54f1266a05c4574213e
Instruction ID: 6176e9408c872933f1e92b44e48565602e616a2c402e7b92ea6083bf4fe4adf9
Opcode Fuzzy Hash: 6c44fc12f90ac9abec2ec16274bdf5e9c83ab404e8f3d54f1266a05c4574213e
Instruction Fuzzy Hash: 30419521B0A59282FA84FF52A8019B9E392BF44BC4FC64531EDCD27BB5DE3EE1018750

Function 00007FF7A3B28850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B288F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B288FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF7A3B23CBB), ref: 00007FF7A3B2893C

Part of subcall function 00007FF7A3B28A20: GetEnvironmentVariableW.KERNEL32(00007FF7A3B2388E), ref: 00007FF7A3B28A57
Part of subcall function 00007FF7A3B28A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7A3B28A79

Part of subcall function 00007FF7A3B382A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B382C1

Part of subcall function 00007FF7A3B22810: MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

TMP, xrefs: 00007FF7A3B288B2
_MEI%d, xrefs: 00007FF7A3B28902
TMP, xrefs: 00007FF7A3B2888C, 00007FF7A3B28993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7A3B2896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7A3B288CC

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction ID: 54006214e56b68227c22573bd94779dd78c5d81a9803b0b06714dcbc65b7ce05
Opcode Fuzzy Hash: 6ea14b1c2d16789ddeaa0d8cc05df9935aa6d91fa7ad17376743f3d33dced37a
Instruction Fuzzy Hash: EC41F811B0B69245F994FFA2A8515F99353AF84780FC60231DD8DA7BF6DD3ED5048320

Function 00007FF8B61A0620 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A0659
EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FF8B61A0670
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A0698

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A063E, 00007FF8B61A067D

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error$Y_new
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2632022502-2723262194
Opcode ID: b201dedd484929c0a4d24b334bc5732d54976be748ea24e33b8dc17cd9a943d5
Instruction ID: 8b7511cb711adbda527a828bbb4e94be29ff8b154512620756c9fb02f67fdab5
Opcode Fuzzy Hash: b201dedd484929c0a4d24b334bc5732d54976be748ea24e33b8dc17cd9a943d5
Instruction Fuzzy Hash: 33218321F0968182EA50EB29F5512FE67A1EF897C8F584071EF4D47B86DF2CE9518B00

Function 00007FF8B78290D0 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON310 ref: 00007FF8B78290E4
PyObject_IsInstance.PYTHON310 ref: 00007FF8B7829101
PyObject_CallNoArgs.PYTHON310 ref: 00007FF8B782910E
PyErr_SetObject.PYTHON310 ref: 00007FF8B7829122
_Py_Dealloc.PYTHON310 ref: 00007FF8B7829131
PyErr_SetObject.PYTHON310 ref: 00007FF8B7829140
_Py_Dealloc.PYTHON310 ref: 00007FF8B7829154

Strings

eligible, xrefs: 00007FF8B7829161

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Object_$DeallocErr_Object$ArgsAttrCallInstance
String ID: eligible
API String ID: 2838319001-1278981203
Opcode ID: 8d0f5874ec826c0ea1a04439bcab145a26b0fabb4b6a36d278dd4050dcab920c
Instruction ID: 7c3ed878ed5efc9c87143a7c2d48e604e44f5edfd94b8fe5dc1836fcba829b23
Opcode Fuzzy Hash: 8d0f5874ec826c0ea1a04439bcab145a26b0fabb4b6a36d278dd4050dcab920c
Instruction Fuzzy Hash: 41112760B89B0686FA549B2FEC5813D2BA0AF4DFD2F095030EE1E17374EE2CE4458318

Function 00007FF8B6171677 Relevance: 13.6, APIs: 9, Instructions: 82COMMON

Download Yara Rule

APIs

BIO_next.LIBCRYPTO-1_1 ref: 00007FF8B619A8F0
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FF8B619A911
BIO_pop.LIBCRYPTO-1_1 ref: 00007FF8B619A929
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8B619A936
BIO_push.LIBCRYPTO-1_1 ref: 00007FF8B619A94B
BIO_next.LIBCRYPTO-1_1 ref: 00007FF8B619A969
BIO_next.LIBCRYPTO-1_1 ref: 00007FF8B619A982
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8B619A996
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8B619A9B3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_free_allO_next$O_popO_pushO_up_ref
String ID:
API String ID: 1496992895-0
Opcode ID: d03d8840c3fbb8b9c54e59ae80f638f519a9124658c3b799017e53a6aa270323
Instruction ID: 578ec2a864ea22abd5cb03d465d1aa690c74849eb90a4bd3b812ba968ed32e08
Opcode Fuzzy Hash: d03d8840c3fbb8b9c54e59ae80f638f519a9124658c3b799017e53a6aa270323
Instruction Fuzzy Hash: 90313E22F0B641C1EFA8AF19D1511386360FF84BC4B1514B1EF9E07BC9DE29E8568341

Function 00007FF8B619C500 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

d2i_OCSP_RESPONSE.LIBCRYPTO-1_1 ref: 00007FF8B619C557
OCSP_response_get1_basic.LIBCRYPTO-1_1 ref: 00007FF8B619C567
OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FF8B619C57E
OCSP_resp_get0.LIBCRYPTO-1_1 ref: 00007FF8B619C595
OCSP_SINGLERESP_get1_ext_d2i.LIBCRYPTO-1_1 ref: 00007FF8B619C5AD

Part of subcall function 00007FF8B619C790: OPENSSL_sk_new_null.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C7C3
Part of subcall function 00007FF8B619C790: ERR_put_error.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C7EB

OCSP_resp_count.LIBCRYPTO-1_1 ref: 00007FF8B619C5D5
SCT_LIST_free.LIBCRYPTO-1_1 ref: 00007FF8B619C5E6
OCSP_BASICRESP_free.LIBCRYPTO-1_1 ref: 00007FF8B619C5EE
OCSP_RESPONSE_free.LIBCRYPTO-1_1 ref: 00007FF8B619C5F6

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: P_resp_count$E_freeL_sk_new_nullP_freeP_get1_ext_d2iP_resp_get0P_response_get1_basicR_put_errorT_freed2i_
String ID:
API String ID: 4245524859-0
Opcode ID: c62a8b4eb6d9856d38cd459085609c2473b8b5396092d49879e368d50c324ca5
Instruction ID: 151f743ee35accfe48b6462eadc5707410a7a795831a25022785e6271865ddfa
Opcode Fuzzy Hash: c62a8b4eb6d9856d38cd459085609c2473b8b5396092d49879e368d50c324ca5
Instruction Fuzzy Hash: 3521B311F0E75282FE64A76EA4513BA16D0AF89BC4F4480B5EF4D87BD6EE6DE4028740

Function 00007FF7A3B2EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7A3B2EAD5

Part of subcall function 00007FF7A3B2FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7A3B2FA6F
Part of subcall function 00007FF7A3B2FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7A3B2FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7A3B2EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7A3B2EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7A3B2EF08

Strings

csm, xrefs: 00007FF7A3B2EAEF
csm, xrefs: 00007FF7A3B2EB56
csm, xrefs: 00007FF7A3B2EBD0

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: ba31fc5c217dc89364841d4547c9f7909d081c00a6cd28b20192846c05cd7f07
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: DBD1B33290978186EBA0AFA6D4447ADB7A5FB45788F510235EE8D67BA5CF3DE040C720

Function 00007FF8B61717DF Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 139COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B61C8299, 00007FF8B61C838E
No ciphers enabled for max supported SSL/TLS version, xrefs: 00007FF8B61C83BB
n, xrefs: 00007FF8B61C8291

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_new
String ID: ..\s\ssl\statem\statem_lib.c$No ciphers enabled for max supported SSL/TLS version$n
API String ID: 458078758-706774904
Opcode ID: 2e01c01044a4d995802bfc430c0eb289d3696b1ae998ba6a96851d3107d2c4a9
Instruction ID: bdc4a64542e3226c1d5891cdb197f9f01bdfff3212109f2f95cc367d0f0a71d8
Opcode Fuzzy Hash: 2e01c01044a4d995802bfc430c0eb289d3696b1ae998ba6a96851d3107d2c4a9
Instruction Fuzzy Hash: 02617B72A08A8295E7909F29D4803BD2BA0FB85BC8F185175DF4E8B795DF3CE489C704

Function 00007FF8A84F1720 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F17F5
PyUnicode_FromString.PYTHON310 ref: 00007FF8A84F1859
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F391E
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F392F

Strings

category, xrefs: 00007FF8A84F3917
a unicode character, xrefs: 00007FF8A84F3909
argument, xrefs: 00007FF8A84F3910

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$category
API String ID: 2803103377-2068800536
Opcode ID: 77e4fbcc9945f98615f4233877a45c53ce06f8666a47e47bebf05d0cff7d07bc
Instruction ID: a12e518f171ebaa0066a7921e0944c4142328f7df1f2be9e97b3e46804beacb3
Opcode Fuzzy Hash: 77e4fbcc9945f98615f4233877a45c53ce06f8666a47e47bebf05d0cff7d07bc
Instruction Fuzzy Hash: 9C51C462F0B686A2FB198B09D59067927A1FB44FD4F04013DDA9E47790DFACEC55C328

Function 00007FF7A3B3ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7A3B3F11A,?,?,-00000018,00007FF7A3B3ADC3,?,?,?,00007FF7A3B3ACBA,?,?,?,00007FF7A3B35FAE), ref: 00007FF7A3B3EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF7A3B3F11A,?,?,-00000018,00007FF7A3B3ADC3,?,?,?,00007FF7A3B3ACBA,?,?,?,00007FF7A3B35FAE), ref: 00007FF7A3B3EF08

Strings

api-ms-, xrefs: 00007FF7A3B3EE46
ext-ms-, xrefs: 00007FF7A3B3EE59

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: ecaa3ed4eab745445aaf5182c0a324d129e5cb9c75ccc18047256c0c10523a05
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: EA414C22B1B62581FAD9EF169804575A393BF44B90FCA4136DD9D67FA4DE3EE4048320

Function 00007FF8A84F1000 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F10CE
PyUnicode_FromString.PYTHON310 ref: 00007FF8A84F10F3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F35B0
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F35C0

Strings

a unicode character, xrefs: 00007FF8A84F359B
bidirectional, xrefs: 00007FF8A84F35A9
argument, xrefs: 00007FF8A84F35A2

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$bidirectional
API String ID: 2803103377-2110215792
Opcode ID: 5166d7d21aa0e87ff6d356bc12cbbb4a0886e80c494d1a0f7969533388822b75
Instruction ID: 27400150dc21870671affc677a29e7d4662a1270354b745f6f58c9598148bb00
Opcode Fuzzy Hash: 5166d7d21aa0e87ff6d356bc12cbbb4a0886e80c494d1a0f7969533388822b75
Instruction Fuzzy Hash: E241D371B0B682A1FB198B15C59027962A1FF44FC4F44413DEA8E876D0DFADEC44C368

Function 00007FF7A3B22C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7A3B23706,?,00007FF7A3B23804), ref: 00007FF7A3B22D63
MessageBoxW.USER32 ref: 00007FF7A3B22D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF7A3B22CA6
Error, xrefs: 00007FF7A3B22D8C
<FormatMessageW failed.>, xrefs: 00007FF7A3B22D70
%ls: , xrefs: 00007FF7A3B22D22

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 9953abd0e9de15fb65e3609415924e242d38217421590934457cc39a6ef49d0d
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 1331093370968042E660BF61B8006ABA692BF847C4F820236DFCDA7769DE3DD506C310

Function 00007FF8A84F45DC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F4613
PyUnicode_FromString.PYTHON310 ref: 00007FF8A84F462F
memcpy.VCRUNTIME140 ref: 00007FF8A84F46AB
PyOS_snprintf.PYTHON310 ref: 00007FF8A84F46ED
PyUnicode_FromStringAndSize.PYTHON310 ref: 00007FF8A84F471A

Strings

%04X, xrefs: 00007FF8A84F46D8
, xrefs: 00007FF8A84F46C3

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
String ID: $%04X
API String ID: 762632776-4013080060
Opcode ID: f342e37f7829702106382c91b0b4711f28b24119364d3e66c8b0f26c67739c47
Instruction ID: 0e73152e1547cecc0d53c237fc46937808fc9970ca25d6006d6f4a4d958205fb
Opcode Fuzzy Hash: f342e37f7829702106382c91b0b4711f28b24119364d3e66c8b0f26c67739c47
Instruction Fuzzy Hash: 9F31B372A0A98161FA218B14D8143B973A1FF45FE4F484339DA6E077D5DFACD9458324

Function 00007FF8A84F4C78 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4CB1
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4CC7
PyErr_Occurred.PYTHON310 ref: 00007FF8A84F4D61
PyLong_FromLong.PYTHON310 ref: 00007FF8A84F4D72

Strings

a unicode character, xrefs: 00007FF8A84F4C9C
argument, xrefs: 00007FF8A84F4CA3
mirrored, xrefs: 00007FF8A84F4CAA

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: 79e7af762cd712f15becbe6e0b4d9f328360e95f3de6ce047a05089685b655d1
Instruction ID: d8a7dff9dee03634684a7abd597dfafadd015a37711c7a2ed37ade96da54c1f3
Opcode Fuzzy Hash: 79e7af762cd712f15becbe6e0b4d9f328360e95f3de6ce047a05089685b655d1
Instruction Fuzzy Hash: 57317A60B0B646A2FB648B25D85137922A1FF44FD4F14853DCE1E873D4DFACEC458268

Function 00007FF8A84F41A4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F41DD
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F41F3
PyErr_Occurred.PYTHON310 ref: 00007FF8A84F428D
PyLong_FromLong.PYTHON310 ref: 00007FF8A84F429E

Strings

a unicode character, xrefs: 00007FF8A84F41C8
combining, xrefs: 00007FF8A84F41D6
argument, xrefs: 00007FF8A84F41CF

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: 6b52bc21d5dceee45583528fb996112a3178edb97db6aa29c7bd250d4d494953
Instruction ID: 6515c070cdfe3376976d4a011542288dab7f6e031ddc4643ba85de3974a646d2
Opcode Fuzzy Hash: 6b52bc21d5dceee45583528fb996112a3178edb97db6aa29c7bd250d4d494953
Instruction Fuzzy Hash: 8231CC20B0B606A2FB544B25996137922A1FF84FD4F05853DDE0E823D4DFACED458368

Function 00007FF8B6171672 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8B61A160F
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B61A1617
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61A1644
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A16E1
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A16E9

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A16D0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2618924202-2723262194
Opcode ID: 7545a12e51818284b5657934bbd6071915fa85bbd2fd23a27a4b37fc0708f1ab
Instruction ID: a528431714b722459cdaad340a84225e859dbe970d74c4a5e98ada22ecb0bb88
Opcode Fuzzy Hash: 7545a12e51818284b5657934bbd6071915fa85bbd2fd23a27a4b37fc0708f1ab
Instruction Fuzzy Hash: B731B431E0D68682F630DF1A94416BE62A1FB45BC4F484074EF9D4BB85DF7CE5018B40

Function 00007FF8B619E6E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8B619E724
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B619E72C
EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B619E73F
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FF8B619E75C
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FF8B619E76E
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B619E7BA

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619E799

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_sizeDigestFinal_exX_copy_exX_freeX_mdX_new
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2082763299-1080266419
Opcode ID: b4ecc85ee2d877b129ba478bb47f6408dd9f6d5d1a6847ef8d6277fe5df6f732
Instruction ID: 4f635ec8441be76d08f4adf14731df49ebcdf12cdc029784693acbdc7b5c2382
Opcode Fuzzy Hash: b4ecc85ee2d877b129ba478bb47f6408dd9f6d5d1a6847ef8d6277fe5df6f732
Instruction Fuzzy Hash: CB21B035B0D74281EA24EB1AF84167A6B90EF54BD8F144070EF4D47B86DF3CE0468781

Function 00007FF8B619C790 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C7C3
ERR_put_error.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C7EB
OPENSSL_sk_pop.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C7F8
OPENSSL_sk_push.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C81A
OPENSSL_sk_pop.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C828
OPENSSL_sk_push.LIBCRYPTO-1_1(?,00007FF8B61982AC), ref: 00007FF8B619C85D

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619C7D0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_popL_sk_push$L_sk_new_nullR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 531138727-1080266419
Opcode ID: 72b23b618e2714b7d8531bcd74357a0d25fa61cdcbaf876205b808bb4746c928
Instruction ID: 53e3b90676639fc8495d5f94e5310b603e03b65db21209850e2ccf4c9861c81e
Opcode Fuzzy Hash: 72b23b618e2714b7d8531bcd74357a0d25fa61cdcbaf876205b808bb4746c928
Instruction Fuzzy Hash: 73218E31E0A692C2EA64DB1A9410179A3A4AF84BD4F4841B5EF8D47BD6EF3CF412C700

Function 00007FF8B619E860 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

BIO_f_buffer.LIBCRYPTO-1_1 ref: 00007FF8B619E889
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B619E891
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B619E8AC
BIO_push.LIBCRYPTO-1_1 ref: 00007FF8B619E8C0

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619E8EE

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_f_bufferO_int_ctrlO_newO_push
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1655923927-1080266419
Opcode ID: 7d4ac05b27d1bd132e9ac2c275e6ac35fc4118e7cdf6544a3c85681280af6716
Instruction ID: 05af2752394ce5e77ec492a7cf956a6b4f6932a909c496d4e116f895234c18dc
Opcode Fuzzy Hash: 7d4ac05b27d1bd132e9ac2c275e6ac35fc4118e7cdf6544a3c85681280af6716
Instruction Fuzzy Hash: 91115E62F0924292EB64EB69F5113A963A0EF447C0F440570EB4D47BD5EF3DE5959700

Function 00007FF8B61715A0 Relevance: 12.1, APIs: 8, Instructions: 115COMMON

Download Yara Rule

APIs

OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8B618F3EA
EVP_get_digestbyname.LIBCRYPTO-1_1 ref: 00007FF8B618F3F2
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8B618F403
OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8B618F441
EVP_get_cipherbyname.LIBCRYPTO-1_1 ref: 00007FF8B618F449
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8B618F459
EVP_CIPHER_iv_length.LIBCRYPTO-1_1 ref: 00007FF8B618F46E
EVP_CIPHER_block_size.LIBCRYPTO-1_1 ref: 00007FF8B618F479

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: J_nid2sn$D_sizeP_get_cipherbynameP_get_digestbynameR_block_sizeR_flagsR_iv_length
String ID:
API String ID: 4211416117-0
Opcode ID: fda6d6c3b8aa7bded6564d5cc9954896f967c9983db96fad7675eecd4e352f3d
Instruction ID: ceeb97afb686b6b3f64b47ebc1fb0e379d0cf03283653702f2daa437fd06baf4
Opcode Fuzzy Hash: fda6d6c3b8aa7bded6564d5cc9954896f967c9983db96fad7675eecd4e352f3d
Instruction Fuzzy Hash: 92419E22F1A6128AFA64DB1E955467D6390AF88BE4F1445B2EF4E437D3CE3CF8428341

Function 00007FF8B619D550 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1(?,00007FF8B619768F), ref: 00007FF8B619D592
OPENSSL_sk_num.LIBCRYPTO-1_1(?,00007FF8B619768F), ref: 00007FF8B619D5A9
OPENSSL_sk_value.LIBCRYPTO-1_1(?,00007FF8B619768F), ref: 00007FF8B619D5B7
X509_NAME_dup.LIBCRYPTO-1_1(?,00007FF8B619768F), ref: 00007FF8B619D5BF
OPENSSL_sk_num.LIBCRYPTO-1_1(?,00007FF8B619768F), ref: 00007FF8B619D5E3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_num$E_dupL_sk_new_nullL_sk_valueX509_
String ID:
API String ID: 3273602126-0
Opcode ID: 0e573bc13ddf8416ad3aefde0ca97644b29fb472d7d6c98dda913f1410464978
Instruction ID: 061ae35fef550d472be04f92e245c442b91288196427af6d7213e15a43bb76de
Opcode Fuzzy Hash: 0e573bc13ddf8416ad3aefde0ca97644b29fb472d7d6c98dda913f1410464978
Instruction Fuzzy Hash: 35216521F0EB8285FA60EB6EA54117D62B1EF44BC8F4450B1EF4E87BC6DE2CE4528700

Function 00007FF8B78260D0 Relevance: 12.1, APIs: 8, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON310 ref: 00007FF8B78260DD
_PyTrash_cond.PYTHON310 ref: 00007FF8B78260EF
PyThreadState_Get.PYTHON310 ref: 00007FF8B78260F9
_PyTrash_begin.PYTHON310 ref: 00007FF8B7826108
_Py_Dealloc.PYTHON310 ref: 00007FF8B7826134
_Py_Dealloc.PYTHON310 ref: 00007FF8B7826158
_Py_Dealloc.PYTHON310 ref: 00007FF8B7826175
_PyTrash_end.PYTHON310 ref: 00007FF8B7826190

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_end
String ID:
API String ID: 227901110-0
Opcode ID: 7c6a2acc96253a68dc6a851340103872d099d94b12c7f42d5210857cfd90136e
Instruction ID: ba3ce0ff2589a2a7d96ad11de08036257dc00f8d280ddb4bd0dab8cb747b6215
Opcode Fuzzy Hash: 7c6a2acc96253a68dc6a851340103872d099d94b12c7f42d5210857cfd90136e
Instruction Fuzzy Hash: 32210E71B48B4282EB554F3D994833C6BA0EF48FEAF194230DB6E026E5CF2DE4458344

Function 00007FF8B61BA5E0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B61BA693
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8B61BA6B4
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B61BA785
ERR_add_error_data.LIBCRYPTO-1_1 ref: 00007FF8B61BA87B

Strings

No ciphers enabled for max supported SSL/TLS version, xrefs: 00007FF8B61BA872
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61BA624, 00007FF8B61BA7E3, 00007FF8B61BA84F

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_num$L_sk_valueR_add_error_data
String ID: ..\s\ssl\statem\statem_clnt.c$No ciphers enabled for max supported SSL/TLS version
API String ID: 2496138956-1190228026
Opcode ID: 82452b5608d7221badafe8bfe210e9e7cd59f31f4139706463deab8ad7ec8123
Instruction ID: 1ef1f99918e3bb468de9dfb1443473298e9b5dceb6f8c585d3b5ea4d5d44517b
Opcode Fuzzy Hash: 82452b5608d7221badafe8bfe210e9e7cd59f31f4139706463deab8ad7ec8123
Instruction Fuzzy Hash: D861E632B09A8246FB608A19E8407BA67A4EB84BD8F5C4175DF4D47B94DF3CE585DB00

Function 00007FF8B61C0660 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8B61BDDAD), ref: 00007FF8B61C07D5
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8B61BDDAD), ref: 00007FF8B61C07F3
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8B61BDDAD), ref: 00007FF8B61C080D
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8B61BDDAD), ref: 00007FF8B61C0826
X509_get0_pubkey.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8B61BDDAD), ref: 00007FF8B61C0865

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8B61C0899

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: N_bin2bn$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 3650846462-1507966698
Opcode ID: 278fc5af8a86312b90c9136c6644aefa74232ce8687e1fe171cbe9cd358847fb
Instruction ID: 0cec54172a635565f1883ecf43eb471fe9eabebdbccd704adf1ee3340a0ed3c6
Opcode Fuzzy Hash: 278fc5af8a86312b90c9136c6644aefa74232ce8687e1fe171cbe9cd358847fb
Instruction Fuzzy Hash: AC61E022F08B9184EB508F68A8446AC77B5EB457D8F188670DFAC26B98DF39D291C340

Function 00007FF8B61CF7F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,00007FF8B61D17D8), ref: 00007FF8B61CF977

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8B61CF833, 00007FF8B61CF953

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: Y_free
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1282063954-348624464
Opcode ID: 7b14953ebf8d76769b98864a68384ebc76ace5062db5951c6759b97e19e98bb1
Instruction ID: 9a153fc8e62b69ec3f06bb354324ad7c39b1e9e9dde14d3da3a14c0dc8f8d106
Opcode Fuzzy Hash: 7b14953ebf8d76769b98864a68384ebc76ace5062db5951c6759b97e19e98bb1
Instruction Fuzzy Hash: D7418D72A0878296EA209F1AE0546AD7BA4EB45BD4F444175EF8C0BB95CF3CE64AC704

Function 00007FF8B61D47F0 Relevance: 10.6, APIs: 7, Instructions: 97COMMON

Download Yara Rule

APIs

EVP_PKEY_security_bits.LIBCRYPTO-1_1 ref: 00007FF8B61D4850
DH_new.LIBCRYPTO-1_1 ref: 00007FF8B61D4857
DH_set0_pqg.LIBCRYPTO-1_1 ref: 00007FF8B61D4907
DH_free.LIBCRYPTO-1_1 ref: 00007FF8B61D4918
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61D4920
DH_free.LIBCRYPTO-1_1 ref: 00007FF8B61D492A
BN_free.LIBCRYPTO-1_1 ref: 00007FF8B61D4932

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: H_freeN_free$H_newH_set0_pqgY_security_bits
String ID:
API String ID: 3535209601-0
Opcode ID: eb53a93a86599d18d73dd647248a56871bddecd4d50ca590b6762aeaf80ecd60
Instruction ID: a9edd0161f7022cf8e11dac68a930b508148db25c4e2ca36205ec76e087aeaca
Opcode Fuzzy Hash: eb53a93a86599d18d73dd647248a56871bddecd4d50ca590b6762aeaf80ecd60
Instruction Fuzzy Hash: A231B412F0E78285FEB8ABAE91953BD1290AF85BC0F1810B5EF4D577D6DE2CE4429740

Function 00007FF8B7825800 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FF8B7825822

Strings

'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8B782588C
attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF8B7825818
int, xrefs: 00007FF8B7825912

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-2022335554
Opcode ID: ac4ee888c964d7d91630edaf05918bc56724bc662c6158c676787cd97139c55f
Instruction ID: 270d9ef6e1807167c2a5c55d2764923a5a077ebd72ea5846713be8d2b48417a7
Opcode Fuzzy Hash: ac4ee888c964d7d91630edaf05918bc56724bc662c6158c676787cd97139c55f
Instruction Fuzzy Hash: FA318121F48B0281EE589B2DE45527D2BA0FF88BD6F995131EB5E467F5DE6CD480C308

Function 00007FF8B61715D2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B61C3C0B
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8B61C3C19
i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FF8B61C3C5D
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B61C3C6B

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B61C3BC8, 00007FF8B61C3C8D
2, xrefs: 00007FF8B61C3CAF

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_num$L_sk_valueX509_i2d_
String ID: ..\s\ssl\statem\statem_lib.c$2
API String ID: 3754435392-3488551833
Opcode ID: 655f90d39ba016328d201df62de7c54ca237959c796a846f6dac73a98d3842bb
Instruction ID: 3152e55b560b6ca33b27fd85870bdd55e5720b45781675c41b16f2358e116706
Opcode Fuzzy Hash: 655f90d39ba016328d201df62de7c54ca237959c796a846f6dac73a98d3842bb
Instruction Fuzzy Hash: E8312831F0D75245FB20EB6AA84127E5694AF84BD4F044171EF4D8BB96DE3CE54A8B08

Function 00007FF8A84F4310 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F434B
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4380
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4394

Strings

a unicode character, xrefs: 00007FF8A84F436B
argument 1, xrefs: 00007FF8A84F4379
decimal, xrefs: 00007FF8A84F4344, 00007FF8A84F4372

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: 5ec715d8f612314d37dcb9becbe6710ed8f88d4d627242044bdd0e4468f1f11b
Instruction ID: cbd48dff481f6d29370c200887ee7aaa1b2a74a4afb6305325b6d6a93ea73516
Opcode Fuzzy Hash: 5ec715d8f612314d37dcb9becbe6710ed8f88d4d627242044bdd0e4468f1f11b
Instruction Fuzzy Hash: 2B318B22B0B646A2EB508B15D94027D2261FB84FC4F54C13ADE0D57B94DFBDED46C368

Function 00007FF8A84F4FB8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F4FF3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F5028
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F503C

Strings

a unicode character, xrefs: 00007FF8A84F5013
argument 1, xrefs: 00007FF8A84F5021
numeric, xrefs: 00007FF8A84F4FEC, 00007FF8A84F501A

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: c696227786d71e6c4bbe31cc5d0caca0a1d546047ec38d9a5dda0198a1748ca8
Instruction ID: 503df1d54fe8d2e8dcb6475719838f09f07edaa0c12d5716e896f58611088375
Opcode Fuzzy Hash: c696227786d71e6c4bbe31cc5d0caca0a1d546047ec38d9a5dda0198a1748ca8
Instruction Fuzzy Hash: 8A318B31B1B646EAFB608B15D6402692261EF80FC4F558439DE0C47794EFAEEC42C3A8

Function 00007FF8A84F4DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A84F4E27
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4E5C
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F4E70

Strings

a unicode character, xrefs: 00007FF8A84F4E47
argument 1, xrefs: 00007FF8A84F4E55
name, xrefs: 00007FF8A84F4E20, 00007FF8A84F4E4E

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: b29c512bfe7fafda20da377a3f4b5d851a2f6093717912e1f28a2fc0d4ae9dfc
Instruction ID: f29edb0306ef27767fde520817a1e7bd6de087a4f07b359e773031dbc033fd41
Opcode Fuzzy Hash: b29c512bfe7fafda20da377a3f4b5d851a2f6093717912e1f28a2fc0d4ae9dfc
Instruction Fuzzy Hash: 8E314921B1B686A1EB608B16D8402792361FB84FC4F54C039DE4D47B99DF7DEC96CB28

Function 00007FF7A3B2DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDBD
GetLastError.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DE63
GetProcAddress.KERNEL32(?,?,?,00007FF7A3B2DFEA,?,?,?,00007FF7A3B2DCDC,?,?,?,00007FF7A3B2D8D9), ref: 00007FF7A3B2DE6F

Strings

api-ms-, xrefs: 00007FF7A3B2DDDD

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 75be4bf83acf7697c6f0d62b0b4acd68e7dc02a87a9d0d6da660a22aeacd38ec
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: CC31E921B0B78581EE91FF529800975A395FF58B90F8A4639DDAD27360DF3DE4408320

Function 00007FF7A3B22A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7A3B2351A,?,00000000,00007FF7A3B23F23), ref: 00007FF7A3B22AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF7A3B22AA8
Warning, xrefs: 00007FF7A3B22B1E
Warning [ANSI Fallback], xrefs: 00007FF7A3B22B0F
WARNING, xrefs: 00007FF7A3B22AAF
0, xrefs: 00007FF7A3B22B16

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 9f3724fc4777d82f1d36e9bf3eccec85cd9920f351572f9bdfd332f1ed592fe2
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 5021A63261978192E650EF51B4817E6A355FB883C4F810232EECC63669DF3DD1458750

Function 00007FF7A3B28760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7A3B28780
OpenProcessToken.ADVAPI32 ref: 00007FF7A3B28793
GetTokenInformation.ADVAPI32 ref: 00007FF7A3B287B8
GetLastError.KERNEL32 ref: 00007FF7A3B287C2
GetTokenInformation.ADVAPI32 ref: 00007FF7A3B28802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A3B2881E
CloseHandle.KERNEL32 ref: 00007FF7A3B28836

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction ID: 527189d301cca72a61bdb79b633a837abd7c73eaca583aff99f53ea01ef84adf
Opcode Fuzzy Hash: 1e3bf3a8b1345e2c0c0bdd6ff4e06add0bb9355989cc78c5a669156b3459c754
Instruction Fuzzy Hash: 0D219821A0D68282EB90AF95B450539E3A2FB817A0F950335DAED97BF8DE7DD4448710

Function 00007FF7A3B3B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7A3B3B1CF
FlsGetValue.KERNEL32 ref: 00007FF7A3B3B1E4
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B205
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B232
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B243
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B254
SetLastError.KERNEL32 ref: 00007FF7A3B3B26F

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction ID: fa9419698329e8c4fc0e948954b561092306fc9e1a1c8e2e9ee73743c346d851
Opcode Fuzzy Hash: 7a7efe5704aebd884d83a549bac9021180a30b6e3a5084d39c82c78793c2ea5e
Instruction Fuzzy Hash: CE218120F0E66682F6DCBF615A5117DE1435F447A0F924335E9BE66EFADE2EA4004360

Function 00007FF7A3B47DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7A3B47E0D
GetLastError.KERNEL32 ref: 00007FF7A3B47E19
CloseHandle.KERNEL32 ref: 00007FF7A3B47E31
CreateFileW.KERNEL32 ref: 00007FF7A3B47E5C
WriteConsoleW.KERNEL32 ref: 00007FF7A3B47E7B

Strings

CONOUT$, xrefs: 00007FF7A3B47E3D

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 742c174c99961a48832bf96d10bb7500a292cf94ea762cb1af6aca6c92c77708
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: D511A221B19A4182F790AF16E844329A6A5BB88BE4F410234DA9E977A4CF3DD8018754

Function 00007FF8B61718BB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8B61A718E
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B61A7196
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A71BE
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61A71E2
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B61A71F7

Strings

..\s\ssl\ssl_txt.c, xrefs: 00007FF8B61A71A3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_txt.c
API String ID: 2618924202-3774725576
Opcode ID: 76b3cb6e15b9c940ada8efb67fb55efdeb7a6807f8422724ca33bbc732a653dc
Instruction ID: 5d70cf13603cff60a7efb158dc1d0aa4c59559c43ac72e28fa1f355713eff891
Opcode Fuzzy Hash: 76b3cb6e15b9c940ada8efb67fb55efdeb7a6807f8422724ca33bbc732a653dc
Instruction Fuzzy Hash: C5019221F1965282E650EB29F5555BAA760AB84BC4F544070FF4C47B9ADF3CE5418B00

Function 00007FF7A3B28560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B28592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B285E9

Part of subcall function 00007FF7A3B29400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7A3B245E4,00000000,00007FF7A3B21985), ref: 00007FF7A3B29439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B28678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B286E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B286F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF7A3B29216), ref: 00007FF7A3B2870A

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction ID: 4bc1dad00278bfedbf1bc8f36c050beb1c17289a93db50fd000ea6a7d0f56332
Opcode Fuzzy Hash: b2770b171440e78660be4c91fda42c27049aa369c6710ced6bdf6821ec2ad01d
Instruction Fuzzy Hash: 6941DD2271A6D245E6B0AF51A440AB6A396FF44BC4F860231DFCDB7BA5DE3DD401C720

Function 00007FF8B6171519 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B6199146
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B6199156
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B6199172
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8B6199185
OPENSSL_sk_find.LIBCRYPTO-1_1 ref: 00007FF8B6199193
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B61991FB

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_num$L_sk_findL_sk_value
String ID:
API String ID: 1561070308-0
Opcode ID: 49cfb41db51e2d83e384b793f50b7199427ee1d05f205d6aa40966a2a6e1666f
Instruction ID: 037ce2afec15ce2b4ffa81fb1bd3822415195b298c72e2b5c61be15be5148358
Opcode Fuzzy Hash: 49cfb41db51e2d83e384b793f50b7199427ee1d05f205d6aa40966a2a6e1666f
Instruction Fuzzy Hash: 5F41A022B0D68286EB649E2E94053797BA0BB56BD4F5C48B5DF4D8B3C9DE3DE4478300

Function 00007FF7A3B290E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B28760: GetCurrentProcess.KERNEL32 ref: 00007FF7A3B28780
Part of subcall function 00007FF7A3B28760: OpenProcessToken.ADVAPI32 ref: 00007FF7A3B28793
Part of subcall function 00007FF7A3B28760: GetTokenInformation.ADVAPI32 ref: 00007FF7A3B287B8
Part of subcall function 00007FF7A3B28760: GetLastError.KERNEL32 ref: 00007FF7A3B287C2
Part of subcall function 00007FF7A3B28760: GetTokenInformation.ADVAPI32 ref: 00007FF7A3B28802
Part of subcall function 00007FF7A3B28760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7A3B2881E
Part of subcall function 00007FF7A3B28760: CloseHandle.KERNEL32 ref: 00007FF7A3B28836

LocalFree.KERNEL32(?,00007FF7A3B23C55), ref: 00007FF7A3B2916C
LocalFree.KERNEL32(?,00007FF7A3B23C55), ref: 00007FF7A3B29175

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7A3B29142
D:(A;;FA;;;%s), xrefs: 00007FF7A3B29157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7A3B29183
S-1-3-4, xrefs: 00007FF7A3B29121

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 76fa0d4d3236f4a3ac72b8783aaede26b382819edb2146c9e147ba1ff64f31a7
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 8B218121B0A78285F780BF50E4157EAB252FF88780FC60135EA8D637A6DF3ED4008360

Function 00007FF7A3B3B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B347
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B37D
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3CC
SetLastError.KERNEL32(?,?,?,00007FF7A3B34F81,?,?,?,?,00007FF7A3B3A4FA,?,?,?,?,00007FF7A3B371FF), ref: 00007FF7A3B3B3E7

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction ID: 1819e64c9c3bb0543c3b1b44a847ef4a880bbcafd1ee569b635b399332d58b07
Opcode Fuzzy Hash: 6c88e88182f069636ae7df0ba171e708af9cab9deaf2d86c464056bb8d47fe11
Instruction Fuzzy Hash: AF119220B0E66282F7DCBF25564117DE1435F447A0FD24335E8AEA6FFADE6EA4018321

Function 00007FF7A3B22910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7A3B21B6A), ref: 00007FF7A3B2295E

Strings

Error [ANSI Fallback], xrefs: 00007FF7A3B229FF
%s: %s, xrefs: 00007FF7A3B229E8
Error, xrefs: 00007FF7A3B22A0E
[PYI-%d:ERROR] , xrefs: 00007FF7A3B22966

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: b6417ff4dc99a11801b2f32d068d60586c54ec74e41b741cb01756880fa0de2a
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: B3313723B0A68152E750FF61B8416E6A292BF887D4F820232EECCA3765DF3DD1468210

Function 00007FF8B619F890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619F8DD
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619F918

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619F8C0, 00007FF8B619F8F9, 00007FF8B619F949

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 9877330b7861c5d632897e2ce88e0a10cc6ea2c7f2df5a42f89e5af22235fce1
Instruction ID: 267a79f5a13e1799b0c324c34d9b14b44ca332a2524ad305d97699c03664ac78
Opcode Fuzzy Hash: 9877330b7861c5d632897e2ce88e0a10cc6ea2c7f2df5a42f89e5af22235fce1
Instruction Fuzzy Hash: CF315A31A08A82DAE7209F59E4043A97760EB84BD8F244276FB9D47BD5CF3DE446CB00

Function 00007FF8B61718A2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6196F58
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6196F93

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6196F39, 00007FF8B6196F74, 00007FF8B6196FDA

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 5e7c9841f93f325714244757ab9d7e0090eaf38bf986610e53f9cecb39fae905
Instruction ID: 92f38a95a8f4be77fe1ba2813da0a1ce88b5c3abdc18dbaa95e40699fe2411fd
Opcode Fuzzy Hash: 5e7c9841f93f325714244757ab9d7e0090eaf38bf986610e53f9cecb39fae905
Instruction Fuzzy Hash: 0F319072A08A85C2F7608F2CE4443AD63A0EB85BD8F544271EB5C4B7D5DF3DD5868B10

Function 00007FF8A84F44EC Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F4525
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F453B

Strings

a unicode character, xrefs: 00007FF8A84F4510
decomposition, xrefs: 00007FF8A84F451E
argument, xrefs: 00007FF8A84F4517

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: eb71c64694ba772ea243d88ab20c540854d330459cc9f8d19473c127f4ed5c7a
Instruction ID: 65692be002a316b48f0e907440ef838ed6e6763d98e2bf9f5ce352051476ae1b
Opcode Fuzzy Hash: eb71c64694ba772ea243d88ab20c540854d330459cc9f8d19473c127f4ed5c7a
Instruction Fuzzy Hash: 3E21BAA1B0B606A2FB549B25D8613796291FF84FE4F44A139DF0E863C4DF6CEC458368

Function 00007FF8A84F48A8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A84F48E1
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A84F48F7

Strings

a unicode character, xrefs: 00007FF8A84F48CC
argument, xrefs: 00007FF8A84F48D3
east_asian_width, xrefs: 00007FF8A84F48DA

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: 4a816c30405d851c681ac4182914aa0a6507a072684f2f0f21f3bca396e9354a
Instruction ID: d3ca9d5d9d34cfef78e356fdbcd7602db29e96ec5820ece793256c5cc77aab34
Opcode Fuzzy Hash: 4a816c30405d851c681ac4182914aa0a6507a072684f2f0f21f3bca396e9354a
Instruction Fuzzy Hash: 3E21DE61B0B646A2FB648B25C8617791291FF44FD8F54803DCE4D923C4CF6DEC458768

Function 00007FF7A3B22B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7A3B2918F,?,00007FF7A3B23C55), ref: 00007FF7A3B22BA0
MessageBoxW.USER32 ref: 00007FF7A3B22C2A

Strings

WARNING, xrefs: 00007FF7A3B22BAF
Warning, xrefs: 00007FF7A3B22C1D
[PYI-%d:%ls] , xrefs: 00007FF7A3B22BA8

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 029b6d3e6d81850db34f88e13fde10a3fd2e68bd5727a21d2e2debf6f0b4378b
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 4721B122709B8182E691EF54F8457EAA365FB88780F814132EACD67666DE3DD205C750

Function 00007FF7A3B22710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7A3B21B99), ref: 00007FF7A3B22760

Strings

[PYI-%d:%s] , xrefs: 00007FF7A3B22768
Error [ANSI Fallback], xrefs: 00007FF7A3B227CF
Error, xrefs: 00007FF7A3B227DE
ERROR, xrefs: 00007FF7A3B2276F

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: a142615334a08d40bbd4ff4dd9e9bd6931b376a65bebaf5a47195d6d00d6082c
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 6D21A332A1A78192E690EF50B8417E6A395EB88384F810231EECC63669DF3DD5458750

Function 00007FF8B61715C3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B619AAF6
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8B619AB05
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B619AB1E

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619AB4D

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_num$L_sk_value
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1603723057-1080266419
Opcode ID: e63cc03bb61770c23f53dcb921607a3fc9bc7c203b65f42536dfa3209a125d91
Instruction ID: 3996455449f9b8418bff53d462be3a8f6bbe6a8386aaa48a5e4c9f1b15fb3c99
Opcode Fuzzy Hash: e63cc03bb61770c23f53dcb921607a3fc9bc7c203b65f42536dfa3209a125d91
Instruction Fuzzy Hash: 8521D532B0965182E750EF1DE4512EDA3B1EB88BC8F584075EB4D437A5DF3DD5868704

Function 00007FF8B6171726 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

BIO_new.LIBCRYPTO-1_1 ref: 00007FF8B61850BE
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8B618510F
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8B6185134
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B6185172

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FF8B61850CB

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrlO_freeO_newX_free
String ID: ..\s\ssl\s3_enc.c
API String ID: 3686289451-1839494539
Opcode ID: 0f4537b6f273d9a57d62c9505bf84043ba7f1c198fad20582c24826d971f95aa
Instruction ID: 5838526dab4c4e767709abbdd624260c8db07252897d9e2bd0881f2968981aca
Opcode Fuzzy Hash: 0f4537b6f273d9a57d62c9505bf84043ba7f1c198fad20582c24826d971f95aa
Instruction Fuzzy Hash: 51214732B0978195EB90DF29E0903AC33A0EB89BC8F488671DF4D4B795DF39D1848700

Function 00007FF8B618B590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B618B5F4
OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8B618B60F
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8B618B623
X509_up_ref.LIBCRYPTO-1_1 ref: 00007FF8B618B62F

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FF8B618B5D8

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pushR_put_errorX509_up_ref
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1254856836-349359282
Opcode ID: 4350f828ab213a4cbc624b13c2d11809c0d947b25cac28e25d23ca67d5d1a989
Instruction ID: 9816d1c87c70d0fcf9d14f929cd2a2a6cc399586c9996d718ea36509079d134c
Opcode Fuzzy Hash: 4350f828ab213a4cbc624b13c2d11809c0d947b25cac28e25d23ca67d5d1a989
Instruction Fuzzy Hash: 64115E61B0AB8281FFA49B6EE5513B953A0AF44BC4F184575EF0C47B86DF3CE4508B00

Function 00007FF8A84F50FC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F5128
_PyUnicode_ToNumeric.PYTHON310 ref: 00007FF8A84F5151
PyErr_SetString.PYTHON310 ref: 00007FF8A84F5179
PyFloat_FromDouble.PYTHON310 ref: 00007FF8A84F518B

Strings

not a numeric character, xrefs: 00007FF8A84F516F

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: 6f40b65d22250433ba970fef7b6fa96197446ff7b59d4b5f99bbc2bdbf8a30c1
Instruction ID: 84b4e3e482f02d90fce3556ce69aef4b58d8721c6eb6cc4d1d020d10b7818017
Opcode Fuzzy Hash: 6f40b65d22250433ba970fef7b6fa96197446ff7b59d4b5f99bbc2bdbf8a30c1
Instruction Fuzzy Hash: 95118E31E0B942A1FB649B25DA0413962A1EF44FC0F094138E94E43755DFACFC868268

Function 00007FF8A84F4454 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A84F4480
_PyUnicode_ToDecimalDigit.PYTHON310 ref: 00007FF8A84F449F
PyErr_SetString.PYTHON310 ref: 00007FF8A84F44BF
PyLong_FromLong.PYTHON310 ref: 00007FF8A84F44D3

Strings

not a decimal, xrefs: 00007FF8A84F44B5

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 397279be5b3b8a6810ec4f07cfde4af0a0996d7eeaf4260f441a94f7aa9927b5
Instruction ID: a73a84d7c45191d8d4ee527e4cfb3d55ef3db005efa4eb041930eb086c0dae1f
Opcode Fuzzy Hash: 397279be5b3b8a6810ec4f07cfde4af0a0996d7eeaf4260f441a94f7aa9927b5
Instruction Fuzzy Hash: 7911A121B0BA42A1FB548F62E55413867A1FF84FD4F08843DDA0E97794DFACEC859328

Function 00007FF8A84F1F20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310(?,?,?,?,?,00007FF8A84F1F0C), ref: 00007FF8A84F3B91

Part of subcall function 00007FF8A84F1FE0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84F2018
Part of subcall function 00007FF8A84F1FE0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84F2036

PyErr_Format.PYTHON310 ref: 00007FF8A84F1F87
PyUnicode_FromKindAndData.PYTHON310 ref: 00007FF8A84F3BC0

Strings

undefined character name '%s', xrefs: 00007FF8A84F1F7A
name too long, xrefs: 00007FF8A84F3B87

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Err_strncmp$DataFormatFromKindStringUnicode_
String ID: name too long$undefined character name '%s'
API String ID: 2291325159-4056717002
Opcode ID: 037af58450031210e4c1200c641c09ff3158a112c572d6a8f5e4bcf4814df1f1
Instruction ID: a4316bccc95adf0ae114db30535cd4844dfda75e00a435db939000ccc6747048
Opcode Fuzzy Hash: 037af58450031210e4c1200c641c09ff3158a112c572d6a8f5e4bcf4814df1f1
Instruction Fuzzy Hash: 83117071A0B907A1FB00DB54D8842B87360FB88FC9F40003ADA4D472A1DFADE94AC728

Function 00007FF8A84F25E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F25EB
PyCapsule_New.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F2628
PyErr_NoMemory.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F3F46
PyMem_Free.PYTHON310(?,?,00000000,00007FF8A84F2595), ref: 00007FF8A84F3F56

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FF8A84F261D

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 4aee792f5c66c47e9953fad9dee25fce8d59659e004b9cbed73430be2ab25bbe
Instruction ID: c936237e1e1feb25e30c129b940dacd24aecc982bb70036fbff8ae4b81c7353c
Opcode Fuzzy Hash: 4aee792f5c66c47e9953fad9dee25fce8d59659e004b9cbed73430be2ab25bbe
Instruction Fuzzy Hash: BFF01430A1BB43A1FA458B51E9441B962A4FF08FC5F48103ED84E063A4EFACE844C338

Function 00007FF7A3B39AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7A3B39B1D
GetProcAddress.KERNEL32 ref: 00007FF7A3B39B33
FreeLibrary.KERNEL32 ref: 00007FF7A3B39B5A

Strings

mscoree.dll, xrefs: 00007FF7A3B39B14
CorExitProcess, xrefs: 00007FF7A3B39B2C

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 022d1891b741e92b2fb70c7e450ca37ea52a64f87c3aafd83518e6aa9ced8e1e
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 14F0C221B0B70682FB94AF24E444339A322AF88761F850235CBEE56AF4DF3ED444C324

Function 00007FF8B7823090 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON310 ref: 00007FF8B78230B9
PyLong_FromSsize_t.PYTHON310 ref: 00007FF8B78230DB
PyObject_RichCompareBool.PYTHON310 ref: 00007FF8B78230F2
_Py_Dealloc.PYTHON310 ref: 00007FF8B7823103
_Py_Dealloc.PYTHON310 ref: 00007FF8B7823112

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareObject_Rich
String ID:
API String ID: 4107546884-0
Opcode ID: 6717d9f09abe7cde4ef4192eb1f0d521039471ba62db8a3f0d9d23952c1c319e
Instruction ID: 77ff898102751dc589b32355778fbe3e5ac8b4d0cd96e7d4db9445840ff1009c
Opcode Fuzzy Hash: 6717d9f09abe7cde4ef4192eb1f0d521039471ba62db8a3f0d9d23952c1c319e
Instruction Fuzzy Hash: 92119121F58B4241EA585B2DA92427DAAA1AF45BF2F581730EF3E02BF5DF2CE8414304

Function 00007FF7A3B493D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7A3B49400
_set_statfp.LIBCMT ref: 00007FF7A3B4941B
_set_statfp.LIBCMT ref: 00007FF7A3B49437
_set_statfp.LIBCMT ref: 00007FF7A3B49473

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: c74ca89f358b4b356d11b32bb88f130a1fff18ac3febdf6f8050113ba688bed1
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 3C11B262E0DA1309F6F43928F456375B0466F98370F86C634EAEE262F68E2E6D41412D

Function 00007FF7A3B3B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B41F
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B43E
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B466
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B477
FlsSetValue.KERNEL32(?,?,?,00007FF7A3B3A613,?,?,00000000,00007FF7A3B3A8AE,?,?,?,?,?,00007FF7A3B3A83A), ref: 00007FF7A3B3B488

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction ID: 26cd80a8410da237365f220afdb8f74b394166ec3e82d3120ee7ed448435d4a9
Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction Fuzzy Hash: B4116620B0A65282F5DCBF255651179E2435F847B0FD64335E8BD66EFADE2EE4018320

Function 00007FF7A3B3B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7A3B3B2A5
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2C4
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2EC
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B2FD
FlsSetValue.KERNEL32 ref: 00007FF7A3B3B30E

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction ID: edd9b08be0a71f8ad7f839499045b92168a5afdc530680317978077d22bb670a
Opcode Fuzzy Hash: 8aa69c65082f5ed190463b1c2d732539134b8ecb86da000f77e4666776fecf75
Instruction Fuzzy Hash: 47110A10E0F62682FADCBE2549111B9E1434F45320FD64735E9BE6AEF6DD2EB8014261

Function 00007FF8B78280E0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON310 ref: 00007FF8B7828107
_Py_Dealloc.PYTHON310 ref: 00007FF8B782812B
_Py_Dealloc.PYTHON310 ref: 00007FF8B782814F
_Py_Dealloc.PYTHON310 ref: 00007FF8B7828173
_Py_Dealloc.PYTHON310 ref: 00007FF8B7828190

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: b2a2c73d3c2a29109a7251d683fb8fa7d1d31db93d72c7a972fec25033542430
Instruction ID: c0b0a45ca0a4e5e6be49f841c7af95a4e0706d9bef486b22f17579103fe9e300
Opcode Fuzzy Hash: b2a2c73d3c2a29109a7251d683fb8fa7d1d31db93d72c7a972fec25033542430
Instruction Fuzzy Hash: DA211A72B58B0181EB658F3DA84837C2AE4AF48BBBF150734DB79112E4CF6ED4858308

Function 00007FF7A3B36010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B36176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3622C

Strings

verbose, xrefs: 00007FF7A3B36020

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 70054ae9cbd952bac33ed049bac66be63b1f3c719a32c11e9c64c9c91d3f225c
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: EF91E722A0EA5641E7E9AE24D89137DB792AB00B54FC64135DACD63FE5DF3EE4058320

Function 00007FF7A3B3FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B3FF17

Part of subcall function 00007FF7A3B37AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B37AC9

Strings

UTF-8, xrefs: 00007FF7A3B3FE96
UTF-16LEUNICODE, xrefs: 00007FF7A3B3FEB5
ccs, xrefs: 00007FF7A3B3FE52

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 04bb89e0989f4d341c241b54083c8f4ecd27ddb8e21abc1977336968a995237a
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 8C81C732D0BA7385F7EC6E258104278B6A2AB11744FD74036DA8977EB5CB3FA9018321

Function 00007FF7A3B2D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A3B2D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A3B2D77A
RtlUnwindEx.KERNEL32 ref: 00007FF7A3B2D7D4

Strings

csm, xrefs: 00007FF7A3B2D761

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: bd7dbfc6ff3dbbd0b29ba1b1ab33ddf74b0b8d80f43ccc614e9c8c4c73d70b24
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 2A51B432B1A7818ADB94AF55D004A78A392EB44B94F924238DEEE57774DF3EE841C710

Function 00007FF7A3B2F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7A3B2F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7A3B2F408

Strings

csm, xrefs: 00007FF7A3B2F342
csm, xrefs: 00007FF7A3B2F45A

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 89943d34ba9c8239cf65c59947f8fe832c22dab1325f43ec24cb92fb45c2e8bc
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: F351D6325093C28AEBA4AF619044B68B7A1FB54B84F964336DADC677A5CF3DE450CB10

Function 00007FF7A3B2EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7A3B2EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7A3B2EFF3

Strings

MOC, xrefs: 00007FF7A3B2EFBB
RCC, xrefs: 00007FF7A3B2EFC3

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 5328b2cf955713a8988c099e0ffa33b44f64ec3392a600ccac7bdefa6107ab2e
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 7061A132909BC581EBA09F55E440BAAB7A1FB84B84F854326EBDC17B65CF7DD190CB10

Function 00007FF7A3B27E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7A3B2352C,?,00000000,00007FF7A3B23F23), ref: 00007FF7A3B27F22

Strings

\, xrefs: 00007FF7A3B27E87
%.*s, xrefs: 00007FF7A3B27EDB
%s%c, xrefs: 00007FF7A3B27E94

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: 2492e31f17411689d10e414d40ead7e851728adc7afc385c6a3e85a54e69eee2
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: BA311A6171AAC145FAA1AF10A451BEAA355EF84BE0F810330EEED577EADE2DD2018710

Function 00007FF7A3B22810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7A3B228EA

Strings

ERROR, xrefs: 00007FF7A3B2286F
Error, xrefs: 00007FF7A3B228DD
[PYI-%d:%ls] , xrefs: 00007FF7A3B22868

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: e4bd206f0e03ce20c52509a245c2ed27afc31417aebad2fdebdf6dfdba407619
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: F021E122B09B8182E690EF54F4457EAA3A1FB88780F810132EECD67666DE3DD205C710

Function 00007FF8B617152D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B618B514
OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8B618B52F
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8B618B543

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FF8B618B4F8

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pushR_put_error
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1176158178-349359282
Opcode ID: b97949d533b1b32835693e0a609ce1cb85964ee957a2b7509848bb86ff9a5740
Instruction ID: 92f990c1c2a5a475e71b01c7828ad7a24d10dd5dc92b1c4f05255cb7714bba5c
Opcode Fuzzy Hash: b97949d533b1b32835693e0a609ce1cb85964ee957a2b7509848bb86ff9a5740
Instruction Fuzzy Hash: F0117C61B0AB4281FFA49B69E0013B953A0AF48BC8F1C85B5EF0C47B86DF3CE4518B00

Function 00007FF8B78288C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FF8B78288E6
_Py_Dealloc.PYTHON310 ref: 00007FF8B782890B

Strings

'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted, xrefs: 00007FF8B78288DC
str or None, xrefs: 00007FF8B7828953

Memory Dump Source

Source File: 00000002.00000002.2237255441.00007FF8B7821000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8B7820000, based on PE: true

Associated: 00000002.00000002.2237222809.00007FF8B7820000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237289405.00007FF8B7835000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237332601.00007FF8B783B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.2237368731.00007FF8B783F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b7820000_builded.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted$str or None
API String ID: 1259552197-1607602726
Opcode ID: 4125b2f59b352141277054c037225919fec23e0b35bf6ff3d99e9ad912687951
Instruction ID: 59afeb1525ed592e98c5b2f4b7f3b645e3025d7a63ff5284e6b3186aea9fcf1b
Opcode Fuzzy Hash: 4125b2f59b352141277054c037225919fec23e0b35bf6ff3d99e9ad912687951
Instruction Fuzzy Hash: 6A117022B18B4682EE548B6DF55027D6760FF88BD5F585231EB1D477B4EE2CE4508308

Function 00007FF8B619C8B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8B619C8D3
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8B619C8E5
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B619C91C

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B619C8FD

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_numL_sk_valueR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2441919041-1080266419
Opcode ID: ab69d39137ff3652811595b6eff4b64ae57194bf54768d7353638117b07989fd
Instruction ID: 9bbbb680f4e98c41cd0deecd673ed1a55774729a38217b31434da2f5fc2044df
Opcode Fuzzy Hash: ab69d39137ff3652811595b6eff4b64ae57194bf54768d7353638117b07989fd
Instruction Fuzzy Hash: 4801A721F0C65281F7649B6DF04126A52A0EF857C4F6440B1EF9D97BDADE3DE9428700

Function 00007FF8B61718B6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8B61C61F8
EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FF8B61C624D

Strings

l, xrefs: 00007FF8B61C6256
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8B61C6216

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: X_copy_exX_new
String ID: ..\s\ssl\statem\statem_lib.c$l
API String ID: 1626106133-3956761411
Opcode ID: 13850c50a85e1ba9e6398759b71311cd0572c899ca6984502e16fcf263f25ccb
Instruction ID: 5681754947e2aa6a2c09f796905fb8894aab244892e8479cbf716d955958d0f0
Opcode Fuzzy Hash: 13850c50a85e1ba9e6398759b71311cd0572c899ca6984502e16fcf263f25ccb
Instruction Fuzzy Hash: 5E01F1A1B0A20285FBA09B39C4103BD36A4DF44BC8F0844B0EF4C8A781EF2CE5858B05

Function 00007FF7A3B3C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7A3B3C68F
WriteFile.KERNEL32 ref: 00007FF7A3B3C957
WriteFile.KERNEL32 ref: 00007FF7A3B3C99D
GetLastError.KERNEL32 ref: 00007FF7A3B3CA53

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 97c9252dc580f2e7a38fda5d3af445bd9e7e9fe503792695819b16e9dd43d11b
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 65D15672B09A908AE754DFB4D4401ACB7B2FB04798B818235CE9DA7FA9DE3DD406C710

Function 00007FF7A3B3CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B3CFBB), ref: 00007FF7A3B3D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B3CFBB), ref: 00007FF7A3B3D177

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: dd5283ee3991216c8abba2e56d138b5151f7218a88af6b87100fcd2c8eb3618d
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 5E910832F1976185F794AF6598402BCABA2AB40B84F954139DE8E77EA4CF3ED441C720

Function 00007FF8A84F1FE0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84F2018
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A84F2036

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A84F202C
HANGUL SYLLABLE , xrefs: 00007FF8A84F2005

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: b4ef4179bf0a52eb89c3ccaad0542fa4ed29e9dc5726da8d4cf56c5f82179dfe
Instruction ID: afd79c7b96adb3171c599b9f64c93a4a14d467576e85d377b55d3a1162217e0b
Opcode Fuzzy Hash: b4ef4179bf0a52eb89c3ccaad0542fa4ed29e9dc5726da8d4cf56c5f82179dfe
Instruction Fuzzy Hash: 75612632B1B65266E6648E19A90067A76A2FF80FC0F044239FA5D877C9DFBCDD05C718

Function 00007FF7A3B3F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7A3B3FAEC
_get_daylight.LIBCMT ref: 00007FF7A3B3FAFD
_get_daylight.LIBCMT ref: 00007FF7A3B3FB0E
_isindst.LIBCMT ref: 00007FF7A3B3FBD9

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 98f28aa6dd58ed946582f0688e33363d78f690e73e6a08554a631d900b9d3c91
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 1D513B72F0652186FB58EF2899516BCA763AB10358F920136DD5E63EF5EF3DA401C710

Function 00007FF7A3B357EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7A3B3581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7A3B35881
GetLastError.KERNEL32 ref: 00007FF7A3B35912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A3B35724), ref: 00007FF7A3B3595E

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 807ebeca4c7bcb8acf9fb6a2a0a1f33daea53434aebb29fa93c05d8e4440eb87
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 9251E322E052518AFB98EF71D4543BD63A2AB44B58F564536DE8D67EA8DF3DD0408320

Function 00007FF7A3B2D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A3B2D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF7A3B2D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF7A3B2D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7A3B2D0D6

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: ce0a79b17b906597ea7843ed9e6c2702f6d943e911a0bcc315884647b985ed4c
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: D5118822B15B05CAFB80EF70E8452A973A0FB08718F840E31DAAD927A4DF38D0548390

Function 00007FF8B61915D0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

OPENSSL_sk_dup.LIBCRYPTO-1_1(00000000,00007FF8B6190B9A), ref: 00007FF8B61915E9
OPENSSL_sk_free.LIBCRYPTO-1_1(00000000,00007FF8B6190B9A), ref: 00007FF8B6191604
OPENSSL_sk_set_cmp_func.LIBCRYPTO-1_1(00000000,00007FF8B6190B9A), ref: 00007FF8B6191616
OPENSSL_sk_sort.LIBCRYPTO-1_1(00000000,00007FF8B6190B9A), ref: 00007FF8B619161E

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: L_sk_dupL_sk_freeL_sk_set_cmp_funcL_sk_sort
String ID:
API String ID: 1312970346-0
Opcode ID: 598c8e5cd6d05e11fd804926a84d7090815e485e0f8fd6f07b8beb3cf62fd99c
Instruction ID: afa8cf32c222d9b0331ed41b98405b01804c4997b6290bec6a100c949eb20d71
Opcode Fuzzy Hash: 598c8e5cd6d05e11fd804926a84d7090815e485e0f8fd6f07b8beb3cf62fd99c
Instruction Fuzzy Hash: C6F08262F0964181EA50EB2EF19227C52609F88BC4F4840B1FF0D4778AEE2CE4914700

Function 00007FF7A3B45B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A3B417D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B41803

_get_daylight.LIBCMT ref: 00007FF7A3B45CA4
_get_daylight.LIBCMT ref: 00007FF7A3B45CB5

Strings

?, xrefs: 00007FF7A3B45C35

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: b754ec3cff778f279a54610a46712aa21427f3d1f85a6ef5ad805f537329bb12
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: 3C417B12A0AA8642F7A4EF259401379D652EF80BA4F954236EEDC12AF6DF3ED040C714

Function 00007FF8B6171816 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8B61C2628
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8B61C2753

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8B61C25A9

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_ctrlmemcpy
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 2266715306-3140652063
Opcode ID: 454f2e2bc751be56a71d20967ac394b9c1a8524ba71c113b4090cf56ead37efd
Instruction ID: 35669d173ff8ae2397cd889159fc8a92e29a01738f68585eabd48d847738f7f3
Opcode Fuzzy Hash: 454f2e2bc751be56a71d20967ac394b9c1a8524ba71c113b4090cf56ead37efd
Instruction Fuzzy Hash: 2A514876204BC096D794DF25E5847AEBBA8FB88B90F104026EF9C87755DF78E0A5C700

Function 00007FF7A3B39084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B390B6

Part of subcall function 00007FF7A3B3A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9CE
Part of subcall function 00007FF7A3B3A9B8: GetLastError.KERNEL32(?,?,?,00007FF7A3B42D92,?,?,?,00007FF7A3B42DCF,?,?,00000000,00007FF7A3B43295,?,?,?,00007FF7A3B431C7), ref: 00007FF7A3B3A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7A3B2CC15), ref: 00007FF7A3B390D4

Strings

C:\Users\user\Desktop\builded.exe, xrefs: 00007FF7A3B390C2

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\builded.exe
API String ID: 3580290477-3059520164
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 8b647c6e1be784f76e23b3b4dd09b9445e77fa43f6ac83a45dbf65d0c43d5752
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: 37419635A0AB2289F798FF25A4401BCB7A6EB447C0BD64035E98D67FA5DF3EE4418310

Function 00007FF7A3B3CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7A3B3CDBF
GetLastError.KERNEL32 ref: 00007FF7A3B3CDE1

Strings

U, xrefs: 00007FF7A3B3CD6B

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: a800494ad174def5a51bd4159de8a0fe1e05862edc97d9ae002e485caf732ca1
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: D741D432B19A9181EBA0EF65E4443B9A761FB88784F814131EE8D97BA8EF3DD401C750

Function 00007FF8B617157D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A0EB8

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A0E0E, 00007FF8B61A0EA7

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 1767461275-2723262194
Opcode ID: 2d0c198d04c162e8d379b8396a8e76b04b6fe425097c24de9c8a53ead9ebc494
Instruction ID: dea2bfc1d835a3942b9a777e0976a0de458544cf163d380c2d0ad7ced299056c
Opcode Fuzzy Hash: 2d0c198d04c162e8d379b8396a8e76b04b6fe425097c24de9c8a53ead9ebc494
Instruction Fuzzy Hash: 15318D71708B8286EB64CF0AD8102A9A668FB88BC9F544075DF9D87B95DF3DEA01D700

Function 00007FF8B6176560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8B61765AD
SystemTimeToFileTime.KERNEL32 ref: 00007FF8B61765BD

Strings

gfff, xrefs: 00007FF8B61765EF

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 12c171fb7924123b845f0450224228a85476b6b386dcff7bd870e799389df5a1
Instruction ID: 43c236b69d51385490c3375a2cc935b5514b3a6589c6f07b5f1fc2c74aac0a38
Opcode Fuzzy Hash: 12c171fb7924123b845f0450224228a85476b6b386dcff7bd870e799389df5a1
Instruction Fuzzy Hash: 042182B2A0868786EB548F2DE5503797BE1EB88BD8F448075EB4DC7755DE3CD6418700

Function 00007FF7A3B3F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A3B3F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7A3B3F6BA

Strings

:, xrefs: 00007FF7A3B3F67E

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction ID: a2f69d312bd63d49a7180fa1d1f7cfe748b2af91fc9b9e43f3015c3d6386025d
Opcode Fuzzy Hash: 779a21297323b81187f7e0c7d27b40be9ec8fbab2d126766b2de98969da868de
Instruction Fuzzy Hash: 3C21F722A0969182FBA4AF15D04426DB3B3FB84B84FD64036D6CD63EA4DF7ED944C760

Function 00007FF8B61717A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8B6188592
RAND_bytes.LIBCRYPTO-1_1 ref: 00007FF8B61885C0

Strings

DOWNGRD, xrefs: 00007FF8B61885F6

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: D_bytes_time64
String ID: DOWNGRD
API String ID: 3543108242-2922851170
Opcode ID: 12e017e5c1d57c15a0fa21407ca3c5bc420114fa899af10fbec8bb9e133dde29
Instruction ID: 6dfefa608415dca7686d751da009a6c49209eabfe3ae7556af0312da37b90df3
Opcode Fuzzy Hash: 12e017e5c1d57c15a0fa21407ca3c5bc420114fa899af10fbec8bb9e133dde29
Instruction Fuzzy Hash: 9D21A522F2868297E79C872DA56107D63A1EB943C0F544079EB1F87786DE28E8A5C700

Function 00007FF8B617167C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8B61CB3D3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 0-348624464
Opcode ID: feb43a3405793f7ca82caf4e42325958333485d8d80e463f293775f007369bbd
Instruction ID: 90bd471e9bd190bdcdd5f8de6d9b86028e2f0c4350f9668b52e7bd34f20487c7
Opcode Fuzzy Hash: feb43a3405793f7ca82caf4e42325958333485d8d80e463f293775f007369bbd
Instruction Fuzzy Hash: A021F532B0824286E760DB59E4547BC3B94FB89394F948071EB4CCB792CE7DE585CB04

Function 00007FF8B61968E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6196988
memcpy.VCRUNTIME140 ref: 00007FF8B61969B2

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6196978

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_errormemcpy
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1385177007-1080266419
Opcode ID: 651fb27223c33793b3b525ad746924232991010c3660fc8222ecdac9da7829f9
Instruction ID: 178e749c0228262c7d99249118b3a33300d2418f3bffc067befb43f1ef749250
Opcode Fuzzy Hash: 651fb27223c33793b3b525ad746924232991010c3660fc8222ecdac9da7829f9
Instruction Fuzzy Hash: 9E2190B2B0468196EB94DF29E4403ACA3A0FB48BC4F488075DF5D87795DF38E8A18720

Function 00007FF8B61718A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6177246
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6177278

Strings

..\s\ssl\d1_msg.c, xrefs: 00007FF8B6177236, 00007FF8B6177268

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\d1_msg.c
API String ID: 1767461275-424620239
Opcode ID: 91bae8b8feed8e6850f30c168b9dcf2da964c9ddd4befaa4290ec12815672435
Instruction ID: 1609289d952452d95840c7a67457ca95b9c2fc1f38651dec4a02d2bda588893d
Opcode Fuzzy Hash: 91bae8b8feed8e6850f30c168b9dcf2da964c9ddd4befaa4290ec12815672435
Instruction Fuzzy Hash: EB113071A0864696E2209F69A8002B96760BF85BE4F6402B1FFAD47BD9DF3CE5448B10

Function 00007FF8B6184880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_write.LIBCRYPTO-1_1 ref: 00007FF8B61848F6
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8B6184913

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FF8B61848C3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: DigestO_writeUpdate
String ID: ..\s\ssl\s3_enc.c
API String ID: 1267058251-1839494539
Opcode ID: c4fe130afb9933a6c48cc054d916e2332491db211b7801996051882dd3acb78c
Instruction ID: e100ba5353f9811fdfe39013ae56f3215660b861ae7ca089cde2dc2325a31b57
Opcode Fuzzy Hash: c4fe130afb9933a6c48cc054d916e2332491db211b7801996051882dd3acb78c
Instruction Fuzzy Hash: 5B11A032F0C64145FB709B59E54037D27A0EB89BD4F184172EF5C97796DE2CD5429B00

Function 00007FF7A3B2FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7A3B2FE08
RaiseException.KERNEL32 ref: 00007FF7A3B2FE49

Strings

csm, xrefs: 00007FF7A3B2FE36

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: a2c359cddbdd7a7450ccb7e33ddbfb3309b2d44bae56f35279c8d796e1ee927c
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 45115B32609B8582EBA1DF25F40026AB7E1FB88B84F994231DBCD17769DF3DD5518B00

Function 00007FF8B6171694 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B61A157A
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8B61A15A0

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8B61A155F

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_errorY_free
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 3485142574-2723262194
Opcode ID: 76a690a06073b4ae387dbcc6038ffaf8cf6d72af440c21cfccd437a65400e1a2
Instruction ID: f10484e88f7db6accccd1ab1dac6fd5fa2bd02f82f628beee4efacfe327c1125
Opcode Fuzzy Hash: 76a690a06073b4ae387dbcc6038ffaf8cf6d72af440c21cfccd437a65400e1a2
Instruction Fuzzy Hash: 0A01F762B0D68686E7409B38F4461EEA7A0EB88BC4F888070EF4D47B86DF3CD4018B00

Function 00007FF7A3B407AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7A3B407DC
GetDriveTypeW.KERNEL32 ref: 00007FF7A3B4081C

Strings

:, xrefs: 00007FF7A3B40805

Memory Dump Source

Source File: 00000002.00000002.2232907044.00007FF7A3B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A3B20000, based on PE: true

Associated: 00000002.00000002.2232873287.00007FF7A3B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2232966529.00007FF7A3B4B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233015483.00007FF7A3B61000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2233092944.00007FF7A3B64000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7a3b20000_builded.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: ed59c37109db945ea4bfcff21c099e1cafeb23a3d5449d0ba034455fa7f7c1c8
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: CB01A72291E20386F7A4BF60946627EE3A1EF44744FC60136D5CD62AA1DF3EE5048B39

Function 00007FF8A84F4F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON310 ref: 00007FF8A84F4F80
PyUnicode_FromString.PYTHON310 ref: 00007FF8A84F4F97

Strings

no such name, xrefs: 00007FF8A84F4F76

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 7a6655aafa68cf14d7b49650addb67a30f8bbda1d9d2751e0c3041d150185062
Instruction ID: af1898ba6fd71788a85ea68475b9de26aaef37e63321aba0d7decc188d3e16ba
Opcode Fuzzy Hash: 7a6655aafa68cf14d7b49650addb67a30f8bbda1d9d2751e0c3041d150185062
Instruction Fuzzy Hash: 56016D31A1BA42A1FB609B61E8103B523A0FF98FC9F404039DE4E46251DFACE8058728

Function 00007FF8B61B96DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8B61B94AB
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8B61B94B8

Strings

), xrefs: 00007FF8B61B96E3

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: )
API String ID: 3946675294-2427484129
Opcode ID: 1eb223866b316573cd142b8d4a18707288d03e927f3d6e88cab935a0b9264f15
Instruction ID: a96088e3384e8f04129e6a099070516cbf6223e060b8866c8e269687d049f6af
Opcode Fuzzy Hash: 1eb223866b316573cd142b8d4a18707288d03e927f3d6e88cab935a0b9264f15
Instruction Fuzzy Hash: 1FF06262B0868186EB51DF1DE0443BD23A1EB86BD8F5841B4CB5D0B786DE7DD4868700

Function 00007FF8B61B9332 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8B61B94AB
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8B61B94B8

Strings

&, xrefs: 00007FF8B61B933B

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: &
API String ID: 3946675294-1010288
Opcode ID: bce02d8370a62550a3fd7c5583aeeedfee2178cd3a4eb7ae605b0b13832dd0b6
Instruction ID: 9e437dfc9076e241f850117961a385ad08a4d6241ca79a0d37045811f3d53cf3
Opcode Fuzzy Hash: bce02d8370a62550a3fd7c5583aeeedfee2178cd3a4eb7ae605b0b13832dd0b6
Instruction Fuzzy Hash: CDF09662B0864185EB50DF2DE0843BD23A0EB86BD8F5C41B4CB0D0B786CE7DD4868700

Function 00007FF8B617254A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8B6195BFE
memcpy.VCRUNTIME140 ref: 00007FF8B6195C1B

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8B6195BF0

Memory Dump Source

Source File: 00000002.00000002.2236943283.00007FF8B6171000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF8B6170000, based on PE: true

Associated: 00000002.00000002.2236911736.00007FF8B6170000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2236943283.00007FF8B61E3000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237039813.00007FF8B61E5000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237083589.00007FF8B6208000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B620D000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B6213000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2237116189.00007FF8B621A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8b6170000_builded.jbxd

Similarity

API ID: R_put_errormemcpy
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1385177007-1080266419
Opcode ID: 303f916de64884449533dbb62141de63a43bbc37be1bae7fd60e0ed3c3be0864
Instruction ID: 73b450d3f99a6ec43bbf67bd6adcb65ef4cfe4fe5341ed33f0400246c38b5871
Opcode Fuzzy Hash: 303f916de64884449533dbb62141de63a43bbc37be1bae7fd60e0ed3c3be0864
Instruction Fuzzy Hash: B6E06561F1405A86E770AB6894067E927A0EB40380F900170E70D46691DE6E6657CB00

Function 00007FF8A84F2650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A84F2563), ref: 00007FF8A84F2656
PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A84F2563), ref: 00007FF8A84F2688

Strings

3.2.0, xrefs: 00007FF8A84F2664

Memory Dump Source

Source File: 00000002.00000002.2233214674.00007FF8A84F1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A84F0000, based on PE: true

Associated: 00000002.00000002.2233136958.00007FF8A84F0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A84F6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A8552000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A859E000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85A2000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233260599.00007FF8A85FB000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233636447.00007FF8A85FF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000002.00000002.2233672830.00007FF8A8601000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a84f0000_builded.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 69c2b4e3579cbbdfeaa96c61cbd88fc537ba55c567b2cadc9d0896fd70d47e88
Instruction ID: 53305d370049128a37fe2a3716b78b24f68a6fcd090eff193a22a258087c15ae
Opcode Fuzzy Hash: 69c2b4e3579cbbdfeaa96c61cbd88fc537ba55c567b2cadc9d0896fd70d47e88
Instruction Fuzzy Hash: A8E07575A0BB12A1FB158B61A84506432A4FF08F95F54013DCD9D02360EFBCE9A4C368

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report builded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_des3.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ecb.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_eksblowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI47442\Crypto\Cipher\_raw_ocb.pyd

Windows Analysis Report
builded.exe