Edit tour

Windows Analysis Report
wsx.exe

Overview

General Information

Sample name:	wsx.exe
Analysis ID:	1523266
MD5:	bfbefe6213ea9b1d3d0f92c970998d80
SHA1:	db7863df94867d3522c47ab417437e0e8c81b124
SHA256:	c337e536bb2195ad30d214fee810360815797a4e3bd91a7d88949e4df6948791
Tags:	exeuser-Porcupine
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Potentially malicious time measurement code found

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses schtasks.exe or at.exe to add and modify task schedules

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

wsx.exe (PID: 6056 cmdline: "C:\Users\user\Desktop\wsx.exe" MD5: BFBEFE6213EA9B1D3D0F92C970998D80)

wsx.exe (PID: 2132 cmdline: "C:\Users\user\Desktop\wsx.exe" MD5: BFBEFE6213EA9B1D3D0F92C970998D80)

cmd.exe (PID: 6648 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3836 cmdline: schtasks /query /tn "registry_65f93d51.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 5340 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1868 cmdline: schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

registry_65f93d51.exe (PID: 1892 cmdline: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe MD5: BFBEFE6213EA9B1D3D0F92C970998D80)

registry_65f93d51.exe (PID: 5064 cmdline: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe MD5: BFBEFE6213EA9B1D3D0F92C970998D80)

cmd.exe (PID: 6584 cmdline: C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7108 cmdline: schtasks /query /tn "registry_65f93d51.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f", CommandLine: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\wsx.exe", ParentImage: C:\Users\user\Desktop\wsx.exe, ParentProcessId: 2132, ParentProcessName: wsx.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f", ProcessId: 5340, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f, CommandLine: schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5340, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f, ProcessId: 1868, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wsx.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93001F0 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	2_2_00007FF8A93001F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9313410 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	2_2_00007FF8A9313410
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F18CF CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F18CF
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1357 memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F1357
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9356AC0 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A9356AC0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930A970 CRYPTO_THREAD_run_once,	2_2_00007FF8A930A970
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2252 BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FF8A92F2252
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9314900 X509_VERIFY_PARAM_free,CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A9314900
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A931C9D0 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8A931C9D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9322C70 CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A9322C70
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F17B7 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A92F17B7
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1FB9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	2_2_00007FF8A92F1FB9
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F8B20 CRYPTO_free,	2_2_00007FF8A92F8B20
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930CB50 CRYPTO_get_ex_new_index,	2_2_00007FF8A930CB50
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9346B00 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,EVP_PKEY_id,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	2_2_00007FF8A9346B00
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933ABF0 memset,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A933ABF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F6BE0 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8A92F6BE0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1230 memcpy,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,memcmp,_time64,	2_2_00007FF8A92F1230
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A931CB90 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,ERR_put_error,EVP_PKEY_free,X509_get0_pubkey,X509_free,OPENSSL_sk_push,ERR_put_error,X509_free,ERR_put_error,	2_2_00007FF8A931CB90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930CBB0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A930CBB0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F8E30 CRYPTO_malloc,ERR_put_error,	2_2_00007FF8A92F8E30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9340E00 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A9340E00
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FEE90 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	2_2_00007FF8A92FEE90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930EE80 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_flags,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,	2_2_00007FF8A930EE80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9326D50 CRYPTO_free,	2_2_00007FF8A9326D50
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9340D60 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A9340D60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F22DE ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F22DE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2545 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	2_2_00007FF8A92F2545
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9326DC0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8A9326DC0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F172B CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A92F172B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1BF9 ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	2_2_00007FF8A92F1BF9
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1B5E EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A92F1B5E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933D040 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A933D040
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F228E CRYPTO_free,	2_2_00007FF8A92F228E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2261 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A92F2261
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9307093 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A9307093
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A932F080 CRYPTO_realloc,	2_2_00007FF8A932F080
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F23EC CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	2_2_00007FF8A92F23EC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9337090 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A9337090
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1DAC CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F1DAC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933AF60 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A933AF60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1B4A CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	2_2_00007FF8A92F1B4A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9306F93 CRYPTO_free,CRYPTO_strdup,ERR_put_error,ERR_put_error,	2_2_00007FF8A9306F93
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9328FF0 EVP_MD_size,EVP_MD_CTX_new,EVP_DigestInit_ex,EVP_DigestFinal_ex,EVP_DigestInit_ex,BIO_ctrl,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key,EVP_DigestSignInit,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_memcmp,OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,	2_2_00007FF8A9328FF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F109B CRYPTO_free,CRYPTO_memdup,CRYPTO_memdup,	2_2_00007FF8A92F109B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93062B0 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A93062B0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93242D0 OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	2_2_00007FF8A93242D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F17D5 CRYPTO_malloc,memcpy,	2_2_00007FF8A92F17D5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93482E0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A93482E0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F16B8 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,EVP_PKEY_missing_parameters,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	2_2_00007FF8A92F16B8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FE100 CRYPTO_free,	2_2_00007FF8A92FE100
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9324110 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8A9324110
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FE1B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A92FE1B0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1D52 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	2_2_00007FF8A92F1D52
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9308180 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A9308180
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9316190 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	2_2_00007FF8A9316190
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F4437 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FF8A92F4437
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9312450 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A9312450
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1514 CRYPTO_free,	2_2_00007FF8A92F1514
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F225C CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8A92F225C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9308420 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8A9308420
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1CE4 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F1CE4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93044F0 CRYPTO_clear_free,	2_2_00007FF8A93044F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933848F CRYPTO_malloc,	2_2_00007FF8A933848F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9324490 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	2_2_00007FF8A9324490
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A934A35C CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A934A35C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1E60 CRYPTO_clear_free,	2_2_00007FF8A92F1E60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93283F0 CRYPTO_zalloc,CRYPTO_free,	2_2_00007FF8A93283F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FE3F0 CRYPTO_malloc,	2_2_00007FF8A92FE3F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93063EA CRYPTO_free,	2_2_00007FF8A93063EA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93303A0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A93303A0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2310 CRYPTO_free,	2_2_00007FF8A92F2310
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1F9B CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	2_2_00007FF8A92F1F9B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F4660 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FF8A92F4660
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2149 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	2_2_00007FF8A92F2149
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F8640 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	2_2_00007FF8A92F8640
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1500 CRYPTO_free,CRYPTO_memdup,ERR_put_error,	2_2_00007FF8A92F1500
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933C6C0 CRYPTO_malloc,	2_2_00007FF8A933C6C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1F78 CRYPTO_strdup,	2_2_00007FF8A92F1F78
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1B18 memset,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	2_2_00007FF8A92F1B18
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F15CD EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,DH_free,EVP_PKEY_security_bits,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestSign,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8A92F15CD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FE510 CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A92FE510
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1EB5 CRYPTO_strdup,CRYPTO_free,	2_2_00007FF8A92F1EB5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933C510 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A933C510
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1B95 CRYPTO_free,CRYPTO_malloc,	2_2_00007FF8A92F1B95
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1208 CRYPTO_zalloc,memcpy,memcpy,memcpy,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F1208
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F8590 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A92F8590
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933A5E0 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8A933A5E0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9330590 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A9330590
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F19EC CRYPTO_malloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A92F19EC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1AB9 CRYPTO_free,	2_2_00007FF8A92F1AB9
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93485A0 CRYPTO_malloc,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	2_2_00007FF8A93485A0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F19BA CRYPTO_malloc,	2_2_00007FF8A92F19BA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9308870 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FF8A9308870
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1C26 EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	2_2_00007FF8A92F1C26
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A931C8E0 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A931C8E0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F250E CRYPTO_free,	2_2_00007FF8A92F250E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A931C740 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	2_2_00007FF8A931C740
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1EAB CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A92F1EAB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1249 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,memcpy,	2_2_00007FF8A92F1249
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9342730 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,memcpy,memcpy,	2_2_00007FF8A9342730
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93387CE CRYPTO_free,CRYPTO_free,	2_2_00007FF8A93387CE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9358780 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	2_2_00007FF8A9358780
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933A7B0 EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	2_2_00007FF8A933A7B0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1D8E BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A92F1D8E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1870 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F1870
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2095 CRYPTO_free,_time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,	2_2_00007FF8A92F2095
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1686 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F1686
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A932FAF0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A932FAF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A934FAF0 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A934FAF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1C0D CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A92F1C0D
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F215D CRYPTO_free,CRYPTO_malloc,RAND_bytes,	2_2_00007FF8A92F215D
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F218F EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8A92F218F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F125D BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A92F125D
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F193A CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F193A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1663 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F1663
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933FC60 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A933FC60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F24D2 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_memcmp,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	2_2_00007FF8A92F24D2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F20F4 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8A92F20F4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F12E4 EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F12E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F101E EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8A92F101E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930FB30 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	2_2_00007FF8A930FB30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9311BD0 CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A9311BD0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9329B90 CRYPTO_memcmp,	2_2_00007FF8A9329B90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1ABE CONF_parse_list,CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F1ABE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F7BD0 CRYPTO_free,	2_2_00007FF8A92F7BD0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F7E20 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A92F7E20
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930DE70 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8A930DE70
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1CD5 CRYPTO_malloc,COMP_expand_block,	2_2_00007FF8A92F1CD5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F150A CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	2_2_00007FF8A92F150A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9329E30 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A9329E30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9337EC7 CRYPTO_clear_free,	2_2_00007FF8A9337EC7
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9305E80 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	2_2_00007FF8A9305E80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1E6A CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	2_2_00007FF8A92F1E6A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9313D40 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A9313D40
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F7D20 CRYPTO_free,	2_2_00007FF8A92F7D20
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9347D00 CRYPTO_memcmp,	2_2_00007FF8A9347D00
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1104 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8A92F1104
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F22CA ERR_put_error,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A92F22CA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A932FDC0 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A932FDC0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1F28 CRYPTO_free,CRYPTO_malloc,memcpy,	2_2_00007FF8A92F1F28
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F16E5 CRYPTO_zalloc,	2_2_00007FF8A92F16E5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930DD80 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	2_2_00007FF8A930DD80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930FDA0 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	2_2_00007FF8A930FDA0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A932A050 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A932A050
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9330070 CRYPTO_memcmp,	2_2_00007FF8A9330070
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F405B BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	2_2_00007FF8A92F405B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93480C0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A93480C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FE0A0 CRYPTO_free,	2_2_00007FF8A92FE0A0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930E0B0 CRYPTO_THREAD_run_once,	2_2_00007FF8A930E0B0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1F01 CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	2_2_00007FF8A92F1F01
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A935BF20 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,	2_2_00007FF8A935BF20
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F7F80 CRYPTO_zalloc,ERR_put_error,	2_2_00007FF8A92F7F80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F9FF0 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F9FF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FDFF0 CRYPTO_free,	2_2_00007FF8A92FDFF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9341F80 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	2_2_00007FF8A9341F80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930BFB0 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	2_2_00007FF8A930BFB0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9309FB0 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A9309FB0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9327270 CRYPTO_free,	2_2_00007FF8A9327270
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A934D230 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A934D230
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A932F2C0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A932F2C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A934F2D0 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	2_2_00007FF8A934F2D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A933B2E0 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8A933B2E0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F23DD CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F23DD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9325120 CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	2_2_00007FF8A9325120
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F191F ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,CRYPTO_dup_ex_data,BIO_ctrl,BIO_ctrl,BIO_up_ref,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FF8A92F191F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93231F0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	2_2_00007FF8A93231F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F24D7 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	2_2_00007FF8A92F24D7
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F207C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,memset,	2_2_00007FF8A92F207C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9327460 CRYPTO_free,	2_2_00007FF8A9327460
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93274D0 CRYPTO_free,	2_2_00007FF8A93274D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9309480 ASN1_item_d2i,ERR_put_error,ASN1_item_free,memcpy,_time64,X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	2_2_00007FF8A9309480
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F141F EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	2_2_00007FF8A92F141F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F18BB CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,memset,	2_2_00007FF8A92F18BB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F17A3 CRYPTO_free,	2_2_00007FF8A92F17A3
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1005 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	2_2_00007FF8A92F1005
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9327310 CRYPTO_free,CRYPTO_free,	2_2_00007FF8A9327310
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2144 EVP_MD_CTX_new,EVP_MD_CTX_copy_ex,CRYPTO_memcmp,memcpy,memcpy,	2_2_00007FF8A92F2144
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9337320 CRYPTO_free,CRYPTO_strndup,	2_2_00007FF8A9337320
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1253 CRYPTO_free,	2_2_00007FF8A92F1253
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A931D3C0 CRYPTO_malloc,CRYPTO_clear_free,	2_2_00007FF8A931D3C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93193D0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8A93193D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93433D0 CRYPTO_malloc,memcpy,	2_2_00007FF8A93433D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1028 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	2_2_00007FF8A92F1028
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F231A CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8A92F231A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1A0A EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	2_2_00007FF8A92F1A0A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2446 CRYPTO_free,CRYPTO_memdup,ERR_put_error,	2_2_00007FF8A92F2446
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9357650 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	2_2_00007FF8A9357650
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F24AF CRYPTO_free,CRYPTO_malloc,memcpy,	2_2_00007FF8A92F24AF
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1C44 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	2_2_00007FF8A92F1C44
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9319630 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FF8A9319630
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F10A5 CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	2_2_00007FF8A92F10A5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A901F0 EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,strncmp,strncmp,strncmp,strncmp,strncmp,	10_2_00007FF8A7A901F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA3410 ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	10_2_00007FF8A7AA3410
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8250E CRYPTO_free,	10_2_00007FF8A7A8250E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AAC8E0 CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7AAC8E0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A98870 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	10_2_00007FF8A7A98870
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81C26 EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,	10_2_00007FF8A7A81C26
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A819BA CRYPTO_malloc,	10_2_00007FF8A7A819BA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACA7B0 EVP_DigestUpdate,EVP_MD_CTX_free,EVP_PKEY_CTX_free,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	10_2_00007FF8A7ACA7B0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AE8780 HMAC_CTX_new,EVP_CIPHER_CTX_new,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,	10_2_00007FF8A7AE8780
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC87CE CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7AC87CE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD2730 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,memcpy,memcpy,	10_2_00007FF8A7AD2730
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81249 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,memcpy,	10_2_00007FF8A7A81249
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81EAB CRYPTO_memcmp,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7A81EAB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AAC740 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	10_2_00007FF8A7AAC740
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A815CD EVP_MD_CTX_new,EVP_PKEY_new,EVP_PKEY_assign,DH_free,EVP_PKEY_security_bits,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_key,EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,EVP_PKEY_size,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestSign,CRYPTO_free,EVP_MD_CTX_free,	10_2_00007FF8A7A815CD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81B18 memset,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,CRYPTO_memcmp,	10_2_00007FF8A7A81B18
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81F78 CRYPTO_strdup,	10_2_00007FF8A7A81F78
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACC6C0 CRYPTO_malloc,	10_2_00007FF8A7ACC6C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81500 CRYPTO_free,CRYPTO_memdup,ERR_put_error,	10_2_00007FF8A7A81500
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82149 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	10_2_00007FF8A7A82149
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81F9B CRYPTO_free,BIO_clear_flags,BIO_set_flags,BIO_snprintf,ERR_add_error_data,memcpy,	10_2_00007FF8A7A81F9B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A84660 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	10_2_00007FF8A7A84660
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A88640 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,	10_2_00007FF8A7A88640
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A819EC CRYPTO_malloc,ERR_put_error,CRYPTO_free,	10_2_00007FF8A7A819EC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81AB9 CRYPTO_free,	10_2_00007FF8A7A81AB9
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD85A0 CRYPTO_malloc,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,RAND_bytes,EVP_sha256,EVP_EncryptUpdate,EVP_EncryptFinal,HMAC_Update,HMAC_Final,	10_2_00007FF8A7AD85A0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A88590 CRYPTO_zalloc,ERR_put_error,	10_2_00007FF8A7A88590
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC0590 CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7AC0590
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACA5E0 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,	10_2_00007FF8A7ACA5E0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81208 CRYPTO_zalloc,memcpy,memcpy,memcpy,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A81208
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81B95 CRYPTO_free,CRYPTO_malloc,	10_2_00007FF8A7A81B95
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8E510 CRYPTO_free,CRYPTO_malloc,	10_2_00007FF8A7A8E510
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACC510 EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ACC510
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81EB5 CRYPTO_strdup,CRYPTO_free,	10_2_00007FF8A7A81EB5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB4490 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,	10_2_00007FF8A7AB4490
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC848F CRYPTO_malloc,	10_2_00007FF8A7AC848F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A944F0 CRYPTO_clear_free,	10_2_00007FF8A7A944F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81CE4 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A81CE4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A84437 CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	10_2_00007FF8A7A84437
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A98420 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,	10_2_00007FF8A7A98420
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81514 CRYPTO_free,	10_2_00007FF8A7A81514
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8225C CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error,	10_2_00007FF8A7A8225C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA2450 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	10_2_00007FF8A7AA2450
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC03A0 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7AC03A0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82310 CRYPTO_free,	10_2_00007FF8A7A82310
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8E3F0 CRYPTO_malloc,	10_2_00007FF8A7A8E3F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB83F0 CRYPTO_zalloc,CRYPTO_free,	10_2_00007FF8A7AB83F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A963EA CRYPTO_free,	10_2_00007FF8A7A963EA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81E60 CRYPTO_clear_free,	10_2_00007FF8A7A81E60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADA35C CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7ADA35C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A962B0 CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A962B0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A817D5 CRYPTO_malloc,memcpy,	10_2_00007FF8A7A817D5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD82E0 CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7AD82E0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB42D0 OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	10_2_00007FF8A7AB42D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8109B CRYPTO_free,CRYPTO_memdup,CRYPTO_memdup,	10_2_00007FF8A7A8109B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8E1B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,	10_2_00007FF8A7A8E1B0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA6190 ERR_put_error,CRYPTO_free,ERR_put_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	10_2_00007FF8A7AA6190
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A98180 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A98180
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81D52 BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,	10_2_00007FF8A7A81D52
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB4110 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	10_2_00007FF8A7AB4110
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8E100 CRYPTO_free,	10_2_00007FF8A7A8E100
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A816B8 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,EVP_PKEY_missing_parameters,X509_free,X509_up_ref,X509_free,OPENSSL_sk_pop_free,	10_2_00007FF8A7A816B8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC7090 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7AC7090
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A97093 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A97093
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ABF080 CRYPTO_realloc,	10_2_00007FF8A7ABF080
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A823EC CRYPTO_free,CRYPTO_malloc,memcmp,CRYPTO_memdup,	10_2_00007FF8A7A823EC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8228E CRYPTO_free,	10_2_00007FF8A7A8228E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82261 CRYPTO_zalloc,ERR_put_error,	10_2_00007FF8A7A82261
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81B5E EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	10_2_00007FF8A7A81B5E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACD040 CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ACD040
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A96F93 CRYPTO_free,CRYPTO_strdup,ERR_put_error,ERR_put_error,	10_2_00007FF8A7A96F93
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB8FF0 EVP_MD_size,EVP_MD_CTX_new,EVP_DigestInit_ex,EVP_DigestFinal_ex,EVP_DigestInit_ex,BIO_ctrl,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key,EVP_DigestSignInit,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_memcmp,OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,	10_2_00007FF8A7AB8FF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81B4A CRYPTO_THREAD_write_lock,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,	10_2_00007FF8A7A81B4A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACAF60 X509_get0_pubkey,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,	10_2_00007FF8A7ACAF60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81DAC CONF_parse_list,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A81DAC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8EE90 EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp,	10_2_00007FF8A7A8EE90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9EE80 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_flags,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,	10_2_00007FF8A7A9EE80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A88E30 CRYPTO_malloc,ERR_put_error,	10_2_00007FF8A7A88E30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD0E00 CRYPTO_malloc,ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	10_2_00007FF8A7AD0E00
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81BF9 ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,OPENSSL_LH_new,OPENSSL_sk_num,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,RAND_bytes,RAND_priv_bytes,RAND_priv_bytes,RAND_priv_bytes,	10_2_00007FF8A7A81BF9
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8172B CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7A8172B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB6DC0 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,	10_2_00007FF8A7AB6DC0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82545 CRYPTO_malloc,ERR_put_error,BIO_snprintf,	10_2_00007FF8A7A82545
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A822DE ERR_put_error,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A822DE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD0D60 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7AD0D60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB6D50 CRYPTO_free,	10_2_00007FF8A7AB6D50
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81FB9 BN_bin2bn,BN_is_zero,CRYPTO_free,CRYPTO_strdup,CRYPTO_clear_free,	10_2_00007FF8A7A81FB9
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A817B7 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	10_2_00007FF8A7A817B7
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB2C70 CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	10_2_00007FF8A7AB2C70
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9CBB0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A9CBB0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81230 memcpy,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,memcmp,_time64,	10_2_00007FF8A7A81230
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AACB90 ERR_put_error,ERR_put_error,ERR_put_error,EVP_MD_size,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_malloc,ERR_put_error,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,ERR_put_error,EVP_PKEY_free,X509_get0_pubkey,X509_free,OPENSSL_sk_push,ERR_put_error,X509_free,ERR_put_error,	10_2_00007FF8A7AACB90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACABF0 memset,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	10_2_00007FF8A7ACABF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A86BE0 CRYPTO_zalloc,CRYPTO_free,	10_2_00007FF8A7A86BE0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A88B20 CRYPTO_free,	10_2_00007FF8A7A88B20
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD6B00 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_id,EVP_PKEY_size,EVP_DigestVerifyInit,EVP_PKEY_id,CRYPTO_malloc,BUF_reverse,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerify,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	10_2_00007FF8A7AD6B00
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9CB50 CRYPTO_get_ex_new_index,	10_2_00007FF8A7A9CB50
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AE6AC0 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7AE6AC0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81357 memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,CRYPTO_free,memcmp,memcmp,memcpy,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A81357
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A818CF CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A818CF
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AAC9D0 ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,ERR_put_error,	10_2_00007FF8A7AAC9D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA4900 X509_VERIFY_PARAM_free,CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	10_2_00007FF8A7AA4900
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9A970 CRYPTO_THREAD_run_once,	10_2_00007FF8A7A9A970
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82252 BIO_s_file,BIO_new,BIO_ctrl,strncmp,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	10_2_00007FF8A7A82252
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA58A7 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	10_2_00007FF8A7AA58A7
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81695 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	10_2_00007FF8A7A81695
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9D820 CRYPTO_THREAD_run_once,	10_2_00007FF8A7A9D820
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81F6E CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A81F6E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81859 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,OPENSSL_cleanse,OPENSSL_cleanse,EVP_MD_size,	10_2_00007FF8A7A81859
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81847 CRYPTO_free,	10_2_00007FF8A7A81847
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82400 CRYPTO_malloc,ERR_put_error,CRYPTO_free,	10_2_00007FF8A7A82400
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AAF730 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	10_2_00007FF8A7AAF730
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB7770 CRYPTO_free,	10_2_00007FF8A7AB7770
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB36F0 CRYPTO_zalloc,ERR_put_error,_time64,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	10_2_00007FF8A7AB36F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A976D0 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,	10_2_00007FF8A7A976D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A810A5 CRYPTO_zalloc,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	10_2_00007FF8A7A810A5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA9630 ERR_put_error,ERR_put_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_put_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	10_2_00007FF8A7AA9630
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81C44 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	10_2_00007FF8A7A81C44
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A824AF CRYPTO_free,CRYPTO_malloc,memcpy,	10_2_00007FF8A7A824AF
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AE7650 CRYPTO_free,CRYPTO_malloc,ERR_put_error,	10_2_00007FF8A7AE7650
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A818C5 ERR_put_error,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A818C5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81B04 CRYPTO_malloc,CRYPTO_mem_ctrl,OPENSSL_sk_find,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,	10_2_00007FF8A7A81B04
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADF5D0 EVP_PKEY_get0_RSA,RSA_size,RSA_size,CRYPTO_malloc,RAND_priv_bytes,CRYPTO_free,	10_2_00007FF8A7ADF5D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AEB5C0 memset,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,memset,	10_2_00007FF8A7AEB5C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADB530 CRYPTO_memcmp,	10_2_00007FF8A7ADB530
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD1520 CRYPTO_free,	10_2_00007FF8A7AD1520
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A89540 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	10_2_00007FF8A7A89540
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A818BB CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,memset,	10_2_00007FF8A7A818BB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A99480 ASN1_item_d2i,ERR_put_error,ASN1_item_free,memcpy,_time64,X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ASN1_item_free,	10_2_00007FF8A7A99480
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8141F EVP_PKEY_get1_tls_encodedpoint,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	10_2_00007FF8A7A8141F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB74D0 CRYPTO_free,	10_2_00007FF8A7AB74D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB7460 CRYPTO_free,	10_2_00007FF8A7AB7460
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82446 CRYPTO_free,CRYPTO_memdup,ERR_put_error,	10_2_00007FF8A7A82446
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8231A CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A8231A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA93D0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	10_2_00007FF8A7AA93D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD33D0 CRYPTO_malloc,memcpy,	10_2_00007FF8A7AD33D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81028 EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_new,RSA_pkey_ctx_ctrl,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_free,	10_2_00007FF8A7A81028
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81A0A EVP_MD_size,EVP_CIPHER_iv_length,EVP_CIPHER_key_length,CRYPTO_clear_free,CRYPTO_malloc,	10_2_00007FF8A7A81A0A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AAD3C0 CRYPTO_malloc,CRYPTO_clear_free,	10_2_00007FF8A7AAD3C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC7320 CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7AC7320
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81253 CRYPTO_free,	10_2_00007FF8A7A81253
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB7310 CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7AB7310
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82144 EVP_MD_CTX_new,EVP_MD_CTX_copy_ex,CRYPTO_memcmp,memcpy,memcpy,	10_2_00007FF8A7A82144
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A817A3 CRYPTO_free,	10_2_00007FF8A7A817A3
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81005 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	10_2_00007FF8A7A81005
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A823DD CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A823DD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACB2E0 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7ACB2E0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADF2D0 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,	10_2_00007FF8A7ADF2D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ABF2C0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ABF2C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADD230 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,CRYPTO_memcmp,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ADD230
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB7270 CRYPTO_free,	10_2_00007FF8A7AB7270
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB31F0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	10_2_00007FF8A7AB31F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A824D7 CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A824D7
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8207C CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,memset,	10_2_00007FF8A7A8207C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8191F ERR_put_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,OPENSSL_sk_value,CRYPTO_dup_ex_data,BIO_ctrl,BIO_ctrl,BIO_up_ref,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	10_2_00007FF8A7A8191F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB5120 CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	10_2_00007FF8A7AB5120
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9E0B0 CRYPTO_THREAD_run_once,	10_2_00007FF8A7A9E0B0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8E0A0 CRYPTO_free,	10_2_00007FF8A7A8E0A0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD80C0 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7AD80C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC0070 CRYPTO_memcmp,	10_2_00007FF8A7AC0070
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8405B BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,BIO_set_init,BIO_clear_flags,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	10_2_00007FF8A7A8405B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ABA050 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	10_2_00007FF8A7ABA050
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9BFB0 CRYPTO_zalloc,ERR_put_error,CRYPTO_THREAD_lock_new,ERR_put_error,CRYPTO_free,	10_2_00007FF8A7A9BFB0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A99FB0 CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7A99FB0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD1F80 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,	10_2_00007FF8A7AD1F80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A87F80 CRYPTO_zalloc,ERR_put_error,	10_2_00007FF8A7A87F80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A89FF0 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A89FF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8DFF0 CRYPTO_free,	10_2_00007FF8A7A8DFF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AEBF20 SRP_Calc_u,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,CRYPTO_clear_free,BN_clear_free,	10_2_00007FF8A7AEBF20
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81F01 CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,	10_2_00007FF8A7A81F01
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A95E80 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	10_2_00007FF8A7A95E80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81E6A CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,CRYPTO_free,	10_2_00007FF8A7A81E6A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC7EC7 CRYPTO_clear_free,	10_2_00007FF8A7AC7EC7
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB9E30 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7AB9E30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8150A CRYPTO_free,CRYPTO_malloc,ERR_put_error,memcpy,	10_2_00007FF8A7A8150A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A87E20 CRYPTO_zalloc,ERR_put_error,	10_2_00007FF8A7A87E20
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9DE70 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	10_2_00007FF8A7A9DE70
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81CD5 CRYPTO_malloc,COMP_expand_block,	10_2_00007FF8A7A81CD5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9FDA0 strncmp,strncmp,strncmp,strncmp,ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,ERR_put_error,strncmp,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	10_2_00007FF8A7A9FDA0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A816E5 CRYPTO_zalloc,	10_2_00007FF8A7A816E5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9DD80 CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl,	10_2_00007FF8A7A9DD80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81F28 CRYPTO_free,CRYPTO_malloc,memcpy,	10_2_00007FF8A7A81F28
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ABFDC0 CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ABFDC0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81104 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	10_2_00007FF8A7A81104
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A822CA ERR_put_error,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A822CA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A87D20 CRYPTO_free,	10_2_00007FF8A7A87D20
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AD7D00 CRYPTO_memcmp,	10_2_00007FF8A7AD7D00
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA3D40 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7AA3D40
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A812E4 EVP_MD_size,RAND_bytes,_time64,CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A812E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A820F4 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	10_2_00007FF8A7A820F4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A824D2 OPENSSL_sk_new_null,d2i_X509,CRYPTO_free,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_memcmp,CRYPTO_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,	10_2_00007FF8A7A824D2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ACFC60 CRYPTO_free,CRYPTO_free,CRYPTO_strndup,	10_2_00007FF8A7ACFC60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB9B90 CRYPTO_memcmp,	10_2_00007FF8A7AB9B90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81ABE CONF_parse_list,CRYPTO_malloc,ERR_put_error,memcpy,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A81ABE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AA1BD0 CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7AA1BD0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A87BD0 CRYPTO_free,	10_2_00007FF8A7A87BD0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9FB30 CRYPTO_zalloc,ERR_put_error,CRYPTO_free,	10_2_00007FF8A7A9FB30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8101E EVP_PKEY_free,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_clear_free,	10_2_00007FF8A7A8101E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81686 CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A81686
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ABFAF0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7ABFAF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADFAF0 BN_bin2bn,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7ADFAF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81870 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A81870
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82095 CRYPTO_free,_time64,CRYPTO_free,CRYPTO_malloc,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,	10_2_00007FF8A7A82095
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81D8E BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A81D8E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81663 CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	10_2_00007FF8A7A81663
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8125D BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	10_2_00007FF8A7A8125D
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8218F EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestSignFinal,EVP_DigestSign,BUF_reverse,CRYPTO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_MD_CTX_free,	10_2_00007FF8A7A8218F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8215D CRYPTO_free,CRYPTO_malloc,RAND_bytes,	10_2_00007FF8A7A8215D
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81C0D CRYPTO_free,CRYPTO_strdup,	10_2_00007FF8A7A81C0D
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8193A CRYPTO_free,CRYPTO_memdup,	10_2_00007FF8A7A8193A

Source: wsx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268931600.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321843970.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2265916752.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316073120.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: wsx.exe, 00000002.00000002.4724039412.00007FF8B83A4000.00000002.00000001.01000000.00000004.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723851835.00007FF8A8024000.00000002.00000001.01000000.00000019.sdmp, ucrtbase.dll.9.dr
Source:	Binary string: C:\A\31\b\bin\amd64\python3.pdb source: wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4726746703.00007FF8BA502000.00000002.00000001.01000000.00000007.sdmp, registry_65f93d51.exe, 00000009.00000003.2325177610.000001BF4058A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725982927.00007FF8B8F72000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265532853.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314930930.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267638883.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320853844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268117839.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321320022.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\31\b\bin\amd64\_bz2.pdb source: wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4726166568.00007FF8BA24E000.00000002.00000001.01000000.0000000A.sdmp, registry_65f93d51.exe, 00000009.00000003.2311725038.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725034578.00007FF8B829E000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_multiprocessing.pdb source: wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2312503652.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_hashlib.pdb source: wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725020792.00007FF8B9105000.00000002.00000001.01000000.00000011.sdmp, registry_65f93d51.exe, 00000009.00000003.2312259416.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725343238.00007FF8B8795000.00000002.00000001.01000000.00000026.sdmp, _hashlib.pyd.9.dr
Source:	Binary string: ~/.pdbrc source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266580337.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319802950.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268227688.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321398734.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266210989.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319475363.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268040879.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321242799.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\unicodedata.pdb source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmp, registry_65f93d51.exe, 00000009.00000003.2327134026.000001BF40594000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722044735.00007FF8A73C5000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268117839.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321320022.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266929158.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320119867.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265342153.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2313965731.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269224887.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322097320.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266842790.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320042183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267715426.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320927539.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_asyncio.pdb source: wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724186040.00007FF8B8F87000.00000002.00000001.01000000.00000016.sdmp, registry_65f93d51.exe, 00000009.00000003.2311554458.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4726060409.00007FF8B90B7000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_lzma.pdb source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725576617.00007FF8B916D000.00000002.00000001.01000000.0000000B.sdmp, registry_65f93d51.exe, 00000009.00000003.2312377234.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724695449.00007FF8B827D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267207504.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320300217.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265818210.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316009389.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_socket.pdb source: wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725967855.00007FF8B9F69000.00000002.00000001.01000000.0000000C.sdmp, registry_65f93d51.exe, 00000009.00000003.2312771106.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724412164.00007FF8B78B9000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268040879.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321242799.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266016159.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2318890669.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269224887.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322097320.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-fibers-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265721119.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315920437.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\python38.pdb source: wsx.exe, 00000002.00000002.4723333080.00007FF8A8E04000.00000002.00000001.01000000.00000005.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723375067.00007FF8A7E24000.00000002.00000001.01000000.0000001A.sdmp, python38.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266112696.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319389209.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267638883.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320853844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\31\b\bin\amd64\_lzma.pdbMM source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725576617.00007FF8B916D000.00000002.00000001.01000000.0000000B.sdmp, registry_65f93d51.exe, 00000009.00000003.2312377234.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724695449.00007FF8B827D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2267504733.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320775294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_ctypes.pdb source: wsx.exe, 00000002.00000002.4725807752.00007FF8B9192000.00000002.00000001.01000000.00000008.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725192076.00007FF8B82C2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32wnet.pdb source: wsx.exe, 00000000.00000003.2279561845.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327436277.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266842790.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320042183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.9.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:40:20 2020 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: wsx.exe, 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722693885.00007FF8A7617000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_queue.pdb source: wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724747960.00007FF8B90F3000.00000002.00000001.01000000.00000012.sdmp, registry_65f93d51.exe, 00000009.00000003.2312703924.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724537307.00007FF8B8253000.00000002.00000001.01000000.00000027.sdmp, _queue.pyd.9.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2266500836.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319729844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: -c are executed after commands from .pdbrc files. source: wsx.exe, 00000002.00000002.4720209105.000001D6CE6DF000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267360213.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320610765.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269119940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322013187.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: wsx.exe, 00000000.00000003.2267090123.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320205484.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265532853.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314930930.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266404717.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319652327.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266500836.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319729844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266698365.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319882300.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267289640.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320513643.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\3\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wsx.exe, 00000000.00000003.2263634927.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2311210717.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Initial commands are read from .pdbrc files in your home directory source: wsx.exe, 00000002.00000002.4720209105.000001D6CE6DF000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_ssl.pdb source: wsx.exe, 00000002.00000002.4725193346.00007FF8B911D000.00000002.00000001.01000000.0000000E.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724117939.00007FF8B782D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265342153.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2313965731.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268796940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321766183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269354500.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322173948.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267432361.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320693436.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266304966.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319574651.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267289640.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320513643.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268227688.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321398734.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269119940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322013187.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268318304.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321475345.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.9.dr
Source:	Binary string: d:\agent\_work\3\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wsx.exe, 00000000.00000003.2263510921.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4727263141.00007FF8BFB30000.00000002.00000001.01000000.00000006.sdmp, registry_65f93d51.exe, 00000009.00000003.2310883925.000001BF40586000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725680215.00007FF8B8B00000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266580337.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319802950.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269022242.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321926554.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.9.dr
Source:	Binary string: placed in the .pdbrc file): source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_overlapped.pdb source: wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724454005.00007FF8B90D5000.00000002.00000001.01000000.00000017.sdmp, registry_65f93d51.exe, 00000009.00000003.2312593294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4726281498.00007FF8BA525000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: If a file ".pdbrc" exists in your home directory or in the current source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267798188.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321008115.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr, api-ms-win-core-util-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267432361.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320693436.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266210989.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319475363.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268439591.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321554854.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266112696.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319389209.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266929158.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320119867.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265628346.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315422600.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265818210.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316009389.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-fibers-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265721119.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315920437.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267504733.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320775294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267958915.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321163060.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268796940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321766183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267798188.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321008115.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr, api-ms-win-core-util-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265439691.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314471193.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\6\b\libssl-1_1.pdb source: wsx.exe, 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723087461.00007FF8A7AF4000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265628346.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315422600.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: wsx.exe, 00000002.00000002.4724039412.00007FF8B83A4000.00000002.00000001.01000000.00000004.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723851835.00007FF8A8024000.00000002.00000001.01000000.00000019.sdmp, ucrtbase.dll.9.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269022242.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321926554.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267958915.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321163060.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\6\b\libssl-1_1.pdb?? source: wsx.exe, 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723087461.00007FF8A7AF4000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265916752.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316073120.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267207504.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320300217.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: wsx.exe, 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722693885.00007FF8A7617000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265439691.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314471193.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267878901.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321086900.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268439591.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321554854.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266304966.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319574651.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268318304.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321475345.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269354500.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322173948.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\select.pdb source: wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725412867.00007FF8B9143000.00000002.00000001.01000000.0000000D.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725502564.00007FF8B8833000.00000002.00000001.01000000.00000022.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267715426.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320927539.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267360213.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320610765.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: wsx.exe, 00000000.00000003.2266016159.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2318890669.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbrc source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266404717.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319652327.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266698365.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319882300.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268931600.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321843970.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: wsx.exe, 00000000.00000003.2267090123.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320205484.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: The standard debugger class (pdb.Pdb) is an example. source: wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE96B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDB33000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267878901.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321086900.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71D7790 FindFirstFileExW,FindClose,	0_2_00007FF7E71D7790
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71D7790 FindFirstFileExW,FindClose,	2_2_00007FF7E71D7790
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084471 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FF8A8084471
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5C7790 FindFirstFileExW,FindClose,	9_2_00007FF6BD5C7790
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5C7790 FindFirstFileExW,FindClose,	10_2_00007FF6BD5C7790
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4471 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	10_2_00007FF8A73D4471

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /conta.php HTTP/1.1Host: pontoslivelobb.servicos.wsUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /conta.php HTTP/1.1Host: pontoslivelobb.servicos.wsUser-Agent: python-requests/2.32.3Accept-Encoding: gzip, deflateAccept: /Connection: keep-alive

Source: global traffic	DNS traffic detected: DNS query: pontoslivelobb.servicos.ws
Source: global traffic	DNS traffic detected: DNS query: estudosadulto.educacao.ws

Source: wsx.exe, 00000002.00000002.4721018755.000001D6CEB00000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720985405.000001DEEDDC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: registry_65f93d51.exe, 0000000A.00000002.4719712925.000001DEED590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://91.92.246.171:5000/replace
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crln
Source: registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlpd/
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl~
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl__exit__c
Source: wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crll__.
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2312377234.000001BF40588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAss
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: wsx.exe, 00000002.00000002.4720967947.000001D6CEAC0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720357983.000001DEED980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.p
Source: wsx.exe, 00000002.00000002.4721431850.000001D6CEDB0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721388934.000001DEEE070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: wsx.exe, 00000002.00000002.4721391137.000001D6CED70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721388934.000001DEEE070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: wsx.exe, 00000002.00000002.4721352219.000001D6CED30000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721308581.000001DEEDFF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail
Source: registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/
Source: registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED4CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2312259416.000001BF40588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719580106.000001D6CE2D0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719712925.000001DEED590000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721662924.000001DEEE210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pontoslivelobb.servicos.ws/conta.php
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pontoslivelobb.servicos.ws/conta.phprg
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pontoslivelobb.servicos.ws/conta.phprg)
Source: wsx.exe, 00000002.00000002.4719580106.000001D6CE2D0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719712925.000001DEED590000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pontoslivelobb.servicos.ws/salva.php
Source: python38.dll.0.dr	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDB8C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0R
Source: registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/Hd
Source: registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/t
Source: wsx.exe, 00000002.00000002.4719910052.000001D6CE4E0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720018075.000001DEED7A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED4CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333794430.000001DEED42A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED3B0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332400133.000001DEEB0C6000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332488463.000001DEEB0C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/
Source: wsx.exe, 00000000.00000003.2279765483.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719280774.000001D6CDFF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327588294.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719310887.000001DEED2B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: wsx.exe, 00000002.00000002.4718850807.000001D6CD760000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290828612.000001D6CDDB1000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718867536.000001DEECED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cpsd
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEED9C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/
Source: wsx.exe, 00000002.00000002.4719763286.000001D6CE3D0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719870837.000001DEED690000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://codecov.io/github/pyca/cryptography?branch=master
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation.html
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security.html
Source: registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.microsof
Source: wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE777000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721473524.000001D6CEE00000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721062499.000001D6CEB40000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721601148.000001DEEE1D0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721429022.000001DEEE0C0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721021413.000001DEEDE00000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://estudosadulto.educacao.ws/contador/contador.php
Source: wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://estudosadulto.educacao.ws/contador/contador.php0
Source: wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://estudosadulto.educacao.ws/contador/contador.php0wt
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE793000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: wsx.exe, 00000000.00000003.2279561845.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277366073.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326414155.000001BF4058A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327436277.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=master
Source: wsx.exe, 00000002.00000002.4718686995.000001D6CD660000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718710013.000001DEECC90000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: registry_65f93d51.exe, 0000000A.00000002.4719870837.000001DEED690000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/497
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332400133.000001DEEB0C6000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332488463.000001DEEB0C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: wsx.exe, 00000002.00000002.4721204773.000001D6CEC30000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721156944.000001DEEDEF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: wsx.exe, 00000002.00000002.4721204773.000001D6CEC30000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721156944.000001DEEDEF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: wsx.exe, 00000002.00000002.4719832400.000001D6CE450000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719943391.000001DEED710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
Source: registry_65f93d51.exe, 0000000A.00000002.4719943391.000001DEED710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: wsx.exe, 00000002.00000002.4719727193.000001D6CE390000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719831009.000001DEED650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsPv
Source: wsx.exe, 00000002.00000002.4719945013.000001D6CE530000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720060998.000001DEED7F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: wsx.exe, 00000000.00000003.2280497122.000001AA0235A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: wsx.exe, 00000000.00000003.2280623300.000001AA02368000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2280497122.000001AA0235A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2280468813.000001AA02368000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328328440.000001BF40599000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF40599000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2265342153.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02361000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmp, wsx.exe, 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmp, registry_65f93d51.exe, 00000009.00000003.2324775684.000001BF4058A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722906514.00007FF8A770D000.00000002.00000001.01000000.00000025.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723140745.00007FF8A7B29000.00000002.00000001.01000000.00000024.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED3B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71D6760	0_2_00007FF7E71D6760
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F4D50	0_2_00007FF7E71F4D50
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F5C9C	0_2_00007FF7E71F5C9C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E08D0	0_2_00007FF7E71E08D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F30FC	0_2_00007FF7E71F30FC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F08E4	0_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E10F0	0_2_00007FF7E71E10F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F5750	0_2_00007FF7E71F5750
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E2730	0_2_00007FF7E71E2730
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F4FCC	0_2_00007FF7E71F4FCC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71ECFC8	0_2_00007FF7E71ECFC8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71ED648	0_2_00007FF7E71ED648
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E4E80	0_2_00007FF7E71E4E80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6EC8	0_2_00007FF7E71E6EC8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E0EE4	0_2_00007FF7E71E0EE4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E1DA0	0_2_00007FF7E71E1DA0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6490	0_2_00007FF7E71E6490
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71EF938	0_2_00007FF7E71EF938
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F2C60	0_2_00007FF7E71F2C60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71D9CC0	0_2_00007FF7E71D9CC0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E0CE0	0_2_00007FF7E71E0CE0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E2B34	0_2_00007FF7E71E2B34
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71ECB34	0_2_00007FF7E71ECB34
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71D1B90	0_2_00007FF7E71D1B90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E0AD4	0_2_00007FF7E71E0AD4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E8AD0	0_2_00007FF7E71E8AD0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F8A98	0_2_00007FF7E71F8A98
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E12F4	0_2_00007FF7E71E12F4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71EF938	0_2_00007FF7E71EF938
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F4D50	2_2_00007FF7E71F4D50
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F5C9C	2_2_00007FF7E71F5C9C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E08D0	2_2_00007FF7E71E08D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F30FC	2_2_00007FF7E71F30FC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F08E4	2_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E10F0	2_2_00007FF7E71E10F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F5750	2_2_00007FF7E71F5750
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E2730	2_2_00007FF7E71E2730
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71D6760	2_2_00007FF7E71D6760
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F4FCC	2_2_00007FF7E71F4FCC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71ECFC8	2_2_00007FF7E71ECFC8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71ED648	2_2_00007FF7E71ED648
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E4E80	2_2_00007FF7E71E4E80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6EC8	2_2_00007FF7E71E6EC8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E0EE4	2_2_00007FF7E71E0EE4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E1DA0	2_2_00007FF7E71E1DA0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6490	2_2_00007FF7E71E6490
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71EF938	2_2_00007FF7E71EF938
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F2C60	2_2_00007FF7E71F2C60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71D9CC0	2_2_00007FF7E71D9CC0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E0CE0	2_2_00007FF7E71E0CE0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E2B34	2_2_00007FF7E71E2B34
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71ECB34	2_2_00007FF7E71ECB34
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71D1B90	2_2_00007FF7E71D1B90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E0AD4	2_2_00007FF7E71E0AD4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E8AD0	2_2_00007FF7E71E8AD0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F8A98	2_2_00007FF7E71F8A98
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E12F4	2_2_00007FF7E71E12F4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71EF938	2_2_00007FF7E71EF938
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082117	2_2_00007FF8A8082117
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80865AA	2_2_00007FF8A80865AA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A816A9D0	2_2_00007FF8A816A9D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086A0F	2_2_00007FF8A8086A0F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081BCC	2_2_00007FF8A8081BCC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80812A8	2_2_00007FF8A80812A8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80851E6	2_2_00007FF8A80851E6
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083EAE	2_2_00007FF8A8083EAE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80834B3	2_2_00007FF8A80834B3
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083EBD	2_2_00007FF8A8083EBD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81BED80	2_2_00007FF8A81BED80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80860F0	2_2_00007FF8A80860F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082A2C	2_2_00007FF8A8082A2C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81AEE10	2_2_00007FF8A81AEE10
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085236	2_2_00007FF8A8085236
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084B83	2_2_00007FF8A8084B83
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809EF00	2_2_00007FF8A809EF00
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082676	2_2_00007FF8A8082676
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809F060	2_2_00007FF8A809F060
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082B30	2_2_00007FF8A8082B30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808655F	2_2_00007FF8A808655F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086014	2_2_00007FF8A8086014
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084DB3	2_2_00007FF8A8084DB3
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808692E	2_2_00007FF8A808692E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084138	2_2_00007FF8A8084138
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082590	2_2_00007FF8A8082590
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8162510	2_2_00007FF8A8162510
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A821E570	2_2_00007FF8A821E570
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084E8A	2_2_00007FF8A8084E8A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081AE6	2_2_00007FF8A8081AE6
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B66A0	2_2_00007FF8A81B66A0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081EB5	2_2_00007FF8A8081EB5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085213	2_2_00007FF8A8085213
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80819DD	2_2_00007FF8A80819DD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808105F	2_2_00007FF8A808105F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808672B	2_2_00007FF8A808672B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80860EB	2_2_00007FF8A80860EB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081F78	2_2_00007FF8A8081F78
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A82B7970	2_2_00007FF8A82B7970
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80EFA00	2_2_00007FF8A80EFA00
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083C24	2_2_00007FF8A8083C24
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082509	2_2_00007FF8A8082509
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A821BAD0	2_2_00007FF8A821BAD0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81BFB40	2_2_00007FF8A81BFB40
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8233BE0	2_2_00007FF8A8233BE0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081B9A	2_2_00007FF8A8081B9A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083869	2_2_00007FF8A8083869
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082013	2_2_00007FF8A8082013
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809BD60	2_2_00007FF8A809BD60
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082BF8	2_2_00007FF8A8082BF8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808135C	2_2_00007FF8A808135C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808514B	2_2_00007FF8A808514B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81ABF30	2_2_00007FF8A81ABF30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80871A8	2_2_00007FF8A80871A8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809BF20	2_2_00007FF8A809BF20
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808380F	2_2_00007FF8A808380F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082C57	2_2_00007FF8A8082C57
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808628F	2_2_00007FF8A808628F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80848DB	2_2_00007FF8A80848DB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A821B150	2_2_00007FF8A821B150
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082518	2_2_00007FF8A8082518
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809F200	2_2_00007FF8A809F200
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084660	2_2_00007FF8A8084660
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808188E	2_2_00007FF8A808188E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082833	2_2_00007FF8A8082833
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081B77	2_2_00007FF8A8081B77
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085BA5	2_2_00007FF8A8085BA5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80AB4C0	2_2_00007FF8A80AB4C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81AB590	2_2_00007FF8A81AB590
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083DC8	2_2_00007FF8A8083DC8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082BCB	2_2_00007FF8A8082BCB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A821F6D0	2_2_00007FF8A821F6D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084B33	2_2_00007FF8A8084B33
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80812C1	2_2_00007FF8A80812C1
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80811DB	2_2_00007FF8A80811DB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80AB850	2_2_00007FF8A80AB850
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808402F	2_2_00007FF8A808402F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082937	2_2_00007FF8A8082937
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086429	2_2_00007FF8A8086429
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B49D0	2_2_00007FF8A81B49D0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808298C	2_2_00007FF8A808298C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086E92	2_2_00007FF8A8086E92
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808320B	2_2_00007FF8A808320B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086532	2_2_00007FF8A8086532
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081041	2_2_00007FF8A8081041
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808609B	2_2_00007FF8A808609B
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808452F	2_2_00007FF8A808452F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B4CE0	2_2_00007FF8A81B4CE0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084016	2_2_00007FF8A8084016
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081AF0	2_2_00007FF8A8081AF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081E7E	2_2_00007FF8A8081E7E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086000	2_2_00007FF8A8086000
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085894	2_2_00007FF8A8085894
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083742	2_2_00007FF8A8083742
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083099	2_2_00007FF8A8083099
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80866D6	2_2_00007FF8A80866D6
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81C0140	2_2_00007FF8A81C0140
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80871C6	2_2_00007FF8A80871C6
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8130200	2_2_00007FF8A8130200
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808572C	2_2_00007FF8A808572C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082AC2	2_2_00007FF8A8082AC2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808704A	2_2_00007FF8A808704A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083972	2_2_00007FF8A8083972
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808734C	2_2_00007FF8A808734C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082EB4	2_2_00007FF8A8082EB4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809C480	2_2_00007FF8A809C480
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808111D	2_2_00007FF8A808111D
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085024	2_2_00007FF8A8085024
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80812EE	2_2_00007FF8A80812EE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A82205F0	2_2_00007FF8A82205F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809C620	2_2_00007FF8A809C620
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083139	2_2_00007FF8A8083139
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083DD2	2_2_00007FF8A8083DD2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085D08	2_2_00007FF8A8085D08
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80862EE	2_2_00007FF8A80862EE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80817E4	2_2_00007FF8A80817E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084DF9	2_2_00007FF8A8084DF9
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80835DF	2_2_00007FF8A80835DF
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086BBD	2_2_00007FF8A8086BBD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80851E1	2_2_00007FF8A80851E1
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8235AA0	2_2_00007FF8A8235AA0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B9A80	2_2_00007FF8A81B9A80
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80837F1	2_2_00007FF8A80837F1
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808242D	2_2_00007FF8A808242D
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084BAB	2_2_00007FF8A8084BAB
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808227F	2_2_00007FF8A808227F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808489A	2_2_00007FF8A808489A
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082A95	2_2_00007FF8A8082A95
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808592F	2_2_00007FF8A808592F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808309E	2_2_00007FF8A808309E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80836DE	2_2_00007FF8A80836DE
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B5E90	2_2_00007FF8A81B5E90
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082347	2_2_00007FF8A8082347
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086244	2_2_00007FF8A8086244
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80824AF	2_2_00007FF8A80824AF
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082D65	2_2_00007FF8A8082D65
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084430	2_2_00007FF8A8084430
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081C26	2_2_00007FF8A8081C26
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80871D5	2_2_00007FF8A80871D5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083E27	2_2_00007FF8A8083E27
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80A5200	2_2_00007FF8A80A5200
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80845CA	2_2_00007FF8A80845CA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A809D260	2_2_00007FF8A809D260
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A81B12B0	2_2_00007FF8A81B12B0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A82352F0	2_2_00007FF8A82352F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80849A8	2_2_00007FF8A80849A8
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80824AA	2_2_00007FF8A80824AA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8081839	2_2_00007FF8A8081839
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80811CC	2_2_00007FF8A80811CC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085BD2	2_2_00007FF8A8085BD2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083EEA	2_2_00007FF8A8083EEA
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083765	2_2_00007FF8A8083765
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082F31	2_2_00007FF8A8082F31
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8083C01	2_2_00007FF8A8083C01
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082E37	2_2_00007FF8A8082E37
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082766	2_2_00007FF8A8082766
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A808732E	2_2_00007FF8A808732E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8082E0F	2_2_00007FF8A8082E0F
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8A012C0	2_2_00007FF8A8A012C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8A018F0	2_2_00007FF8A8A018F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A93001F0	2_2_00007FF8A93001F0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1357	2_2_00007FF8A92F1357
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F2491	2_2_00007FF8A92F2491
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9322C70	2_2_00007FF8A9322C70
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F6D30	2_2_00007FF8A92F6D30
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F12B2	2_2_00007FF8A92F12B2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9302D50	2_2_00007FF8A9302D50
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1924	2_2_00007FF8A92F1924
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9328FF0	2_2_00007FF8A9328FF0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F15CD	2_2_00007FF8A92F15CD
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1E83	2_2_00007FF8A92F1E83
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9358780	2_2_00007FF8A9358780
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F23F6	2_2_00007FF8A92F23F6
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92FFAD5	2_2_00007FF8A92FFAD5
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1E7E	2_2_00007FF8A92F1E7E
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9305980	2_2_00007FF8A9305980
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F24D2	2_2_00007FF8A92F24D2
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F12E4	2_2_00007FF8A92F12E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1C03	2_2_00007FF8A92F1C03
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A930F400	2_2_00007FF8A930F400
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1BBD	2_2_00007FF8A92F1BBD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E4D50	9_2_00007FF6BD5E4D50
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5C6760	9_2_00007FF6BD5C6760
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E5C9C	9_2_00007FF6BD5E5C9C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D4E80	9_2_00007FF6BD5D4E80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5DD648	9_2_00007FF6BD5DD648
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D2730	9_2_00007FF6BD5D2730
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D0EE4	9_2_00007FF6BD5D0EE4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6EC8	9_2_00007FF6BD5D6EC8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D1DA0	9_2_00007FF6BD5D1DA0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E30FC	9_2_00007FF6BD5E30FC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E08E4	9_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D10F0	9_2_00007FF6BD5D10F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D08D0	9_2_00007FF6BD5D08D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E5750	9_2_00007FF6BD5E5750
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E4FCC	9_2_00007FF6BD5E4FCC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5DCFC8	9_2_00007FF6BD5DCFC8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E8A98	9_2_00007FF6BD5E8A98
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D2B34	9_2_00007FF6BD5D2B34
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5DCB34	9_2_00007FF6BD5DCB34
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D12F4	9_2_00007FF6BD5D12F4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D0AD4	9_2_00007FF6BD5D0AD4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D8AD0	9_2_00007FF6BD5D8AD0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5DF938	9_2_00007FF6BD5DF938
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6490	9_2_00007FF6BD5D6490
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5DF938	9_2_00007FF6BD5DF938
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E2C60	9_2_00007FF6BD5E2C60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D0CE0	9_2_00007FF6BD5D0CE0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5C9CC0	9_2_00007FF6BD5C9CC0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5C1B90	9_2_00007FF6BD5C1B90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E4D50	10_2_00007FF6BD5E4D50
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E5C9C	10_2_00007FF6BD5E5C9C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D4E80	10_2_00007FF6BD5D4E80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5DD648	10_2_00007FF6BD5DD648
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D2730	10_2_00007FF6BD5D2730
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D0EE4	10_2_00007FF6BD5D0EE4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6EC8	10_2_00007FF6BD5D6EC8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D1DA0	10_2_00007FF6BD5D1DA0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E30FC	10_2_00007FF6BD5E30FC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E08E4	10_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D10F0	10_2_00007FF6BD5D10F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D08D0	10_2_00007FF6BD5D08D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5C6760	10_2_00007FF6BD5C6760
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E5750	10_2_00007FF6BD5E5750
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E4FCC	10_2_00007FF6BD5E4FCC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5DCFC8	10_2_00007FF6BD5DCFC8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E8A98	10_2_00007FF6BD5E8A98
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D2B34	10_2_00007FF6BD5D2B34
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5DCB34	10_2_00007FF6BD5DCB34
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D12F4	10_2_00007FF6BD5D12F4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D0AD4	10_2_00007FF6BD5D0AD4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D8AD0	10_2_00007FF6BD5D8AD0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5DF938	10_2_00007FF6BD5DF938
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6490	10_2_00007FF6BD5D6490
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5DF938	10_2_00007FF6BD5DF938
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E2C60	10_2_00007FF6BD5E2C60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D0CE0	10_2_00007FF6BD5D0CE0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5C9CC0	10_2_00007FF6BD5C9CC0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5C1B90	10_2_00007FF6BD5C1B90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A72C18F0	10_2_00007FF8A72C18F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A72C12C0	10_2_00007FF8A72C12C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D672B	10_2_00007FF8A73D672B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1F78	10_2_00007FF8A73D1F78
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D60EB	10_2_00007FF8A73D60EB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D19DD	10_2_00007FF8A73D19DD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D105F	10_2_00007FF8A73D105F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1AE6	10_2_00007FF8A73D1AE6
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5213	10_2_00007FF8A73D5213
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1EB5	10_2_00007FF8A73D1EB5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A75066A0	10_2_00007FF8A75066A0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A756E570	10_2_00007FF8A756E570
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A74B2510	10_2_00007FF8A74B2510
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4E8A	10_2_00007FF8A73D4E8A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D692E	10_2_00007FF8A73D692E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2590	10_2_00007FF8A73D2590
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4138	10_2_00007FF8A73D4138
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D655F	10_2_00007FF8A73D655F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6014	10_2_00007FF8A73D6014
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4DB3	10_2_00007FF8A73D4DB3
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2B30	10_2_00007FF8A73D2B30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EF060	10_2_00007FF8A73EF060
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2676	10_2_00007FF8A73D2676
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EEF00	10_2_00007FF8A73EEF00
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A74FEE10	10_2_00007FF8A74FEE10
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2A2C	10_2_00007FF8A73D2A2C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D60F0	10_2_00007FF8A73D60F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4B83	10_2_00007FF8A73D4B83
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5236	10_2_00007FF8A73D5236
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3EBD	10_2_00007FF8A73D3EBD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A750ED80	10_2_00007FF8A750ED80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D34B3	10_2_00007FF8A73D34B3
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3EAE	10_2_00007FF8A73D3EAE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D51E6	10_2_00007FF8A73D51E6
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D12A8	10_2_00007FF8A73D12A8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1BCC	10_2_00007FF8A73D1BCC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6A0F	10_2_00007FF8A73D6A0F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2117	10_2_00007FF8A73D2117
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A74BA9D0	10_2_00007FF8A74BA9D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D65AA	10_2_00007FF8A73D65AA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73FB850	10_2_00007FF8A73FB850
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D402F	10_2_00007FF8A73D402F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D11DB	10_2_00007FF8A73D11DB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D12C1	10_2_00007FF8A73D12C1
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2BCB	10_2_00007FF8A73D2BCB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4B33	10_2_00007FF8A73D4B33
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A756F6D0	10_2_00007FF8A756F6D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3DC8	10_2_00007FF8A73D3DC8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A74FB590	10_2_00007FF8A74FB590
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1B77	10_2_00007FF8A73D1B77
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2833	10_2_00007FF8A73D2833
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D188E	10_2_00007FF8A73D188E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73FB4C0	10_2_00007FF8A73FB4C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5BA5	10_2_00007FF8A73D5BA5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4660	10_2_00007FF8A73D4660
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EF200	10_2_00007FF8A73EF200
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D48DB	10_2_00007FF8A73D48DB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A756B150	10_2_00007FF8A756B150
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2518	10_2_00007FF8A73D2518
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2C57	10_2_00007FF8A73D2C57
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D380F	10_2_00007FF8A73D380F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D628F	10_2_00007FF8A73D628F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D71A8	10_2_00007FF8A73D71A8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EBF20	10_2_00007FF8A73EBF20
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A74FBF30	10_2_00007FF8A74FBF30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2BF8	10_2_00007FF8A73D2BF8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D514B	10_2_00007FF8A73D514B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D135C	10_2_00007FF8A73D135C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EBD60	10_2_00007FF8A73EBD60
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2013	10_2_00007FF8A73D2013
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3869	10_2_00007FF8A73D3869
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1B9A	10_2_00007FF8A73D1B9A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A750FB40	10_2_00007FF8A750FB40
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7583BE0	10_2_00007FF8A7583BE0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2509	10_2_00007FF8A73D2509
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A743FA00	10_2_00007FF8A743FA00
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3C24	10_2_00007FF8A73D3C24
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A756BAD0	10_2_00007FF8A756BAD0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7607970	10_2_00007FF8A7607970
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4DF9	10_2_00007FF8A73D4DF9
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D62EE	10_2_00007FF8A73D62EE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D17E4	10_2_00007FF8A73D17E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3139	10_2_00007FF8A73D3139
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3DD2	10_2_00007FF8A73D3DD2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EC620	10_2_00007FF8A73EC620
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5D08	10_2_00007FF8A73D5D08
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5024	10_2_00007FF8A73D5024
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A75705F0	10_2_00007FF8A75705F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D12EE	10_2_00007FF8A73D12EE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D111D	10_2_00007FF8A73D111D
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73EC480	10_2_00007FF8A73EC480
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2EB4	10_2_00007FF8A73D2EB4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D734C	10_2_00007FF8A73D734C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2AC2	10_2_00007FF8A73D2AC2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D572C	10_2_00007FF8A73D572C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7480200	10_2_00007FF8A7480200
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3972	10_2_00007FF8A73D3972
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D704A	10_2_00007FF8A73D704A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7510140	10_2_00007FF8A7510140
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D66D6	10_2_00007FF8A73D66D6
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D71C6	10_2_00007FF8A73D71C6
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3742	10_2_00007FF8A73D3742
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5894	10_2_00007FF8A73D5894
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3099	10_2_00007FF8A73D3099
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6000	10_2_00007FF8A73D6000
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1E7E	10_2_00007FF8A73D1E7E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4016	10_2_00007FF8A73D4016
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1AF0	10_2_00007FF8A73D1AF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D452F	10_2_00007FF8A73D452F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D609B	10_2_00007FF8A73D609B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7504CE0	10_2_00007FF8A7504CE0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6532	10_2_00007FF8A73D6532
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1041	10_2_00007FF8A73D1041
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D320B	10_2_00007FF8A73D320B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6E92	10_2_00007FF8A73D6E92
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D298C	10_2_00007FF8A73D298C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6429	10_2_00007FF8A73D6429
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2937	10_2_00007FF8A73D2937
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A75049D0	10_2_00007FF8A75049D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2E0F	10_2_00007FF8A73D2E0F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2E37	10_2_00007FF8A73D2E37
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2766	10_2_00007FF8A73D2766
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3C01	10_2_00007FF8A73D3C01
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D732E	10_2_00007FF8A73D732E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3765	10_2_00007FF8A73D3765
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2F31	10_2_00007FF8A73D2F31
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1839	10_2_00007FF8A73D1839
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3EEA	10_2_00007FF8A73D3EEA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5BD2	10_2_00007FF8A73D5BD2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D11CC	10_2_00007FF8A73D11CC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D49A8	10_2_00007FF8A73D49A8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D24AA	10_2_00007FF8A73D24AA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73ED260	10_2_00007FF8A73ED260
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D45CA	10_2_00007FF8A73D45CA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73F5200	10_2_00007FF8A73F5200
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A75852F0	10_2_00007FF8A75852F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A75012B0	10_2_00007FF8A75012B0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D71D5	10_2_00007FF8A73D71D5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D1C26	10_2_00007FF8A73D1C26
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D3E27	10_2_00007FF8A73D3E27
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2D65	10_2_00007FF8A73D2D65
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D24AF	10_2_00007FF8A73D24AF
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4430	10_2_00007FF8A73D4430
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6244	10_2_00007FF8A73D6244
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2347	10_2_00007FF8A73D2347
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D36DE	10_2_00007FF8A73D36DE
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7505E90	10_2_00007FF8A7505E90
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D592F	10_2_00007FF8A73D592F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D309E	10_2_00007FF8A73D309E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D227F	10_2_00007FF8A73D227F
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4BAB	10_2_00007FF8A73D4BAB
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D2A95	10_2_00007FF8A73D2A95
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D489A	10_2_00007FF8A73D489A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D37F1	10_2_00007FF8A73D37F1
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D242D	10_2_00007FF8A73D242D
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D51E1	10_2_00007FF8A73D51E1
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6BBD	10_2_00007FF8A73D6BBD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7585AA0	10_2_00007FF8A7585AA0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7509A80	10_2_00007FF8A7509A80
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D35DF	10_2_00007FF8A73D35DF
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A901F0	10_2_00007FF8A7A901F0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AE8780	10_2_00007FF8A7AE8780
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A815CD	10_2_00007FF8A7A815CD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81E83	10_2_00007FF8A7A81E83
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81924	10_2_00007FF8A7A81924
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB8FF0	10_2_00007FF8A7AB8FF0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A86D30	10_2_00007FF8A7A86D30
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A812B2	10_2_00007FF8A7A812B2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A92D50	10_2_00007FF8A7A92D50
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AB2C70	10_2_00007FF8A7AB2C70
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A82491	10_2_00007FF8A7A82491
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81357	10_2_00007FF8A7A81357
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7ADF5D0	10_2_00007FF8A7ADF5D0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8B520	10_2_00007FF8A7A8B520
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A9F400	10_2_00007FF8A7A9F400
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81BBD	10_2_00007FF8A7A81BBD
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81C03	10_2_00007FF8A7A81C03
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A812E4	10_2_00007FF8A7A812E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A824D2	10_2_00007FF8A7A824D2
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A823F6	10_2_00007FF8A7A823F6
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A8FAD5	10_2_00007FF8A7A8FAD5
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A95980	10_2_00007FF8A7A95980
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81E7E	10_2_00007FF8A7A81E7E
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F6C920	10_2_00007FF8A7F6C920
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F6F990	10_2_00007FF8A7F6F990
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F649C4	10_2_00007FF8A7F649C4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F909CC	10_2_00007FF8A7F909CC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F74B18	10_2_00007FF8A7F74B18
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A8016BCC	10_2_00007FF8A8016BCC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F80BCA	10_2_00007FF8A7F80BCA
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F87BDC	10_2_00007FF8A7F87BDC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F77C40	10_2_00007FF8A7F77C40
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F65E2A	10_2_00007FF8A7F65E2A
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7FD3064	10_2_00007FF8A7FD3064
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F74070	10_2_00007FF8A7F74070

Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D5DEE appears 738 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D4106 appears 385 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D1FC8 appears 55 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D4697 appears 138 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D1055 appears 1559 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D4205 appears 47 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A7A81023 appears 575 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D2004 appears 31 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A7AEC50F appears 194 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A7AEC5A5 appears 103 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF6BD5C2770 appears 82 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D1C0D appears 119 times
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: String function: 00007FF8A73D2072 appears 82 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8084106 appears 385 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8081FC8 appears 55 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF7E71D2770 appears 82 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8085DEE appears 738 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8082072 appears 82 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8081C0D appears 119 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A935C50F appears 168 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A935C5A5 appears 94 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8082004 appears 31 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8081055 appears 1559 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8084205 appears 47 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A8084697 appears 138 times
Source: C:\Users\user\Desktop\wsx.exe	Code function: String function: 00007FF8A92F1023 appears 499 times

Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: python3.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-fibers-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-fibers-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.9.dr	Static PE information: No import functions for PE file found

Source: wsx.exe, 00000000.00000003.2266016159.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267207504.000001AA02355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265916752.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265628346.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266929158.000001AA02355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265342153.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268117839.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2279561845.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32wnet.pyd0 vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267638883.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268227688.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython38.dll. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268439591.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267432361.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2277933525.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266112696.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265818210.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267289640.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2277366073.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepywintypes38.dll0 vs wsx.exe
Source: wsx.exe, 00000000.00000003.2269022242.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268040879.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267360213.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267958915.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265439691.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267504733.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266842790.000001AA02355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2263634927.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs wsx.exe
Source: wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265532853.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267878901.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2277501724.000001AA02366000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267090123.000001AA02355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266698365.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266210989.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266304966.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2269354500.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264770739.000001AA02361000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268796940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266500836.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2265721119.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267715426.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs wsx.exe
Source: wsx.exe, 00000000.00000003.2269224887.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2267798188.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268318304.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266404717.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2269119940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2266580337.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2268931600.000001AA02356000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs wsx.exe
Source: wsx.exe, 00000000.00000003.2263510921.000001AA02354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs wsx.exe
Source: wsx.exe	Binary or memory string: OriginalFilename vs wsx.exe
Source: wsx.exe, 00000002.00000002.4725467852.00007FF8B9146000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamelibsslH vs wsx.exe
Source: wsx.exe, 00000002.00000002.4724237780.00007FF8B8F8F000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4725873934.00007FF8B919D000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4726267406.00007FF8BA254000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4724900014.00007FF8B90F6000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4726029014.00007FF8B9F73000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4726746703.00007FF8BA502000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs wsx.exe
Source: wsx.exe, 00000002.00000002.4724505913.00007FF8B90DA000.00000002.00000001.01000000.00000017.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4725101733.00007FF8B910A000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4724106871.00007FF8B83E2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameucrtbase.dllj% vs wsx.exe
Source: wsx.exe, 00000002.00000002.4725681636.00007FF8B9176000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4725322126.00007FF8B9134000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs wsx.exe
Source: wsx.exe, 00000002.00000002.4727543324.00007FF8BFB37000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs wsx.exe
Source: wsx.exe, 00000002.00000002.4723675434.00007FF8A8F17000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamepython38.dll. vs wsx.exe

Source: classification engine

Classification label: mal68.evad.winEXE@21/160@2/2

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71D7420 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF7E71D7420

Source: C:\Users\user\Desktop\wsx.exe

File created: C:\Users\user\AppData\Roaming\Software

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03

Source: C:\Users\user\Desktop\wsx.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI60562

Jump to behavior

Source: wsx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\wsx.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wsx.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\wsx.exe

File read: C:\Users\user\Desktop\wsx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wsx.exe "C:\Users\user\Desktop\wsx.exe"
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Users\user\Desktop\wsx.exe "C:\Users\user\Desktop\wsx.exe"
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Users\user\Desktop\wsx.exe "C:\Users\user\Desktop\wsx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"	Jump to behavior

Source: C:\Users\user\Desktop\wsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\wsx.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: wsx.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: wsx.exe

Static file information: File size 10090064 > 1048576

Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: wsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: wsx.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: wsx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268931600.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321843970.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2265916752.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316073120.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: ucrtbase.pdb source: wsx.exe, 00000002.00000002.4724039412.00007FF8B83A4000.00000002.00000001.01000000.00000004.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723851835.00007FF8A8024000.00000002.00000001.01000000.00000019.sdmp, ucrtbase.dll.9.dr
Source:	Binary string: C:\A\31\b\bin\amd64\python3.pdb source: wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4726746703.00007FF8BA502000.00000002.00000001.01000000.00000007.sdmp, registry_65f93d51.exe, 00000009.00000003.2325177610.000001BF4058A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725982927.00007FF8B8F72000.00000002.00000001.01000000.0000001C.sdmp
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265532853.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314930930.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267638883.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320853844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268117839.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321320022.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\31\b\bin\amd64\_bz2.pdb source: wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4726166568.00007FF8BA24E000.00000002.00000001.01000000.0000000A.sdmp, registry_65f93d51.exe, 00000009.00000003.2311725038.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725034578.00007FF8B829E000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_multiprocessing.pdb source: wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2312503652.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_hashlib.pdb source: wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725020792.00007FF8B9105000.00000002.00000001.01000000.00000011.sdmp, registry_65f93d51.exe, 00000009.00000003.2312259416.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725343238.00007FF8B8795000.00000002.00000001.01000000.00000026.sdmp, _hashlib.pyd.9.dr
Source:	Binary string: ~/.pdbrc source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266580337.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319802950.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268227688.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321398734.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdb.Pdb source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266210989.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319475363.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268040879.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321242799.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\unicodedata.pdb source: wsx.exe, 00000000.00000003.2279137450.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmp, registry_65f93d51.exe, 00000009.00000003.2327134026.000001BF40594000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722044735.00007FF8A73C5000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268117839.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321320022.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266929158.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320119867.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265342153.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2313965731.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269224887.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322097320.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266842790.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320042183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267715426.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320927539.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_asyncio.pdb source: wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724186040.00007FF8B8F87000.00000002.00000001.01000000.00000016.sdmp, registry_65f93d51.exe, 00000009.00000003.2311554458.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4726060409.00007FF8B90B7000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_lzma.pdb source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725576617.00007FF8B916D000.00000002.00000001.01000000.0000000B.sdmp, registry_65f93d51.exe, 00000009.00000003.2312377234.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724695449.00007FF8B827D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267207504.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320300217.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265818210.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316009389.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_socket.pdb source: wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725967855.00007FF8B9F69000.00000002.00000001.01000000.0000000C.sdmp, registry_65f93d51.exe, 00000009.00000003.2312771106.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724412164.00007FF8B78B9000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268040879.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321242799.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266016159.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2318890669.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269224887.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322097320.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-fibers-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265721119.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315920437.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\python38.pdb source: wsx.exe, 00000002.00000002.4723333080.00007FF8A8E04000.00000002.00000001.01000000.00000005.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723375067.00007FF8A7E24000.00000002.00000001.01000000.0000001A.sdmp, python38.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266112696.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319389209.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267638883.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320853844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source:	Binary string: C:\A\31\b\bin\amd64\_lzma.pdbMM source: wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725576617.00007FF8B916D000.00000002.00000001.01000000.0000000B.sdmp, registry_65f93d51.exe, 00000009.00000003.2312377234.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724695449.00007FF8B827D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2267504733.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320775294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_ctypes.pdb source: wsx.exe, 00000002.00000002.4725807752.00007FF8B9192000.00000002.00000001.01000000.00000008.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725192076.00007FF8B82C2000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32wnet.pdb source: wsx.exe, 00000000.00000003.2279561845.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327436277.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266842790.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320042183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.9.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:40:20 2020 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: wsx.exe, 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722693885.00007FF8A7617000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_queue.pdb source: wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724747960.00007FF8B90F3000.00000002.00000001.01000000.00000012.sdmp, registry_65f93d51.exe, 00000009.00000003.2312703924.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724537307.00007FF8B8253000.00000002.00000001.01000000.00000027.sdmp, _queue.pyd.9.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: wsx.exe, 00000000.00000003.2266500836.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319729844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: -c are executed after commands from .pdbrc files. source: wsx.exe, 00000002.00000002.4720209105.000001D6CE6DF000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267360213.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320610765.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269119940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322013187.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: wsx.exe, 00000000.00000003.2267090123.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320205484.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265532853.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314930930.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266404717.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319652327.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266500836.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319729844.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266698365.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319882300.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267289640.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320513643.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\3\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: wsx.exe, 00000000.00000003.2263634927.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2311210717.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Initial commands are read from .pdbrc files in your home directory source: wsx.exe, 00000002.00000002.4720209105.000001D6CE6DF000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_ssl.pdb source: wsx.exe, 00000002.00000002.4725193346.00007FF8B911D000.00000002.00000001.01000000.0000000E.sdmp, registry_65f93d51.exe, 0000000A.00000002.4724117939.00007FF8B782D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265342153.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2313965731.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268796940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321766183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269354500.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322173948.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267432361.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320693436.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266304966.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319574651.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267289640.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320513643.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268227688.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321398734.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269119940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322013187.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268318304.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321475345.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.9.dr
Source:	Binary string: d:\agent\_work\3\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: wsx.exe, 00000000.00000003.2263510921.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4727263141.00007FF8BFB30000.00000002.00000001.01000000.00000006.sdmp, registry_65f93d51.exe, 00000009.00000003.2310883925.000001BF40586000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725680215.00007FF8B8B00000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266580337.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319802950.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269022242.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321926554.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.9.dr
Source:	Binary string: placed in the .pdbrc file): source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\_overlapped.pdb source: wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4724454005.00007FF8B90D5000.00000002.00000001.01000000.00000017.sdmp, registry_65f93d51.exe, 00000009.00000003.2312593294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4726281498.00007FF8BA525000.00000002.00000001.01000000.0000002C.sdmp
Source:	Binary string: If a file ".pdbrc" exists in your home directory or in the current source: wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267798188.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321008115.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr, api-ms-win-core-util-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267432361.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320693436.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266210989.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319475363.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268439591.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321554854.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266112696.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319389209.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266929158.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320119867.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265628346.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315422600.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265818210.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316009389.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-fibers-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265721119.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315920437.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267504733.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320775294.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267958915.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321163060.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268796940.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321766183.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267798188.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321008115.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr, api-ms-win-core-util-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265439691.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314471193.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\6\b\libssl-1_1.pdb source: wsx.exe, 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723087461.00007FF8A7AF4000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265628346.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2315422600.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ucrtbase.pdbUGP source: wsx.exe, 00000002.00000002.4724039412.00007FF8B83A4000.00000002.00000001.01000000.00000004.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723851835.00007FF8A8024000.00000002.00000001.01000000.00000019.sdmp, ucrtbase.dll.9.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2269022242.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321926554.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267958915.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321163060.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\6\b\libssl-1_1.pdb?? source: wsx.exe, 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmp, registry_65f93d51.exe, 0000000A.00000002.4723087461.00007FF8A7AF4000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdbGCTL source: wsx.exe, 00000000.00000003.2265916752.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2316073120.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267207504.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320300217.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: wsx.exe, 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmp, registry_65f93d51.exe, 0000000A.00000002.4722693885.00007FF8A7617000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2265439691.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2314471193.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267878901.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321086900.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2268439591.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321554854.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266304966.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319574651.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268318304.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321475345.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2269354500.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2322173948.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\31\b\bin\amd64\select.pdb source: wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4725412867.00007FF8B9143000.00000002.00000001.01000000.0000000D.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4725502564.00007FF8B8833000.00000002.00000001.01000000.00000022.sdmp, select.pyd.0.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267715426.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320927539.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2267360213.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320610765.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: wsx.exe, 00000000.00000003.2266016159.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2318890669.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdbrc source: wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: wsx.exe, 00000000.00000003.2266404717.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319652327.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.9.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2266698365.000001AA0235B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2319882300.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2268931600.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321843970.000001BF40588000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdbGCTL source: wsx.exe, 00000000.00000003.2267090123.000001AA02355000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2320205484.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source:	Binary string: The standard debugger class (pdb.Pdb) is an example. source: wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE96B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDB33000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdbGCTL source: wsx.exe, 00000000.00000003.2267878901.000001AA02356000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2321086900.000001BF40588000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr

Source: wsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: wsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: wsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: wsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: wsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: api-ms-win-core-console-l1-1-0.dll.0.dr

Static PE information: 0x6F5B3627 [Thu Mar 15 05:56:55 2029 UTC]

Source: wsx.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: registry_65f93d51.exe.2.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.9.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.9.dr	Static PE information: section name: .00cfg
Source: VCRUNTIME140.dll.9.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A9335B81 push rcx; ret	2_2_00007FF8A9335B82
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7AC5B81 push rcx; ret	10_2_00007FF8A7AC5B82
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F8EB55 push rdi; ret	10_2_00007FF8A7F8EB5B
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7F6126A push qword ptr [rdi+rbp-01h]; ret	10_2_00007FF8A7F6126F

Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_cffi_backend.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_cffi_backend.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI18922\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71D3DD0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7E71D3DD0

Source: C:\Users\user\Desktop\wsx.exe

Code function: 2_2_00007FF8A8083251 rdtsc

2_2_00007FF8A8083251

Source: C:\Users\user\Desktop\wsx.exe	Window / User API: threadDelayed 1580	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Window / User API: threadDelayed 8418	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Window / User API: foregroundWindowGot 1776	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Window / User API: threadDelayed 8484	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Window / User API: threadDelayed 1514	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Window / User API: foregroundWindowGot 1777	Jump to behavior

Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_cffi_backend.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_cffi_backend.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\python38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32\pywintypes38.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography\hazmat\bindings\_openssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\wsx.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\wsx.exe	API coverage: 1.8 %
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	API coverage: 1.6 %

Source: C:\Users\user\Desktop\wsx.exe TID: 1120	Thread sleep count: 1580 > 30	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe TID: 1120	Thread sleep time: -790000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe TID: 1120	Thread sleep count: 8418 > 30	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe TID: 1120	Thread sleep time: -4209000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe TID: 6524	Thread sleep count: 8484 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe TID: 6524	Thread sleep time: -4242000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe TID: 6524	Thread sleep count: 1514 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe TID: 6524	Thread sleep time: -757000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71F08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71D7790 FindFirstFileExW,FindClose,	0_2_00007FF7E71D7790
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71F08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7E71F08E4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71D7790 FindFirstFileExW,FindClose,	2_2_00007FF7E71D7790
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF7E71E6644
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084471 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FF8A8084471
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5E08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5C7790 FindFirstFileExW,FindClose,	9_2_00007FF6BD5C7790
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	9_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5E08E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00007FF6BD5E08E4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5C7790 FindFirstFileExW,FindClose,	10_2_00007FF6BD5C7790
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D6644 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	10_2_00007FF6BD5D6644
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4471 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	10_2_00007FF8A73D4471

Source: wsx.exe, 00000000.00000003.2280085504.000001AA0235A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327919764.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.dr	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED0B6000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWoto %SystemRoot%\system32\mswsock.dllad() method that
Source: wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8086500	2_2_00007FF8A8086500
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A80863C0	2_2_00007FF8A80863C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D6500	10_2_00007FF8A73D6500
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D63C0	10_2_00007FF8A73D63C0

Source: C:\Users\user\Desktop\wsx.exe

Code function: 2_2_00007FF8A8083251 rdtsc

2_2_00007FF8A8083251

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71DB5DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E71DB5DC

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71F24D0 GetProcessHeap,

0_2_00007FF7E71F24D0

Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71DAFC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E71DAFC4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71DB7C0 SetUnhandledExceptionFilter,	0_2_00007FF7E71DB7C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71DB5DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E71DB5DC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 0_2_00007FF7E71E9A14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E71E9A14
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71DAFC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7E71DAFC4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71DB7C0 SetUnhandledExceptionFilter,	2_2_00007FF7E71DB7C0
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71DB5DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7E71DB5DC
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF7E71E9A14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7E71E9A14
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8084FED __scrt_fastfail,IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8084FED
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8A02A38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8A8A02A38
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8A033B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A8A033B4
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8A0359C SetUnhandledExceptionFilter,	2_2_00007FF8A8A0359C
Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A92F1D75 __scrt_fastfail,IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8A92F1D75
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5CB5DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF6BD5CB5DC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5CAFC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FF6BD5CAFC4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5CB7C0 SetUnhandledExceptionFilter,	9_2_00007FF6BD5CB7C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 9_2_00007FF6BD5D9A14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FF6BD5D9A14
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5CB5DC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF6BD5CB5DC
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5CAFC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF6BD5CAFC4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5CB7C0 SetUnhandledExceptionFilter,	10_2_00007FF6BD5CB7C0
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF6BD5D9A14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF6BD5D9A14
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A72C359C SetUnhandledExceptionFilter,	10_2_00007FF8A72C359C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A72C33B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8A72C33B4
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A72C2A38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF8A72C2A38
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D4FED __scrt_fastfail,IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8A73D4FED
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7A81D75 __scrt_fastfail,IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8A7A81D75
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A7FDC350 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8A7FDC350

Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Users\user\Desktop\wsx.exe "C:\Users\user\Desktop\wsx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /query /tn "registry_65f93d51.exe"	Jump to behavior

Source: wsx.exe, 00000002.00000002.4721891045.000001D6CF7A0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721938594.000001D6CF7E0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721601148.000001DEEE1D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: wsx.exe, 00000002.00000002.4721891045.000001D6CF7A0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721938594.000001D6CF7E0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721601148.000001DEEE1D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager0
Source: wsx.exe, 00000002.00000003.3239685469.000001D6CF7E0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721891045.000001D6CF7A0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721938594.000001D6CF7E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: program manager

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71F88E0 cpuid

0_2_00007FF7E71F88E0

Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: EnumSystemLocalesW,	10_2_00007FF8A7FDAA9C
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	10_2_00007FF8A7FDAB04
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	10_2_00007FF8A7FDABB8
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: EnterCriticalSection,__crt_fast_encode_pointer,EnumSystemLocalesW,LeaveCriticalSection,	10_2_00007FF8A7FD8D68
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00007FF8A7FDB024
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00007FF8A7FDB1E4

Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md.cp38-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md__mypyc.cp38-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\certifi\cacert.pem VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Roaming VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\lockfile VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\wsx.exe	Queries volume information: C:\Users\user\Desktop\wsx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\ucrtbase.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Queries volume information: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71DB4C0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E71DB4C0

Source: C:\Users\user\Desktop\wsx.exe

Code function: 0_2_00007FF7E71F4D50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7E71F4D50

Source: C:\Users\user\Desktop\wsx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\wsx.exe	Code function: 2_2_00007FF8A8085DB7 bind,WSAGetLastError,		2_2_00007FF8A8085DB7
Source: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe	Code function: 10_2_00007FF8A73D5DB7 bind,WSAGetLastError,		10_2_00007FF8A73D5DB7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	22 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wsx.exe	11%	ReversingLabs
wsx.exe	14%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_cffi_backend.cp38-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-fibers-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\bcrypt\_bcrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md.cp38-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md__mypyc.cp38-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography\hazmat\bindings\_openssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\python38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32\pywintypes38.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI18922\win32wnet.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_cffi_backend.cp38-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pontoslivelobb.servicos.ws	191.252.83.191	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
estudosadulto.educacao.ws	94.156.67.32	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://pontoslivelobb.servicos.ws/conta.php	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/asweigart/pyperclip/issues/55	wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.xrampsecurity.com/XGCA.crll__.	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pontoslivelobb.servicos.ws/conta.phprg	wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cloud.google.com/appengine/docs/standard/runtimes	wsx.exe, 00000002.00000002.4719763286.000001D6CE3D0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719870837.000001DEED690000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/mhammond/pywin32	wsx.exe, 00000000.00000003.2279561845.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277366073.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326414155.000001BF4058A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327436277.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.python.org/library/unittest.html	wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pontoslivelobb.servicos.ws/salva.php	wsx.exe, 00000002.00000002.4719580106.000001D6CE2D0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719712925.000001DEED590000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.python.org/download/releases/2.3/mro/.	wsx.exe, 00000002.00000002.4718850807.000001D6CD760000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290828612.000001D6CDDB1000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718867536.000001DEECED0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://tools.ietf.org/html/rfc2388#section-4.4	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.apache.org/licenses/LICENSE-2.0	wsx.exe, 00000000.00000003.2280623300.000001AA02368000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2280497122.000001AA0235A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2280468813.000001AA02368000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328328440.000001BF40599000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF40599000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	wsx.exe, 00000002.00000002.4721431850.000001D6CEDB0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721388934.000001DEEE070000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://codecov.io/github/pyca/cryptography/coverage.svg?branch=master	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
http://crl.dhimyotis.com/certignarootca.crl	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://curl.haxx.se/rfc/cookie_spec.html	wsx.exe, 00000002.00000002.4720967947.000001D6CEAC0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720357983.000001DEED980000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://ocsp.accv.es	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.python.org/dev/peps/pep-0205/	wsx.exe, 00000000.00000003.2279765483.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719280774.000001D6CDFF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2327588294.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719310887.000001DEED2B0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	wsx.exe, 00000002.00000002.4721391137.000001D6CED70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721388934.000001DEEE070000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c	wsx.exe, 00000002.00000002.4721239599.000001D6CEC70000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://estudosadulto.educacao.ws/contador/contador.php	wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE777000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721310829.000001D6CECF0000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721473524.000001D6CEE00000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4721062499.000001D6CEB40000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721601148.000001DEEE1D0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721429022.000001DEEE0C0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721021413.000001DEEDE00000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721273657.000001DEEDFB0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED390000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://json.org	registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED4CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	wsx.exe, 00000002.00000002.4718686995.000001D6CD660000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718710013.000001DEECC90000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://httpbin.org/get	registry_65f93d51.exe, 0000000A.00000002.4721200938.000001DEEDF30000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://httpbin.org/	wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.92.246.171:5000/replace	registry_65f93d51.exe, 0000000A.00000002.4719712925.000001DEED590000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://wwww.certigna.fr/autorites/0m	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://codecov.io/github/pyca/cryptography?branch=master	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://httpbin.org/	wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.apache.org/licenses/	wsx.exe, 00000000.00000003.2280497122.000001AA0235A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328258629.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://wwww.certigna.fr/autorites/	registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pontoslivelobb.servicos.ws/conta.phprg)	wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://repository.swisssign.com/t	registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	wsx.exe, 00000002.00000003.2289908865.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2291758750.000001D6CBE90000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290464010.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290287018.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290158960.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2289611735.000001D6CBE5B000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000003.2290609085.000001D6CBE5A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEAFED000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2331071299.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329999010.000001DEEB03C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2329900306.000001DEEB041000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330062853.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330349702.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718119614.000001DEEB08B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cryptography.io/en/latest/installation.html	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
http://crl.securetrust.com/STCA.crl	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/STCA.crl__exit__c	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://wwwsearch.sf.net/):	wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEED9C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/legislacion_c.htm	wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	wsx.exe, 00000002.00000002.4719910052.000001D6CE4E0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720018075.000001DEED7A0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.xrampsecurity.com/XGCA.crl0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cert.fnmt.es/dpcs/	wsx.exe, 00000002.00000002.4718299020.000001D6CBDDE000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es00	wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	registry_65f93d51.exe, 0000000A.00000003.2330602280.000001DEEB06C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pyca/cryptography/issues	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://readthedocs.org/projects/cryptography/badge/?version=latest	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	wsx.exe, 00000002.00000002.4719391565.000001D6CE211000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://google.com/	registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mahler:8092/site-updates.py	wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332400133.000001DEEB0C6000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332488463.000001DEEB0C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html	wsx.exe, 00000002.00000002.4719945013.000001D6CE530000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720060998.000001DEED7F0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://estudosadulto.educacao.ws/contador/contador.php0	wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/SGCA.crl	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.p	wsx.exe, 00000002.00000002.4720673524.000001D6CE9B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://.../back.jpeg	wsx.exe, 00000002.00000002.4721018755.000001D6CEB00000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720985405.000001DEEDDC0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/pyca/cryptography	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://cryptography.io/	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	wsx.exe, 00000002.00000002.4719832400.000001D6CE450000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719943391.000001DEED710000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.python.org/	wsx.exe, 00000002.00000002.4720209105.000001D6CE80F000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332400133.000001DEEB0C6000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2332488463.000001DEEB0C8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://httpbin.org/post	wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error	wsx.exe, 00000002.00000002.4721204773.000001D6CEC30000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721156944.000001DEEDEF0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/Ousret/charset_normalizer	wsx.exe, 00000002.00000002.4720209105.000001D6CE793000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED569000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/urllib3/urllib3/issues/497	registry_65f93d51.exe, 0000000A.00000002.4719870837.000001DEED690000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.firmaprofesional.com/cps0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/SGCA.crl0	wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/STCA.crl0	wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.quovadisglobal.com/cpsd	registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://yahoo.com/	wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	wsx.exe, 00000002.00000002.4719391565.000001D6CE0C0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333794430.000001DEED42A000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED3B0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333601164.000001DEED401000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	wsx.exe, 00000000.00000003.2265229722.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://w3c.github.io/html/sec-forms.html#multipart-form-data	wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED4CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://docs.microsof	registry_65f93d51.exe, 0000000A.00000002.4720778267.000001DEEDC94000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mail.python.org/mailman/listinfo/cryptography-dev	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://requests.readthedocs.io	wsx.exe, 00000002.00000002.4721204773.000001D6CEC30000.00000004.00001000.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721156944.000001DEEDEF0000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://repository.swisssign.com/	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDB8C000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://python.org/dev/peps/pep-0263/	python38.dll.0.dr	false		unknown
http://crl.xrampsecurity.com/XGCA.crl	registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://repository.swisssign.com/Hd	registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDAE1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://repository.swisssign.com/0R	wsx.exe, 00000002.00000002.4720209105.000001D6CE893000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.python.org	wsx.exe, 00000002.00000002.4719019125.000001D6CDE98000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000003.2333460204.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719438072.000001DEED3B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/legislacion_c.htm0U	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.accv.es0	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4720403641.000001DEEDBBE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	wsx.exe, 00000000.00000003.2274110280.000001AA02362000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264080444.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275028844.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275950894.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264467594.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264770739.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2277501724.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264228352.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276567966.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2279137450.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264691239.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2276083050.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2275609971.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264596873.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264365268.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263747195.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2264864812.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2263839273.000001AA02354000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000000.00000003.2274110280.000001AA02359000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2326535528.000001BF4058B000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2312259416.000001BF40588000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings	registry_65f93d51.exe, 0000000A.00000002.4719943391.000001DEED710000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://cryptography.io/en/latest/security.html	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
https://twitter.com/	wsx.exe, 00000002.00000002.4718299020.000001D6CBE7E000.00000004.00000020.00020000.00000000.sdmp, wsx.exe, 00000002.00000002.4719019125.000001D6CDDB0000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED165000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsPv	wsx.exe, 00000002.00000002.4719727193.000001D6CE390000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4719831009.000001DEED650000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps	wsx.exe, 00000002.00000002.4720209105.000001D6CE8C8000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED090000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://img.shields.io/pypi/v/cryptography.svg	wsx.exe, 00000000.00000003.2280855435.000001AA0235D000.00000004.00000020.00020000.00000000.sdmp, registry_65f93d51.exe, 00000009.00000003.2328495473.000001BF4058E000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false		unknown
http://google.com/mail/	registry_65f93d51.exe, 0000000A.00000002.4718994312.000001DEED0DF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate	wsx.exe, 00000002.00000002.4721352219.000001D6CED30000.00000004.00001000.00020000.00000000.sdmp, registry_65f93d51.exe, 0000000A.00000002.4721308581.000001DEEDFF0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://estudosadulto.educacao.ws/contador/contador.php0wt	wsx.exe, 00000002.00000002.4721755051.000001D6CF710000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
191.252.83.191	pontoslivelobb.servicos.ws	Brazil		27715	LocawebServicosdeInternetSABR	false
94.156.67.32	estudosadulto.educacao.ws	Bulgaria		31420	TERASYST-ASBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523266
Start date and time:	2024-10-01 11:36:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wsx.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@21/160@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 40.126.32.133, 40.126.32.138, 20.190.160.17, 40.126.32.136, 20.190.160.14, 20.190.160.22, 40.126.32.140, 20.190.160.20, 104.208.16.94, 13.89.179.12
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:37:57	API Interceptor	2820625x Sleep call for process: wsx.exe modified
05:38:02	API Interceptor	2369061x Sleep call for process: registry_65f93d51.exe modified
11:37:24	Task Scheduler	Run new task: registry_65f93d51.exe path: C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
191.252.83.191	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	pontoslivelobb.servicos.ws/conta.php
94.156.67.32	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
estudosadulto.educacao.ws	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	94.156.67.32
fp2e7a.wpc.phicdn.net	https://thubanoa.com/1?z=8001368	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://app.getresponse.com/change_details.html?x=a62b&m=BrgFNl&s=BW9rcZD&u=C3YQM&z=EMkQID6&pt=change_details	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://abby-gatenby.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVNucEJVREU9JnVpZD1VU0VSMDMwOTIwMjRVNDYwOTAzMDE=N0123N	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://assets.watchasync.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	Adjunto factura.vbs	Get hash	malicious	Unknown	Browse	192.229.221.95
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.229.221.95
	https://www.afghanhayatrestaurant.com.au/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://www.polorestobar.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://jv.prenticeu.com/SAFlSIeECgRZt_tUKXhAOQHYyqb5e4/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
pontoslivelobb.servicos.ws	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	191.252.83.191

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TERASYST-ASBG	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	94.156.67.32
	https://www.google.to/url?url=https://bxaxlsoggszcwwbz&nzc=vvjpqcc&suvkdk=cmz&kwdec=vutety&cbb=sslsceg&pagnn=fuhmpw&dkqf=mwwhastk&ffmvozjupo=yqbyougxxo&q=amp/gm5bqhj.g%C2%ADb%C2%ADe%C2%ADym%C2%ADw%C2%ADc%C2%ADg%C2%ADv%C2%ADk%C2%ADb%C2%ADd%C2%ADevll.com%E2%80%8B/cbvogermm&clnw=xokmakg&dhxrdhh=zgwr&tievm=savxww&gfpizxn=fnv	Get hash	malicious	HTMLPhisher	Browse	94.156.64.140
	https://editdoucsign.pages.dev/?email=3mail@b.c	Get hash	malicious	HTMLPhisher	Browse	94.156.66.124
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	94.156.69.75
	PersonalizedOffer.exe	Get hash	malicious	UltraVNC	Browse	94.156.69.75
	SecuriteInfo.com.Win32.MalwareX-gen.15249.22466.exe	Get hash	malicious	Unknown	Browse	94.156.71.53
	file.exe	Get hash	malicious	Unknown	Browse	94.156.68.124
	file.exe	Get hash	malicious	Unknown	Browse	94.156.65.70
	CorelDRAWGraphicsSuite202425.2.0.301x64MultilingualUpdate.exe	Get hash	malicious	Quasar, DarkTortilla	Browse	94.156.64.45
	killua.x86_64.elf	Get hash	malicious	Unknown	Browse	94.156.71.92
LocawebServicosdeInternetSABR	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse	191.252.83.191
	https://emailmarketing.locaweb.com.br/accounts/194439/messages/7/clicks/116375/9?envelope_id=7/	Get hash	malicious	Unknown	Browse	186.202.135.207
	http://emailmarketing.locaweb.com.br/accounts/194439/messages/3/clicks/14727/3/	Get hash	malicious	Unknown	Browse	186.202.135.207
	Oficio notificacion multas y sanciones.vbs	Get hash	malicious	Njrat	Browse	191.252.83.213
	Bb65bKypZP.vbs	Get hash	malicious	Unknown	Browse	191.252.83.213
	u30wlJmZuT.vbs	Get hash	malicious	Unknown	Browse	191.252.83.213
	bF9JDHS47l.vbs	Get hash	malicious	Remcos	Browse	191.252.83.213
	TPFK2rYosu.vbs	Get hash	malicious	Unknown	Browse	191.252.83.213
	TDjIl6ldeJ.vbs	Get hash	malicious	Unknown	Browse	191.252.83.213
	0Zdq4t4SKO.vbs	Get hash	malicious	Unknown	Browse	191.252.83.213

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140.dll	Deolane-Video-PDF.vbs	Get hash	malicious	Unknown	Browse
	https://symless.com/synergy/synergy/api/download/synergy-win_x64-v3.0.79.1-rc3.msi	Get hash	malicious	Unknown	Browse
	DKLmoAuzkA.exe	Get hash	malicious	CobaltStrike	Browse
	https://api-functions.prod.a.symless.com/download-log?synergyVersion=3.0.66.22-beta&operatingSystem=Windows&architecture=64-bit&downloadUrl=https%3A%2F%2Frc.symless.com%2Fsynergy3%2Fv3.0.66.22-beta%2Fsynergy-win_x64-v3.0.66.22-beta.msi&userId=886628	Get hash	malicious	Unknown	Browse
	Nk77hIlehl.exe	Get hash	malicious	Unknown	Browse
	Nk77hIlehl.exe	Get hash	malicious	Unknown	Browse
	Nk77hIlehl.exe	Get hash	malicious	Unknown	Browse
	UQqngcmYAa.exe	Get hash	malicious	Unknown	Browse
	4KCaptureUtility_1.7.9.4940_x64.msi	Get hash	malicious	Unknown	Browse
	run.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101664
Entropy (8bit):	6.561877023049057
Encrypted:	false
SSDEEP:	1536:yCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+9C7ecbGSh9ZR0Fa:yFWY1WxgGStJ8HaC7ecbG2Ga
MD5:	18571D6663B7D9AC95F2821C203E471F
SHA1:	3C186018DF04E875D6B9F83521028A21F145E3BE
SHA-256:	0B040A314C19FF88F38FD9C89DCA2D493113A6109ADB8525733C3F6627DA888F
SHA-512:	C8CBCA1072B8CB04F9D82135C91FF6D7A539CB7A488671CECB6B5E2F11A4807F47AD9AF5A87EBEE44984AB71D7C44FC87850F9D04FD2C5019EC1B6A1B483CA21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Deolane-Video-PDF.vbs, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: DKLmoAuzkA.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Nk77hIlehl.exe, Detection: malicious, Browse Filename: Nk77hIlehl.exe, Detection: malicious, Browse Filename: Nk77hIlehl.exe, Detection: malicious, Browse Filename: UQqngcmYAa.exe, Detection: malicious, Browse Filename: 4KCaptureUtility_1.7.9.4940_x64.msi, Detection: malicious, Browse Filename: run.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d......^.........." .........^......................................................v=....`A.........................................0..4....9.......p.......P.......L.. A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44328
Entropy (8bit):	6.619269527509389
Encrypted:	false
SSDEEP:	384:qim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXfIfy85xM8AT5WrmKWkrWiS:qIe8kySL2iPQxdvjAevMM5vAWtNyjS
MD5:	A4F89FFC725CCAE3C7BBCB9A0C91302F
SHA1:	531194DAD6795B3CB50B02501B0856EFA694DD36
SHA-256:	BBCEA93943F7E28A4D904301FF4BB708ADAEC4CC27800020044085FB838D4E5D
SHA-512:	C8CE2DCB65CD1FD0A7FFDC1DF0076BE2882BADAC7082B49FF96EC2CA1E944CCAB8699AB28901A895CCA90783CD223434552E366103FB6FCD25D9AD033B95EEDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d......^.........." .....:...4......pA...................................................`A.........................................j......\|k..x....................l..(A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63560
Entropy (8bit):	5.8738277266687575
Encrypted:	false
SSDEEP:	1536:ddA7ll/y7vFtIrfKqnXM7KXsssS9ZINsn8ByvK:dUll/WFAfnXMOX5PZINsnNK
MD5:	7DD62E9903D66377D49D592B6E6DAC82
SHA1:	2B6BEC5D58CD4A7F0EAA809179461DBDB527D4F7
SHA-256:	29712C65138FC02208D8575A8EF188D69947464DD0DC2BE53F34C8DA81A82F06
SHA-512:	9BC8526C6C9EBA3682848277079457BB443A516CDBF3F10D281763A37483E7C6929AFEDDD7D9663E3573DD03665230395CEC7C60EA3F1671DF93628A665822AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f."..."..."...+.R. ....... .......).............. ......!...y... ...".........#......#....>.#......#...Rich"...................PE..d...P.._.........." .....\................................................... ...........`.............................................P...`...d.......................H.......p....v..T............................v...............p..0............................text...<Z.......\.................. ..`.rdata..HI...p...J...`..............@..@.data...( ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86088
Entropy (8bit):	6.376772954999528
Encrypted:	false
SSDEEP:	1536:i2g2Q9bRpNtjKjhtgc7JV+kwu0D9sl8/PFXPpQBIN4V/y8R:Jg2Qbvo0cV4kwu0D9sK/9XPpQBIN4VJR
MD5:	FC0D862A854993E0E51C00DEE3EEC777
SHA1:	20203332C6F7BD51F6A5ACBBC9F677C930D0669D
SHA-256:	E5DE23DBAC7ECE02566E79B3D1923A8EEAE628925C7FB4B98A443CAD94A06863
SHA-512:	B3C2ADE15CC196E687E83DD8D21CE88B83C8137A83CFC20BC8F2C8F3AB72643EF7CA08E1DC23DE0695F508BA0080871956303AC30F92AB865F3E4249D4D65C2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.00..^c..^c..^c...c..^c.._b..^c.R.c..^c..[b..^c..Zb..^c..]b..^c.._b..^cN._b..^c.._ct.^c..Sb..^c..^b..^c...c..^c..\b..^cRich..^c........PE..d...e.._.........." .........h..............................................p.......^....`.........................................0...H...x........P.......@..4....6..H....`..........T...............................................H............................text............................... ..`.rdata..rB.......D..................@..@.data........0......................@....pdata..4....@......................@..@.rsrc........P.......(..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_cffi_backend.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177664
Entropy (8bit):	6.158534074101028
Encrypted:	false
SSDEEP:	3072:8QY/et3+F8qiO1dmSzbo0+tMv5J5S7wbSTLLKCR8LpA:xwEuF8qXsSzESxThbSTLeCOLp
MD5:	4173EC9FE8F83845BBAF61D8C313A30A
SHA1:	D0A6095964150230EDE434506E167F1DEE731296
SHA-256:	3DF50B1E9FADC6D006C712D2A80A96AE0A286EFD82F9A4160439C75D2BE4D7B4
SHA-512:	17C6E083CAFB7D6B6DCFAD4960F04E3754A5C0D1AE70F1AE8B91421C4AFCBE32D44611FEC29D295A36573007674510AF9992DAA3057548EFFCCCA772602FA435
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C..#...p...p...p...p...p.7.q...p.7\|p...p.7.q...p.7.q...p.7.q...pL.q...p...q...p...p...p.0.q...p...p...p.0.q...p.0~p...p.0.q...pRich...p........................PE..d...!~.f.........." ...(.....@.............................................. ............`.........................................pV..h....V.......................................=..............................p<..@............................................text............................... ..`.rdata..............................@..@.data....].......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	126024
Entropy (8bit):	5.9027294934540775
Encrypted:	false
SSDEEP:	3072:97uYeVDxa+yVfZgV2JjtiAEUBfeT0jJRZBFU8RdINVPS:9K383gIj/feTgJRX
MD5:	8ADB1345C717E575E6614E163EB62328
SHA1:	F1EE3FFF6E06DC4F22A5EB38C09C54580880E0A3
SHA-256:	65EDC348DB42347570578B979151B787CEEBFC98E0372C28116CC229494A78A8
SHA-512:	0F11673854327FD2FCD12838F54C080EDC4D40E4BCB50C413FE3F823056D189636DC661EA79207163F966719BF0815E1FFA75E2FB676DF4E56ED6321F1FF6CAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........gq..............~.......k.......k.......k.......k......Xh.......n.......n......^o..........!...Xh......Xh......Xh......Xh......Rich............................PE..d...[.._.........." .................^....................................................`..........................................r......4s..................d.......H...........P-..T............................-............... ..p............................text...i........................... ..`.rdata...n... ...p..................@..@.data....>.......:...v..............@....pdata..d...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	266824
Entropy (8bit):	6.520816772363595
Encrypted:	false
SSDEEP:	6144:mYXkBpKJU7vSJL9cu4eSOolgjozIQk9qWMa3pLW1AG4visa2OGuQaN:oBpKJGSpslDsQ+Ju5N
MD5:	49B8CD4D750FE59ADFB1CF8252C3EFE0
SHA1:	01F6E81B46F417233262DF5282E233FDAD369686
SHA-256:	0AF14298B022D615FC12DE4034068985928FE6B7AB6BAE3F5BE3A8ADAD379074
SHA-512:	EEA62D90D09502EB1ED425DD7C43355356C94F35740B78469DB6D74B7C362ECEC01806B1E1071BB741D68391996F8960B4642E98831525EE2886867D202CD07C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@2F..S(..S(..S(..+...S(..>)..S(..>-..S(..>,..S(..>+..S(..=)..S(._;)..S(..S)..S(..=+..S(..=%..S(..=(..S(..=..S(..=..S(.Rich.S(.........PE..d...S.._.........." .........F......$........................................0......$.....`.........................................`...P........................+......H.... ..P.......T...............................................(............................text...@........................... ..`.rdata..............................@..@.data...H.......$..................@....pdata...+.......,..................@..@.rsrc...............................@..@.reloc..P.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46152
Entropy (8bit):	5.9492510690836475
Encrypted:	false
SSDEEP:	768:4OUT3iMTYwbDU5496lvj3UEPKhievaZoZINsIm0WDG4yHo:4OrBwbDQdjEphfvCoZINsImhyHo
MD5:	5FA7C9D5E6068718C6010BBEB18FBEB3
SHA1:	93E8875D6D0F943B4226E25452C2C7D63D22B790
SHA-256:	2E98F91087F56DFDFFBBDD951CD55CD7EA771CEC93D59CADB86B964ED8708155
SHA-512:	3104AA8B785740DC6A5261C27B2BDC6E14B2F37862FA0FBA151B1BC1BFC0E5FB5B6934B95488FA47C5AF3FC2B2283F333FF6517B6F8CF0437C52CF171DA58BF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................?.....-......-....-....-......d............c............d......d......d.S.....d......Rich............PE..d...e.._.........." .....@...\.......2..............................................OQ....`..........................................v..P....v..........................H...........0X..T............................X...............P...............................text....>.......@.................. ..`.rdata..D4...P...6...D..............@..@.data...h............z..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162376
Entropy (8bit):	6.760133023586482
Encrypted:	false
SSDEEP:	3072:DfVedVAw2nIhmc8sWOwPhE8qENIawGWp1ZB4Vzxznfo9mNoF32YIUVbFBINH1d:DfVedVYnWmS9we8G9ZB4DwYOFZIUzU
MD5:	60E215BB78FB9A40352980F4DE818814
SHA1:	FF750858C3352081514E2AE0D200F3B8C3D40096
SHA-256:	C4D00582DEE45841747B07B91A3E46E55AF79E6518EC9F0CE59B989C0ACD2806
SHA-512:	398A441DE98963873417DA6352413D080620FAF2AE4B99425D7C9EAF96D5F2FDF1358E21F16870BDFF514452115266A58EE3C6783611F037957BFA4BCEC34230
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T......K...K...K...K...K..J...K..J...K..J...K..J...K..J...KK.J...K...Kq..K..J*..K..J...K..mK...K..J...KRich...K................PE..d...p.._.........." .....\|..........84....................................................`.........................................p6..L....6..x............`.......`..H.......$.......T...........................`...................0............................text...!z.......\|.................. ..`.rdata..............................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................R..............@..@.reloc..$............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29256
Entropy (8bit):	5.9682801135376815
Encrypted:	false
SSDEEP:	384:oQybRGaX9IGnrQa4qtpj4Y54JP7gR0478sn5pINkBLpXSnYPLxDG4y8RG4:oD8qCG0aZcJDux35pINktpiWDG4ys
MD5:	E322BEF009567F51A5B50580EA358B84
SHA1:	8518BCF80EBC1A7359EC924C7D246748EC3B0B08
SHA-256:	AC50CDC428714DD5F411CA45AA1196E99075755B4719D17B2929E94C5E868AEF
SHA-512:	3970106FA397B7B5F2C354E9A433AA50164A742296D102C94111F00F60972295E426486016341D180FDA05532E7CD5F753F9FDBAD158E9759FE55EBE5EFBC2D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v...............oi.....+z......+z......+z......+z......by....................by......by......by......by......Rich....................PE..d...T.._.........." ..... ...:......X...............................................z"....`..........................................@..`....@..x....p.. ....`.......X..H............3..T............................4...............0...............................text............ .................. ..`.rdata..$....0.......$..............@..@.data...h....P.......@..............@....pdata.......`.......F..............@..@.rsrc... ....p.......J..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45640
Entropy (8bit):	6.029273550521059
Encrypted:	false
SSDEEP:	768:GjJDGL+xD1jf2SnI1KseKVoYWE50vnIBkBovVINJtKkWDG4yR7:GjJ6+2CI1KJ20vnIBJvVINJtKRyJ
MD5:	DA51560431C584706D9A9E3E40E82CFE
SHA1:	E60C22A05FD6A34C95F46DC17292F8C4D5E8C332
SHA-256:	EF1BB6ABEDC9A6E156ECA16AA53E836948DEB224CDC0C5FC05E7816F860C38A9
SHA-512:	555AA6FD084B0675D629BF79711C91899D178735E4B1B9F9AC4C13D7F01E0A3D8F6436699E37922F04BAFFEF32EFF540EF4BACE6B58E3BAFAFA021DDC12564EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................F................................D...........................D......D......D.*....D......Rich...........................PE..d...V.._.........." .....@...Z......h................................................4....`..........................................v..X...Hw..........................H...........@W..T............................W...............P...............................text...J?.......@.................. ..`.rdata...4...P...6...D..............@..@.data...`............z..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28232
Entropy (8bit):	6.026784322519284
Encrypted:	false
SSDEEP:	384:5fzd3kPmXE/K/15JGsNi6rDcDRmOnx+cECdINqUTnYPLxDG4y8RGF9uE:V7XE/KLJa6rDaRm4DdINqUTWDG4yF9uE
MD5:	1FC2C6B80936EFC502BFC30FC24CAA56
SHA1:	4E5B26FF3B225906C2B9E39E0F06126CFC43A257
SHA-256:	9C47A3B84012837C60B7FECED86ED0A4F12910A85FD259A4483A48CD940E3514
SHA-512:	D07655D78ACA969CCC0D7CEDF9E337C7B20082D80BE1D90D69C42BE933FBAB1C828316D2EB5461DED2FF35E52762E249FC0C2BCCBC2B8436488FB6A270D3D9EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f."..."..."...+.V. ....... .......).......*....... ......!...y... ..."...a......#......#....:.#......#...Rich"...........PE..d...T.._.........." .........8............................................................`.........................................`B..L....B..d....p.......`.......T..H.......l...@3..T............................3...............0..8............................text...l........................... ..`.rdata..J....0......."..............@..@.data........P.......>..............@....pdata.......`.......B..............@..@.rsrc........p.......F..............@..@.reloc..l............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78920
Entropy (8bit):	6.068138139328106
Encrypted:	false
SSDEEP:	1536:SKmx5snrlAdD68Asd9/s+7+pIlxRjDzrdINVwayv:JmxqnBwAsd9/se+pIxRPzrdINVw1
MD5:	1D53841BB21ACDCC8742828C3ADED891
SHA1:	CDF15D4815820571684C1F720D0CBA24129E79C8
SHA-256:	AB13258C6DA2C26C4DCA7239FF4360CA9166EA8F53BB8CC08D2C7476CAB7D61B
SHA-512:	0266BCBCD7CA5F6C9DF8DBEEA00E1275932DACC38E5DD83A47BFBB87F7CA6778458A6671D8B84A63AE9216A65975DA656BA487AC28D41140122F46D0174FA9F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z...z...z...s.-.~......x......v......r......x......x...!..}...z.........{......{.....A.{......{...Richz...........................PE..d...f.._.........." .....x...................................................`...........`......................................... ...P...p........@.......0..........H....P...... ...T............................................................................text...Xv.......x.................. ..`.rdata...v.......x...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153672
Entropy (8bit):	5.895447412110481
Encrypted:	false
SSDEEP:	3072:HlO4VRd4tXxAhr2uVk/Zytv7OazgnBYi5qTEVfa+MuUqZBIN47+:FD4tXyZ2AQytCazgatqZS
MD5:	84DEA8D0ACCE4A707B094A3627B62EAB
SHA1:	D45DDA99466AB08CC922E828729D0840AE2DDC18
SHA-256:	DCF6B3FF84B55C3859D0F176C4CE6904C0D7D4643A657B817C6322933DBF82F6
SHA-512:	FDAA7EB10F8BF7B42A5C9691F600EFF48190041A8B28A5DAB977170DB717FFF58DD0F64B02CA30D274552FF30EE02A6577F1465792CF6760366C2588BF373108
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................'...'.....'.....'...n...i.....................n...n...n.i...n...Rich..........................PE..d...h.._.........." .........................................................p............`.............................................d............P.......@.......>..H....`..........T............................................................................text............................... ..`.rdata..............................@..@.data....k.......f..................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.729352106249244
Encrypted:	false
SSDEEP:	192:+zOGWZhWsWJWadJCsVWQ4OW4f/hHssDX01k9z3AHQH4i/vN:+zBWZhWZCsFf/FDR9zcQvv
MD5:	4A8F3A1847F216B8AC3E6B53BC20BD81
SHA1:	F5AADC1399A9DA38087DF52E509D919D743E3EA7
SHA-256:	29B7D786D9F421765A4F4904F79605C41E17C0A24D7F91E44C0B7B0DEA489FC3
SHA-512:	E70D2B719517C413FA967CA1A8D224299AF55D988B3CC28013AAA3677660FAE9ECB6F858D31C08CD8A0888F932AF1384F0EAA928C002200F0710C2D5BDDCED1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...'6[o.........." ...&.....0...............................................@.......t....`A........................................p...,............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.582853727629458
Encrypted:	false
SSDEEP:	192:SWZhWpWEXCVWQ4KWgfYXxwVIX01k9z3A2rZ2Co:SWZhWGVWR9zL12j
MD5:	D7AD8DB12FF42D620A657127DADA1D88
SHA1:	0CA381C734A3A93DC5F19C58DADFDCA9D1AFCCD8
SHA-256:	26054D8FEBAB1AACF11AA5CB64055808CD33388A8E77D0B3BCBC7543B0EEA3BD
SHA-512:	7E2D6B60ADBF97B22AB4B66691E483827D5755CFC6FCB5224369ADA53CBD8CDA43C4694A000EA4B5CEBC69A475B54DF0E9694C20AFD9EC62B4DB7B22241BDC45
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.56864151469395
Encrypted:	false
SSDEEP:	192:JWZhW9VWJWadJCsVWQ4mWJfTBm+0U8X01k9z3Ar+bP:JWZhWiCsofTBmo8R9zY+P
MD5:	C68A86C180FF1FCAC90D1DA9A08179C1
SHA1:	C287951441C957931DC4EBBEE4DC9426A4501554
SHA-256:	2C91C4861E88C92693A1B145EBE2F69FFB90797CD42061E2D84F3D7FC009A941
SHA-512:	857FBF9852596EF7263D8FAF970128487413C859246F58B15CEC32D11576894C47211A3BD9005F86C2A28FA6B67FBA96831C4953C0FA24E2373A6DAECB85E121
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......}.........." ...&.....0...............................................@.......n....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.635214855201274
Encrypted:	false
SSDEEP:	192:hPmxD3jPWZhWUzWJWadJCsVWQ4KW8xwVIX01k9z3A2rEUOdu:hPAPWZhWUqCsLR9zLANA
MD5:	A17FF429442D4E5298F0FAF95950A77D
SHA1:	522A365DAD26BEDC2BFE48164DC63C2C37C993C3
SHA-256:	8E9D1D206DA69DA744D77F730233344EBE7C2A392550511698A79CE2D9180B41
SHA-512:	7D4E31251C171B90A0C533718655C98D8737FF220BCC43F893FF42C57AB43D82E6BD13FA94DEF5BB4205CAEC68DC8178D6B2A25AD819689F25DAD01BE544D5AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...h..,.........." ...&.....0...............................................@............`A........................................p................0...............0..8&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-fibers-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.5745435750793515
Encrypted:	false
SSDEEP:	192:NyWZhWPWEXCVWQ4OW+shHssDX01k9z3AHQHBhuWC:QWZhWEnsFDR9zcQk
MD5:	73DD550364215163EA9EDB537E6B3714
SHA1:	C24FCADFEE877D5402E2B4F8518C4F5F4A2CE4B4
SHA-256:	0235C78780EFF0BD34FCE01D1C366E5E5936EA361676CB9711A4CFFF747D457A
SHA-512:	2406D9D44D3ED86A95248B25CF574E0C06533CD916048A2FACD68F4DB48E49E8E8CE1917091BCFB273D0ACC210697CEB659930C896E51464C300EC06476D8CC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....+............" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	4.87194572901717
Encrypted:	false
SSDEEP:	192:1whDPvVr8rFTsKWZhWgWEXCVWQ4KWiOcADB6ZX01k9z3AT2s7u:WJPvVrQWZhW7KcTR9zW2s6
MD5:	ECEE1B7DA6539C233E8DEC78BFC8E1F9
SHA1:	052BA049F6D8CD5579E01C9E2F85414B15E6CBF8
SHA-256:	249D7CD1C87738F87458B95ACE4AB8F87B0DE99EEEFB796F6B86CBA889D49B2C
SHA-512:	EA21FE20336B8170B2A8CD13DF217E9EE87AA1D2B0BA476BEE2A97C3FCE57648C9AB664B9BA895D5BBBCD119F2BB6633BEDC85DAFBD7BF6853AA48B168A927F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......b.........." ...&.....@...............................................P......A.....`A........................................p...x............@...............@..(&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.608548224344036
Encrypted:	false
SSDEEP:	192:u7xmWZhWlWEXCVWQ4KWs8HjKDUX01k9z3AmaS+5:u1mWZhWSYpR9zX78
MD5:	3473BC217562594B5B126D7AEB9380E9
SHA1:	B551B9D9AA80BE070F577376E484610E01C5171A
SHA-256:	0D8190FD619FEB20DF123931108D499132F7051F1EBB0EF246082F4C52C88B22
SHA-512:	036B93457ADE632AD68264D81FF26EE1156038E234C606882386D6BABCBE722A18E9CED1655F97CAECAF5FD514E261DAFE999A3E9FEC00CC677E177F0BF8E203
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...D............." ...&.....0...............................................@............`A........................................p...L............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.41968362445382
Encrypted:	false
SSDEEP:	192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
MD5:	50ABF0A7EE67F00F247BADA185A7661C
SHA1:	0CDDAC9AC4DB3BF10A11D4B79085EF9CB3FB84A1
SHA-256:	F957A4C261506484B53534A9BE8931C02EC1A349B3F431A858F8215CECFEC3F7
SHA-512:	C2694BB5D103BAFF1264926A04D2F0FE156B8815A23C3748412A81CC307B71A9236A0E974B5549321014065E393D10228A0F0004DF9BA677F03B5D244A64B528
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....mR.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.612550828747309
Encrypted:	false
SSDEEP:	192:/JWZhWdWJWadJCsVWQ4OWHhNy9hHssDX01k9z3AHQHXJw:/JWZhW8CsEh6FDR9zcQ5
MD5:	53B1BEEE348FF035FEF099922D69D588
SHA1:	7BC23B19568E2683641116F770773F8BCF03376B
SHA-256:	3A52229BF8A9DF9F69A450F1ED7AFC0D813D478D148C20F88EC4169D19B0D592
SHA-512:	85C7FFA63483D69870CD69BF40E2B4EA5992D6B82607EE9BFC354C3BD5079E18CFE2CA0BCAA2FE493B42226F4A8097737116EA023823CE3EF177596DD80EDCDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....v$.........." ...&.....0...............................................@............`A........................................p...`............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.721465362736704
Encrypted:	false
SSDEEP:	192:gIxlyWZhW6WEXCVWQ4KW3YfyttuX01k9z3AwQoz/fI:gIxlyWZhWtMSR9zVQE4
MD5:	5846D53AC41102BB6F7E1F78717FEA7F
SHA1:	72254F1B93F17C2C6921179C31CD19B1B4C5292D
SHA-256:	059DFA16C1BBE5FF3A4B5443BA5E7AD1D41E392A873B09CFEF787020CA3E101F
SHA-512:	0C29C0F562F1CABD794D8BF7F5CEF0B0213FCF52A71EB254E0122F88C6E03558CB2259CAFF6B46D3B055101EF5422318E48D6C7568CBF2423212B8ED4E8F0F7F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...,v............" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.620454652680466
Encrypted:	false
SSDEEP:	192:NHWZhWjWEXCVWQ4iWM0JKxu3O6YX01k9z3AFs5Ks:tWZhWYj0J8R9z2s5Ks
MD5:	5A1569EFA80FD139B561A9677A661F8A
SHA1:	FB0C824688E65ED12F52FA961EF3BAE5674F32AF
SHA-256:	41C1EAF5545109E871ABEF7386AB1ABF9D2DE1762CB4720C945AFA8424858B00
SHA-512:	1D2594C7F9757A95B41A9E6496F89C81FC96448B32CACB0C10D0DB8C28A95CF33B3AD23348BCD8FB37D82BD72865D3C60944206F2E795686440DE49BBCC39D7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....D.........." ...&.....0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.842934040846033
Encrypted:	false
SSDEEP:	192:8TvuBL3BBLMWZhWNWJWadJCsVWQ4iWBRBm+0U8X01k9z3Ar6V2EzVL:8TvuBL3BiWZhWMCsGRBmo8R9zY6V2w
MD5:	5EB2D8E1B9C9BD462C808F492EF117C2
SHA1:	60D398EC6E72AB670A2D9EF1B6747387C8DE724E
SHA-256:	DB85F9AAE6E9A5F1664326FA3FB82FE1002A3053857724D6C8D979A07C1221A1
SHA-512:	DF0EF770368F153104F828F1C2381BEA9A79E69DEFD43AF53BDD419B7D80144831E0C4CC8695BAEE9F26928F0C4A00FE4837C872313C37BCE1B23E6690A93BDA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....hp.........." ...&.....0...............................................@......L#....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.343540756101008
Encrypted:	false
SSDEEP:	384:/naOMw3zdp3bwjGzue9/0jCRrndb5WZhW4Csq1IH6FDR9zcQ:SOMwBprwjGzue9/0jCRrndbkaSSl9z
MD5:	0414909B279EA61CA344EDBE8E33E40B
SHA1:	4ECE0DABE954C43F9BD5032DE76EC29C47B22E10
SHA-256:	05B0C773A77850F3D50DDB4B82CC4D5F19316FE1AAA65E21B4709AE73F60A28E
SHA-512:	EDBD33540CD1EF69F2CE824CFB991903EC6E4EDDA815F07D610247594CEEB2EBC78F05A44B4DE8C5C937191B7E8B2EF221423C06DF303D73DEEA721C25D15EED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....#w.........." ...&.....0...............................................@......`.....`A........................................p................0...............0..8&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.7496431210219505
Encrypted:	false
SSDEEP:	192:E6WZhW2WJWadJCsVWQ4KW7QLxwVIX01k9z3A2rgFl:E6WZhWTCsfR9zLUFl
MD5:	5E93BF4AA81616285858CA455343B6D3
SHA1:	8DE55BE56B6520801177F757D9E3235EC88085F7
SHA-256:	C44EC29A51145281372007D241A2CC15B00D0BACC8ADFAAC61E8E82EFE8EA6A3
SHA-512:	E6A46DAD1D7125DBAAF9D020100D7EC321620E38FDD1C931AF74E8EC25E841C52555EC9646A895AD4450DE94F70E82E9A237C2895DDFD16769B07CB73AD827E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...ee............" ...&.....0...............................................@............`A........................................p...l............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.6919844070599135
Encrypted:	false
SSDEEP:	192:VWZhWo9WJWadJCsVWQ4KWcrY00pyEuX01k9z3A2pCaCI9p8Y:VWZhWTCsnrEpcR9zjpCDY
MD5:	94FCE2F4B244D3968B75A4A61B2347AB
SHA1:	C5898AF5FD941C19FCDD949C6B4E2BB090D040D2
SHA-256:	C513BDC265654D2E9A304423F299FB46953631F0D78AF8C1D397CD58B491475A
SHA-512:	1AFE1F3A9B803C5758FF24376FE040D856B5CA814717B490464260C9C78E70CE6C166EFBCC98E26AC12DD6173285B4863DA7DF4FF644D1D8150F8AC4B47113E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d..._+..........." ...&.....0...............................................@............`A........................................p................0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.875726049629512
Encrypted:	false
SSDEEP:	192:wgFWGWZhWmWJWadJCsVWQ4KWRYrxwVIX01k9z3A2r/3:jFjWZhWjCsDR9zLT3
MD5:	DF64597430E1126C3BA0FE5ECF995004
SHA1:	3E32AD558501FB9D108F885A55841605BE641628
SHA-256:	9638950211CBDCDAEB886CAB277573391BF7DDA2FBDB24FC18D31125DC8A7C24
SHA-512:	E16C1F5468BF2FC90B66B4B66DBAD62CDBE29180F8DA8AB8AD28D1B0C418CB96EADF24BB54F2EE9BCFE3176256D05F7EB591B6F908E47BD420BA22768FE0EA61
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......e.........." ...&.....0...............................................@......Np....`A........................................p...H............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.215332998256423
Encrypted:	false
SSDEEP:	384:rck1JzNcKSIVWZhWBCsbEpcR9zjpC/l2pB:zcKSFAEpw9z8/leB
MD5:	D21BE88A58960EDFE83CCBBDF5C4103D
SHA1:	3CB0D010837B77102E77CA62E1033EF4EB5473AC
SHA-256:	3E909B4951E485DE391F9A101E513B32C6D3507674C4D666AD3105B939B25C24
SHA-512:	99B1FDA3EC9292A59ED528AB243B4F8AC63E2D7B219135F26050BB7DD124A5D5DC4A14A69383A8AA0B03F0F0A3BCCF0C233EF09B8E3D3BDF43D0AA1CFC1A3992
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...\.YE.........." ...&.....0...............................................@.......l....`A........................................p................0...............0..8&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.761033474432705
Encrypted:	false
SSDEEP:	192:2kDfIeeWZhWsWJWadJCsVWQ4iWZzbTseUfX01k9z3AuqBXh/Y:2kDfIeeWZhWZCsaz/6fR9zBg/Y
MD5:	B1BA47D8389C40C2DDA3C56CBED14FC5
SHA1:	2EEF9FFA32171D53AFFA44E3DB7727AA383F7FAC
SHA-256:	C7277C05DC6B905FAD5CB930B0ECFBBC4676B46974B4571E54CA44CB6F6BE404
SHA-512:	466E31F17F73BDA5149343B23F4966502A8597D2A2E43F9A6C9C32387451D92C6B658CCAAE27044E68E4A9FD0EF9C89E32DC7639D59FCF04C596B6ABFA09658B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@......,.....`A........................................p................0...............0...%..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.548179328701105
Encrypted:	false
SSDEEP:	192:gWZhWtWJWadJCsVWQ4iWocCJOowcLK+X01k9z3A+TU3v:gWZhWsCsNy6R9zZY3v
MD5:	430D7CDD96BC499BA9EB84BB36AA301A
SHA1:	48B43F6E4FFA8423966D06B417B82C5F72525DD9
SHA-256:	3E16B030A162EE3B4F6BF612AF75D02A768A87F2D6A41A83F5ADAB2EC3C24DD1
SHA-512:	51042EBCA24086E1D0015FA921816A2F3C56065E1E15190B48C58656EB88610D64ACACB87584981963CAB501985C2CB68E53075CF5E0C65761BBDDAF56FBBAB0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...x.\..........." ...&.....0...............................................@......C.....`A........................................p................0...............0...%..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.742588003611338
Encrypted:	false
SSDEEP:	192:ahGeVfWZhWIlWEXCVWQ4KWEyttuX01k9z3AwQoz/C5N:ahGeVfWZhWDaSR9zVQEKz
MD5:	C03DAA9E875FF8638F631B1C95F4B342
SHA1:	71EAEACCEA8A302F87D1594CE612449C1195E882
SHA-256:	A281AE7A487ECEA619E696903E5A8119AE3F9E9EB2F0B64B31A8324B530A4D35
SHA-512:	EFA6CA2710F9827888F2CFCB87A321D66593B39988EBF743F37E2B8FE77DBA9517BDD8571D0BE7573CD6E1C786C1EDBA10857CFB6060E315AA0D46A16523D43B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................." ...&.....0...............................................@...........`A........................................p...<............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.653065529702944
Encrypted:	false
SSDEEP:	192:AO9qVQzyMvrSWZhWqWJWadJCsVWQ4OWI+tDohHssDX01k9z3AHQHP6b:ywyMvWWZhWHCsuRoFDR9zcQ
MD5:	9AB1BDE57B958090D53DE161469E5E8D
SHA1:	8452AED000B2E77040BA8B1E5762532CDF5A60AD
SHA-256:	199C988D566F19E8C67F4CD7147A7DF591CD2F2D648CBC511A5E4580346E75F4
SHA-512:	CF53C6885E154A05F8773D6B66A605049D70CC544F22A11D423C885608CD387446306CE6DFEE2CC4EE9387CDC0A50DA55948B5E55AD94ACDE7C7FD04FE38A137
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...epXN.........." ...&.....0...............................................@.......?....`A........................................p................0...............0..8&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.131579423253394
Encrypted:	false
SSDEEP:	384:zewidv3V0dfpkXc0vVaU8WZhWOCswEpcR9zjpCuSU:aHdv3VqpkXc0vVamKEpw9z8uj
MD5:	2C4BE18E4D56E056B3FB7C2AFB032E9E
SHA1:	9620C91A98175DDDCCC1F1AF78393143249E9EB9
SHA-256:	56657DA3DB3877624F5DAD3980DF3235FE7E1038916627C0845B5001199D513F
SHA-512:	18CBB5671ED99B475C7F6FF2D41943BA6D28FBBD781884BF069D1AA83F051C00D61BAA11459DCCA4FE2A4BC26C3540E1F598E4E0AE59A5E18D340A68B695ED78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....Y.........." ...&.....0...............................................@............`A........................................p...X............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.795933306978902
Encrypted:	false
SSDEEP:	192:stZ3rWZhWrWEXCVWQ4iWJmDoSJj+iX01k9z3ATaF2k:stZ3rWZhWgSmDX+iR9zYaz
MD5:	B865442FB6836A9B933A216109FF3D0F
SHA1:	15011FCAEA649CA016FA93996639F59C23B74106
SHA-256:	498194CFE8B1138385595A7DB3863ADF29A9663551D746FB64648FFD075186B3
SHA-512:	EEB9FA00A941C4B30320FBB9ECC2717E53D13CD12394500D795BE742DBE25C5FDF8590E9FE7F3B210A9D9AA07C7392419823A6A947591E7A38707A87309A2B76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...^Q............" ...&.....0...............................................@............`A........................................p...x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.851336652526625
Encrypted:	false
SSDEEP:	192:wgdKIMFCbmaovWZhW4WJWadJCsVWQ42Wns9rxu3O6YX01k9z3AFzqw9Sl:dj78WZhWlCs4s9fR9z2On
MD5:	1F0AB051A3F210DB40A8C5E813BA0428
SHA1:	E2EC19439618DF1D6F34EE7C76108E3EA90A8B14
SHA-256:	2D4CDDA6D6AEC0B1A84D84528380C5650683B8EED680F3CAFD821AC7F422070C
SHA-512:	A8BA535580D6756AC30E725411980A8D17E9A8AA1229233BB7A9B15C55B18B61136772D5D75CCE0EDF21B0F300BBD4D2458A4C69762261E928EF3CB7D5A14BDD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...8"0..........." ...&.....0...............................................@............`A........................................p...H............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.814262557975911
Encrypted:	false
SSDEEP:	192:ShmnWZhWQWEXCVWQ4KW6lho1NVAv+cQ0GX01k9z3AOHMCQH:SAWZhWLTH4NbZR9zDHMR
MD5:	953C63EF10EC30EF7C89A6F0F7074041
SHA1:	4B4F1FF3085FDED9DBD737F273585AD43175B0A3
SHA-256:	C93954167C12E15B58AC95240D2E0A2FBD94561D739D9F6ACA906D9C30453496
SHA-512:	B4534785E4D02AD387E3C6082884D438CC4B3CD8758AABCF99620052F5842DBD298351BC1723C274D4F7D3FCE0CC940DF3D47865FECE2F07CDB1151376BA852E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....*............" ...&.....0...............................................@............`A........................................p...H............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22064
Entropy (8bit):	4.599333886916871
Encrypted:	false
SSDEEP:	192:hWZhWaWJWadJCsVWQ4qWiTl+hHssDX01k9z3AHQHFUUG:hWZhWXCs/+FDR9zcQDG
MD5:	85A8B925D50105DB8250FA0878BB146E
SHA1:	4B56D7EB81E0666E0CD047F9205584A97CE91A01
SHA-256:	F3324803591D2794BAD583C71D5036976941631A5F0E6D67C71FC8BA29F30BA8
SHA-512:	CB074508052FAFA8BAA2E988E0F4241411A543E55A6A9FEE915029C6AA87C93CCE1F0B14FE0658361B6B4AB6880B31A950C215404C0D71D8A862D4E74AB3B797
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A........................................p...<............0...............0..0&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.90510985681131
Encrypted:	false
SSDEEP:	192:LhoWZhWEWWJWadJCsVWQ4KWiJYCY00pyEuX01k9z3A2pCapIcR/3:+WZhWEzCs1REpcR9zjpCw3
MD5:	43760078912B411595BCDED3B2EB063D
SHA1:	BD00CD60FD094B87AB0CFF30CD2AFE0A78853F22
SHA-256:	0A9BCAA55326373200396BB1AF46B3058F8F7AF7BE3289544DDDBAFDEC420FEA
SHA-512:	D779F67BBB6E9867BCEF7667C28E0032C01F36B8EA418504E9683240A6C0D9640B24D1DC5FA78CC9DCC4515F7BE0D314F27EBCEBC047B2E0F71680905D87827B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...8q............" ...&.....0...............................................@.......@....`A.........................................................0...............0..8&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	4.868380796510273
Encrypted:	false
SSDEEP:	192:tk9cydWZhWVWEXCVWQ4KWvcADB6ZX01k9z3AT2BE:ttydWZhWiWcTR9zW2e
MD5:	55E742035343AF7B93CAEEB71D322BED
SHA1:	121134DFECA618EC3FAE3FB640E541141D0C7B65
SHA-256:	2364FA428DEBA813B8A27B369ACEA8ED365AA5C9DA776D57E146576920746F0E
SHA-512:	601474B8C9185CB734DF191F4382590F1466C0A32773E17C73AFA5C1446DC648253D44E4EBAD6CE0D29288AFB1D7794C09FF0D7CFE81A3ADC3DC26B3DA46103D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....!B.........." ...&.....@...............................................P......s.....`A.........................................................@...............@..(&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.728659141523223
Encrypted:	false
SSDEEP:	192:QhWZhWyWJWadJCsVWQ4KWQU2Y00pyEuX01k9z3A2pCa/IcbY:QhWZhWPCsPEpcR9zjpCuk
MD5:	4EEB879FCEEAE59927F98A1A199B59CA
SHA1:	3BB833EDF4C10B42B7B376B93644CCC7F9A4B0F8
SHA-256:	E1B95E27CAD9DA4F0BD8BF4C913F49B9B8DA6D28303F2946B55DA3BD7FEB36A3
SHA-512:	6A43EB0C660395A60D17401E948BC4DA010261197EA13B5C9E043E7EE93C30EB17EFB9B6B138ECDD77DDC3D0CAA98921B57BFC244F6CD554417A0FBA5C9407B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...F..5.........." ...&.....0...............................................@......a.....`A............................................"............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	5.169073785182673
Encrypted:	false
SSDEEP:	192:GEpnWlC0i5ClWZhWPWEXCVWQ4iWv6I8HNsAX01k9z3AqjEgr7HO:vnWm5ClWZhWENtHNsAR9zygr6
MD5:	1FD59E1DD71EB3BDADB313029710DC33
SHA1:	82F5DE117D9C55247DA873AB8AD23F4E07841366
SHA-256:	953E4403094EC0C3E8C3A9AB38012CC36D86AC5FE3FFF2D6B6C5F51F75737C46
SHA-512:	69608FF0127587B93DB86C8CB27A932FA4B550C7D8D908F9FB8579BA2BCCC6D43E7283363F7B46DD39A40A8C790A030028A78302703658FD5D68F5EE9452A5AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A.........................................................0...............0...%..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.827217723133749
Encrypted:	false
SSDEEP:	192:rvh8Y17aFBRIWZhWdWJWadJCsVWQ4iWwBxu3O6YX01k9z3AFAjjHVy:bLdWZhW8CsRFR9z2AjjHVy
MD5:	481282554B34E19C77978DC7888434E6
SHA1:	BD33F1189FC79AC57716F9D030EF0BDD30205115
SHA-256:	8895C5AB2152A7F25F0C44A3457867229046952106D422331A1C57AD7935B47E
SHA-512:	FBE98FDA91618DD980709BABD8E56B8C4C4FF370E6DE23075F89303AAFFFD723DDDFD270F388C573914385E957ADD756BFE2B1FCEF5F9F86CB30E111177A52E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....eM..........." ...&.....0...............................................@......$.....`A.........................................................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.790131923417916
Encrypted:	false
SSDEEP:	192:dDWZhWqqWEXCVWQ4iWEchBm+0U8X01k9z3Areh3:1WZhWaf2Bmo8R9zYs
MD5:	78FC4A7E489F64EA5E0A745C12477FD8
SHA1:	51AB73B5142EE2F742ABDAEDF427690613A19F4A
SHA-256:	C12C28E3391A8C8ADCABE4632470DE824118C56338F46FCD8B99257709F50604
SHA-512:	C9064FF0B39421B28720E65E70695A997995CBEC80F1534D88B886BDA1797A7316D9B61E458B894B528C7BCE21C36F1D4ACD916DE96D0CDFDE59107EA93CD5D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...j5O@.........." ...&.....0...............................................@.......{....`A............................................e............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30248
Entropy (8bit):	5.124756298989814
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLhWZhWPC2R9zQaXy:/FMq59Bb1jMbK9zni
MD5:	A12569B252B6761A6330D2FFB6C2983B
SHA1:	CC6BDB88B252144AF816976A181D2B3B961CE389
SHA-256:	AB0DE0CF89F88B947E01A5AB630D71384AD69F903CEF063CCB10DE54D061EA2E
SHA-512:	EE9CB0E2C613374348A34E4A65C83DA8D35E6E841F50EED726FF397C7BB6EC430ED200B3B1A541041A91EBE5AE0C96270EE7B891C8C173B340C82ABD2CDF8750
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...K..G.........." ...&.....P...............................................`.......$....`A.............................................%...........P...............P..(&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.851114039202199
Encrypted:	false
SSDEEP:	192:HeXrqjd79WZhWHWEXCVWQ4iWs1lNowcLK+X01k9z3A++/+e:H4rEWZhWcRTN6R9zZK
MD5:	38D1C8D2AA2023D85ACA69286D79FB78
SHA1:	A97E806268DC4EE781EC2BFB654ED8BF91C2A83A
SHA-256:	381A09A63B5818A2499144ADBD8C5F6BBCFCE93D643E9920CC54485006FBCC48
SHA-512:	FC71441009EBE69DFBC04A791CB401306CB88F7BED5290CD899E234D290209917DC7FBD0D0D1A16CEB056858C77306B8EE5F3C17432F3594904B73B20162738E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A............................................x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	5.013491600663517
Encrypted:	false
SSDEEP:	192:pmGqX8mPrpJhhf4AN5/KixWZhWnWEXCVWQ4KWMKDUX01k9z3AmaSAWXH:pysyr7PWZhW83pR9zX7VH
MD5:	DC8BFCEEC3D20100F29FD4798415DC00
SHA1:	BD4764BE2833F40C1CC54229C759F83D67AE5294
SHA-256:	4950D0A97CB18971355247FECCFD6F8EA24E46BCA30F54540C050E4631EC57A8
SHA-512:	CC7899AD716A81AF46D73B1CB8DED51AEE9619F2ACCC35859E351FB8EE4F965F5BCC9ADBB7353CA7A3C8E39D36C09481F66519CB173DA1D2578718C764FB6FAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....Xj..........." ...&.....@...............................................P............`A............................................4............@...............@..(&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26168
Entropy (8bit):	5.280902373266687
Encrypted:	false
SSDEEP:	192:cqy+OV2OlkuWYFxEpah7WZhWNWJWadJCsVWQ4KW2TaY00pyEuX01k9z3A2pCahIS:8+OV2oFVh7WZhWMCsveEpcR9zjpCKn
MD5:	4A3342BCE6B58EF810E804F1C5915E40
SHA1:	FE636CCA0A57E92BB27E0F76075110981D3B3639
SHA-256:	2509179079A598B3E5DFD856D8E03E45DE7379C628901DBD869EC4332DDB618C
SHA-512:	F0C626F88F016C17FA45EA62441DD862A9575666EC06734F61D8E153C5F46A016FE1D9271293A8E29AFBD167F7A381E3EE04CB413736BC224AC31E0FE760341C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...T.w..........." ...&.....@...............................................P......x.....`A............................................a............@...............@..8&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26168
Entropy (8bit):	5.274613783530853
Encrypted:	false
SSDEEP:	768:7CV5yguNvZ5VQgx3SbwA71IkFhmwEpw9z8Eb:A5yguNvZ5VQgx3SbwA71IyVEp4z5
MD5:	2E657FE299572EACDAC67F4B9F603857
SHA1:	EB4FBC0147D4DF5D4EF81953BC1265D505A19297
SHA-256:	EC3C2BFF10B9469AC9C6ED109307731A1A4694FB54856DDD082A2FFD3CC34DF2
SHA-512:	EE3899584ECECE342ACCBD73D681358CFE8B4FD2ED07CF3034B14F3D04E3B03E5D6D041A0AFCB0B2B2B5AFAC118032317B5ECA00D11F7703D9D0DAE0E3AC38F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......G.........." ...&.....@...............................................P......}.....`A.........................................................@...............@..8&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.236019047489365
Encrypted:	false
SSDEEP:	192:AlhwDiWZhWgWJWadJCsVWQ4KWIq4nzY00pyEuX01k9z3A2pCa0Il:yWZhWtCsDxzEpcR9zjpC2
MD5:	9BC895E2CC140E168FA55372FCE8682B
SHA1:	579D71E19331625DDA84BAA9D8B81DD3BAFC9913
SHA-256:	287F80B2B330CC5F9FDF47DE50B189993CE925B5E2B7A6DA5CDAEF9C7D5F36C1
SHA-512:	DE0E5C6F9656106FCF2443D863D26C4B16BBB5B40E676199F9C459BE02B4837A2D32BDDDA82543EB2E0BF14A27EDEA7F5D506914DA8D63DA77ED7CCD2204AA65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...M.l..........." ...&.....0...............................................@...........`A.........................................................0...............0..8&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.794932075714544
Encrypted:	false
SSDEEP:	192:y/fHQdu3WZhWKWJWadJCsVWQ4KWbyg8Y00pyEuX01k9z3A2pCaFIpM:y/f5WZhWnCsmyg8EpcR9zjpCxM
MD5:	4653DA8959B7FE33D32E61E472507D54
SHA1:	6D071B52F40DC609F40989B3DD0FB53124607DF8
SHA-256:	B7E186A946119791E42F17E623732E23F864F98B592C41D95B3DA0532EA9D5F3
SHA-512:	81E17CF4B64ED5EFBA191D35B1877384544557C3001EFA0321A755A35413740AE66E39E39F573D3184EF8C893C739A74D37F170FE540F81177A83B44BC18BA6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....s$..........." ...&.....0...............................................@......f.....`A............................................^............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1029627
Entropy (8bit):	5.501988597633617
Encrypted:	false
SSDEEP:	24576:fhidb8tosQNRs54PK4IMiVw59bfCEzX2TBEx7gR32Dq:fhidb8tosQNRs54PK4I29OTBA7iKq
MD5:	BF8C0D4A45F2C849F32485A563ECBF6F
SHA1:	463617160DCB24C679C40A53B5A89B8B199B1708
SHA-256:	0365E936E50D48B88DB4630735ED6D4D8A57FC933CAB533C36CA1267213E8B14
SHA-512:	01FC89A4BDCFCA4532930A58A02639151DBBAE0EF751D75ADCE258741CD09F3DA1625C8769856C0CCCB2DC8A4F2A713035F00792B3FB2DACB454BAE35CCCD528
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI18922\bcrypt\_bcrypt.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	6.439270025490856
Encrypted:	false
SSDEEP:	6144:YotX4Kpgfhnyu9Bkio/5hV+6gSa/AUJed:YcXlOAuDkioBj+Md
MD5:	C00C889C86F1953954B15D59FB93F888
SHA1:	C642CB2C0A198999E1E8C22D0D5A329475B2D95F
SHA-256:	93477D20C0BF0235B0287FB8274F563EDE810838154C4EF841B3388B3BE6387B
SHA-512:	0EA1532C13302FD85707E7E33DB5A0E35C407EAAFC7CF5CC2DB6C0662A940C32D9925CFCBE385475883D2F1706EA4CADBAE65A9E4F857A963CC9E638E7F6B823
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..Q..Q..Q......Q.''P..Q.''R..Q.''U..Q.''T..Q.%P..Q..P..Q..P.d.Q..Q.Q.. Q..Q.. S..Q.Rich.Q.................PE..d......f.........." ...(.$...~......\|.....................................................`..........................................w..T....w..................x'..............4.......T.......................(.......@............@...............................text...6#.......$.................. ..`.rdata...F...@...H...(..............@..@.data...0............p..............@....pdata..x'.......(...t..............@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291528
Entropy (8bit):	6.047650375646611
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5NP:QWb/TRJLWURrI5RWavdF0J
MD5:	181AC9A809B1A8F1BC39C1C5C777CF2A
SHA1:	9341E715CEA2E6207329E7034365749FCA1F37DC
SHA-256:	488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
SHA-512:	E19A92B94AEDCF1282B3EF561BD471EA19ED361334092C55D72425F9183EBD1D30A619E493841B6F75C629F26F28DC682960977941B486C59475F21CF86FFF85
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.672271015164389
Encrypted:	false
SSDEEP:	96:IdCh72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh2XQMtCFQHq0fcX6g8cim1qeSju1:Im2HzzU2bRYoeuHncqgvimoe
MD5:	38105DF780EDDD734027328E0DCA0CA3
SHA1:	45F1D9E3472478F8E1BA86675F5C81C00B183BEA
SHA-256:	9512896233D2119E78E2E1FCFD83643B2BE2B427F08D16FC568FE98B9D4913CB
SHA-512:	BA2A05C236CE47D87888F618BE2B23532D0D882578707B07AE220A96883B468F7088A19EBBE3BAC2ADF4035DA6B7EE6FA9E57B620E2BC67B28E54CD969D6BBB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B1...P...P...P...(...P.../...P..M(...P.../...P.../...P.../...P...$...P...P.. P..?...P..?...P..?.a..P..?...P..Rich.P..........................PE..d....gAe.........." ...%.....................................................p............`..........................................'..l...\(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.878471536699278
Encrypted:	false
SSDEEP:	3072:fwyXU0GUUIB37Jy/TcqxcBpAFbbC6CpmZ48q:YUqxEqCfEZpq
MD5:	073F09E1EDF5EC4173CE2DE1121B9DD1
SHA1:	6CDB2559A1B706446CDD993E6FD680095E119B2E
SHA-256:	7412969BFE1BCA38BBB25BAB02B54506A05015A4944B54953FCFDB179EC3F13C
SHA-512:	70A1A766001EC78A5FCE7EADF6CAE07F11B3CA6B08115E130C77D024524879577CCAB263C596102102B1569933C601592FBB5EE07C7DB123BB850965EF8E8E96
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............pr..pr..pr......pr...s..pr...s..pr...w..pr...v..pr...q..pr.#.s..pr..ps..pr...z..pr...r..pr......pr...p..pr.Rich.pr.........................PE..d....gAe.........." ...%........... -....................................... ............`.............................................`...P.......................................Px...............................w..@............@...............................text...H(......................... ..`.rdata...W...@...X..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.554768229532207
Encrypted:	false
SSDEEP:	6:h9Co8FyQjkDYc5tWreLBF/pn2mHr2DASvUSBT5+FL8tjivzn:h9aVM/mrGzRsvUSBT5+J8li7n
MD5:	BF405A8056A6647E7D077B0E7BC36ABA
SHA1:	36C43938EFD5C62DDEC283557007E4BDFB4E0797
SHA-256:	43DAD2CC752AB721CD9A9F36ECE70FB53AB7713551F2D3D8694D8E8C5A06D6E2
SHA-512:	16590110B2F659D9C131B2093E05D30919A67368154305DCFE8D54FB88525F49F9F9F385A77BA5BCBEA8092061011D72B1BCC65CDC784BCFDDE10CE4DCE5586F
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses...The code used in the OS random engine is derived from CPython, and is licensed.under the terms of the PSF License Agreement..

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\LICENSE.PSF

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	5.015031803022437
Encrypted:	false
SSDEEP:	48:xUXyp7TEJzIXFCPXB/XF/gwHsV3XF2iDaGkiCXF1u0A2s/8AMUiioTqNyPhIXF+v:KXG3EJ0EPX9rsV3ZdkZ8oAShTkyZIYAw
MD5:	43C37D21E1DBAD10CDDCD150BA2C0595
SHA1:	ACF6B1628B04FE43A99071223CDBD7B66691C264
SHA-256:	693EC0A662B39F995A4F252B03A6222945470C1B6F12CA02918E4EFE0DF64B9F
SHA-512:	96D7C63AD24F7543599F0FED919948E486B35D01694BE02D980A8BA3D2A8B5A0E42341D940841D3528F56F09A582D32B3E81DED44BB3AAD1874C92650CB08129
Malicious:	false
Preview:	1. This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and. the Individual or Organization ("Licensee") accessing and otherwise using Python. 2.7.12 software in source or binary form and its associated documentation...2. Subject to the terms and conditions of this License Agreement, PSF hereby. grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,. analyze, test, perform and/or display publicly, prepare derivative works,. distribute, and otherwise use Python 2.7.12 alone or in any derivative. version, provided, however, that PSF's License Agreement and PSF's notice of. copyright, i.e., "Copyright . 2001-2016 Python Software Foundation; All Rights. Reserved" are retained in Python 2.7.12 alone or in any derivative version. prepared by Licensee...3. In the event Licensee prepares a derivative work that is based on or. incorporates Python 2.7.12 or any part thereof, and wants to make the. derivative work available to ot

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5068
Entropy (8bit):	5.076339504081192
Encrypted:	false
SSDEEP:	96:DDKVZ4WQIUQIhQIKQILbQIRIaMmPktxsx/1A0ivAEYaCjF04rpklE2jQech5mjvj:0acPuPXs/u0ivAEYaCjF04rpklE2jE03
MD5:	6723294F406FC0A1E70892680472A8E1
SHA1:	18802D07F5E3C416BD27B204AF13EE08316E0C4A
SHA-256:	CFB2C2C8067495438DC92FD335B51A04584A01283FCDDB6E4B03859049BEA2C6
SHA-512:	97DBDFF77AE87E5AED7A680668F9E8FB4A1FF5F3A7CB290E064896DF99ED2954E5D69433C605EAF97BE44D980FC4564C10A39176650BA4CBCE37FBCA0E22BE92
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cryptography.Version: 3.4.8.Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers..Home-page: https://github.com/pyca/cryptography.Author: The Python Cryptographic Authority and individual contributors.Author-email: cryptography-dev@python.org.License: BSD or Apache License, Version 2.0.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language ::

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16213
Entropy (8bit):	5.517159774741598
Encrypted:	false
SSDEEP:	384:NUXaxfEhrvJzrPMOOZWGmAufMdpdNT2UbycOpCNOvUfomBN:NUKxfEhrvJzbI2kF/N
MD5:	B7B9537DB89E17783D25AFB4EC15F462
SHA1:	77B37400EE0F3751C9BED57C2B3BB38F0F801FE2
SHA-256:	771938223E14E33E82D4D16D8D4FA873D196C164CBEF5ECBADED8C5EE2A59DAC
SHA-512:	8DF93B200B10A55549BB04ABED1AECCCD4952FFFE829C3F90097602125B425C5E5812077DD3CC9F993E3FE02AC887C046AE06A345471419E77AC14F2A757EAB9
Malicious:	false
Preview:	cryptography-3.4.8.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-3.4.8.dist-info/LICENSE,sha256=Q9rSzHUqtyHNmp827OcPtTq3cTVR8tPYaU2OjFoG1uI,323..cryptography-3.4.8.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-3.4.8.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-3.4.8.dist-info/LICENSE.PSF,sha256=aT7ApmKzn5laTyUrA6YiKUVHDBtvEsoCkY5O_g32S58,2415..cryptography-3.4.8.dist-info/METADATA,sha256=z7LCyAZ0lUONyS_TNbUaBFhKASg_zdtuSwOFkEm-osY,5068..cryptography-3.4.8.dist-info/RECORD,,..cryptography-3.4.8.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-3.4.8.dist-info/WHEEL,sha256=g0Gp_9X_YiwOuaF1hZMQNaS1qKUg2WIXRJjlZWggGSw,100..cryptography-3.4.8.dist-info/top_level.txt,sha256=rR2wh6A6juD02TBZNJqqonh8x9UP9Sa5Z9Hl1pCPCiM,31..cryptography/__about__.py,sha256=Gma4uMyERDaqXMloHsN56Lo-XunkiH9-joZKZJPG5a8,805..cryptography/__ini

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.992787665793268
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViYHgP+tkKc5vKQLn:RtBMwlViYAWK/SQLn
MD5:	81473BB8DD3C8C2FAB84DF8D7FE8E9FB
SHA1:	F91348D2BD8A4A48F331C55ED939AA964C2503E1
SHA-256:	8341A9FFD5FF622C0EB9A17585931035A4B5A8A520D962174498E5656820192C
SHA-512:	C16213B3BEA153A781C3EBD1741CA34865F6240A7AA1F9DBF73F9D0C7D7FBAF2545EDAF9CEEA89C287725273EC5F744FF7FFEC073121EFDE3E7783671129301A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.37.0).Root-Is-Purelib: false.Tag: cp36-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography-3.4.8.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.962103165155795
Encrypted:	false
SSDEEP:	3:DA1JjBHvAYuOv:DUOev
MD5:	62246E29EB9A005B743A15C18FE944DD
SHA1:	10A5E354DAA692FF714D3C49BED348ABD8A485C7
SHA-256:	AD1DB087A03A8EE0F4D93059349AAAA2787CC7D50FF526B967D1E5D6908F0A23
SHA-512:	F16FDA3B0A05A1B5F7D8F63E8A223B27CA4689F559D4A00357E129ECB24AD3E8B4519A70D59919DE8D93ADC8AD3B0EAF05192E3D18CE876D7DCA13ED498A0FCC
Malicious:	false
Preview:	_openssl._padding.cryptography.

C:\Users\user\AppData\Local\Temp\_MEI18922\cryptography\hazmat\bindings\_openssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3120128
Entropy (8bit):	6.664100235549327
Encrypted:	false
SSDEEP:	49152:FMVwASOyGtlql4IU6iAc1vdDP4GKJmhpdmdYTKugTt2mPTUT42Nr:JH+r1vphSaTm2QUT42l
MD5:	40646757F855E446AE37FEC76DE99A92
SHA1:	7013F6F293FF8DF18558147C7D05F7D453FAF447
SHA-256:	68F036B96D1BF85C5BB7BD15DF187E1BA3A848B2ABCF04FE5D2598CDEE13DCF0
SHA-512:	A25F689C85B9E19F6AA9E1CD10CB414D38CAB79BA476E52756F7D3879895DE225457D94384B7DFD4754C2A0753D7FF258B7DA52A829568BA6C8E9F2BB96D9FDE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......tDW,0%9.0%9.0%9.9].."%9.bP8~2%9.bP<~<%9.bP=~8%9.bP:~4%9..Q8~2%9.$N8~=%9.0%8..%9.0%9.,%9..P=~.'9..P1~1%9..P9~1%9..P..1%9..P;~1%9.Rich0%9.........................PE..d...:+%a.........." .....L"......... .........................................0...........`......................................... N,.P...pN,.h...../......0...D............/.h}.................................0..8............`"..............................text....K"......L"................. ..`.rdata..,....`"......P".............@..@.data.......p,......T,.............@....pdata...D...0...F....-.............@..@.rsrc........./......./.............@..@.reloc..h}..../..~..../.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	189000
Entropy (8bit):	6.310516938504568
Encrypted:	false
SSDEEP:	3072:NLSp96+JvGNw61ctOjB5vrNm067VpwiKdF3+6xdvl18UfKIz4qztsOSSnVDNYWum:a97vkw61BB5vrNm0Kj5+vxfKdqfVTum
MD5:	11A886189EB726D5786926CC09F9E116
SHA1:	D94295368A1285681FB03BAC0553EB1495D43805
SHA-256:	DC38BDBE10CFAA99799E0C87AA8444FC062D445B87686D6593FFCA46CC938031
SHA-512:	405C56487A91AD1209029CA6EA125642076251F0A8C069EEF0E30CE484381DB7BF24D2F5CD74B83D1C8C1358F92F35FA6ED7B75601ACE611CF36BB2331588684
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eb...1...1...1...1...1P..0...1P..0...1P..0...1P..0...1...0...1..0...1...1...1...0...1...0...1...1...1...0...1Rich...1........................PE..d...^.._.........." .................................................................$....`.........................................P...P....................... .......H............%..T............................&...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58952
Entropy (8bit):	5.848741332074507
Encrypted:	false
SSDEEP:	768:FTS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSx5:q9xiEAnUvdkdINV0Eyv
MD5:	9779C701BE8E17867D1D92D470607948
SHA1:	6AAE834541CCC73D1C87C9F1A12DF4AC0CF9001F
SHA-256:	59E6421802D30326C1704F15ACC2B2888097241E291ABA4860D1E1FC3D26D4BF
SHA-512:	4E34BCDD2093347D2B4E5C0F8C25F5D36D54097283FAF5B2BE1C75D717F716D459A45336647D3360457F25417952E62F8F21F5A720204FE5B894D5513E43E782
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.....d...d...d...l...d...d...d......d...f...d.Rich..d.................PE..d...O.._.........." ................................................................M.....`.........................................` ..@...............................H............ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\python38.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4209224
Entropy (8bit):	6.419196959467616
Encrypted:	false
SSDEEP:	49152:qc3VjUbaXKKpiMo2eArGQgukWACEU05yTTysQHbhAT+JClyqA8qcW2d6RVFiT7PR:Fyw/rkTVElJHXZGU/DH4MbXEF9rQv
MD5:	1F2688B97F9827F1DE7DFEDB4AD2348C
SHA1:	A9650970D38E30835336426F704579E87FCFC892
SHA-256:	169EEB1BDF99ED93CA26453D5CA49339E5AE092662CD94CDE09FBB10046F83FC
SHA-512:	27E56B2D73226E36B0C473D8EB646813997CBDF955397D0B61FCAE37ED1F2C3715E589F9A07D909A967009ED2C664D14007CCF37D83A7DF7CE2A0FEFCA615503
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... M..X...5...X..H....X...5...X...5...X...5...X..0...X...X..Y..J6...X..J6...X..J6!..X..J6...X..Rich.X..................PE..d...F.._.........." .........."...............................................C.....m.@...`..........................................8.......9.\|....pB......p@.,.... @.H.....B..t.. r!.T............................r!............... .`............................text............................... ..`.rdata..l..... .....................@..@.data.........9.......9.............@....pdata..,....p@.......=.............@..@.rsrc........pB.......?.............@..@.reloc...t....B..v....?.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\pywin32_system32\pywintypes38.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	6.010139157748554
Encrypted:	false
SSDEEP:	3072:mjbngJOM0WyPQSst/1ZI32yYrrC0P0xsr1praPDe+4KKPu7UJdap:+bgp0BISst/16YrrC0Ju7e1Kuu7UJ
MD5:	F60DA44A33910EDA70D838D7635D8FB1
SHA1:	C35B4CF47349888384729386C74C374EDB6F6FF3
SHA-256:	13934599FF931F97E8EAC6106DC67D54609BEFD0B0E653B46F6C25B18830C572
SHA-512:	3C57ED384C23C89F99708BDF688EBD28629E84DF8756E7B64DFA8B6E0B52BEEFB0C62DE820F2C72E5679B7632279DCB414A781CFD2C5C9654D09D9DA24FA17B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .................,.......................................p............`.........................................0...`B......,....P..d....0...............`..0...@t..T............................t..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata.......0......................@..@.rsrc...d....P.......$..............@..@.reloc..0....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26696
Entropy (8bit):	6.083258526295506
Encrypted:	false
SSDEEP:	768:hGNKrWZwhMHqSa/QtmI0dINqGSWDG4yiJ:hqKrWmhMKSa/QtmI0dINqGXye
MD5:	A2AB334E18222738DCB05BF820725938
SHA1:	2F75455A471F95AC814B8E4560A023034480B7B5
SHA-256:	7BA95624370216795EA4A087C326422CFCBCCC42B5ADA21F4D85C532C71AFAD7
SHA-512:	72E891D1C7E5EA44A569283B5C8BD8C310F2EE3D3CC9C25C6A7D7D77A62CB301C822C833B0792C3163CF0B0D6272DA2F667E6BC74B07ED7946082433F77D9679
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1...1...1...I~..1../\...1../\...1../\...1../\...1..f_...1..Y...1...1...1..f_...1..f_...1..f_...1..f_...1..Rich.1..................PE..d...V.._.........." .........4......X...............................................\|.....`......................................... @..L...l@..x....p.......`.......N..H.......,....2..T........................... 3...............0...............................text............................... ..`.rdata..X....0....... ..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc..,............L..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122768
Entropy (8bit):	6.6466118295886165
Encrypted:	false
SSDEEP:	24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
MD5:	3B337C2D41069B0A1E43E30F891C3813
SHA1:	EBEE2827B5CB153CBBB51C9718DA1549FA80FC5C
SHA-256:	C04DAEBA7E7C4B711D33993AB4C51A2E087F98F4211AEA0DCB3A216656BA0AB7
SHA-512:	FDB3012A71221447B35757ED2BDCA6ED1F8833B2F81D03AABEBD2CD7780A33A9C3D816535D03C5C3EDD5AAF11D91156842B380E2A63135E3C7F87193AD211499
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:K..:K..:K..K..:K..;K..:KK..K..:KK.:J..:KK.9J..:KK.?J..:KK.>J.:KK.4J..:KK..K..:KK.8J..:KRich..:K........PE..d................" .....0..........0^...............................................N....`A................................................................. ...........!...... .......p............................Z..8..............(............................text...X .......0.................. ..`.rdata......@.......@..............@..@.data....&....... ..................@....pdata....... ......................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1096264
Entropy (8bit):	5.342861808860828
Encrypted:	false
SSDEEP:	12288:reQqQOZ6K191SnFRFotduNdBjCmN/XlyCAx9++bBlhJk93cgewrxEeBpl8:reQGn4oghCc/+9nbDhG2wrxpl8
MD5:	549C9EEDA8546CD32D0713C723ABD12A
SHA1:	F84B2C529CFF58B888CC99F566FCD2EBA6FF2B8E
SHA-256:	5D5E733397EF7C4946CF26C84B07312CB12EAF339374613D4381E694EF38169B
SHA-512:	9432DAF045BAC3E322B1797F49AFE50F76FAF8B7D8DB063A1D56578016C813881AF3324E2529032A8644A04B58CCC9D2C363BF92B56115F06B9EEFEBFAB08180
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.{FU.(FU.(FU.(O-/(@U.(.8.)DU.(.8.)JU.(.8.)NU.(.8.)DU.(.;.)EU.(.=.)DU.(FU.(.U.(.;.)GU.(.;.)GU.(.;C(GU.(.;.)GU.(RichFU.(................PE..d...W.._.........." .....J...X.......)..............................................jL....`.............................................X...............................H...........@)..T............................)...............`...............................text...NI.......J.................. ..`.rdata...-...`.......N..............@..@.data................\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI18922\win32wnet.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.572930724109382
Encrypted:	false
SSDEEP:	768:2uFLa14u3wdL8AKlcFcpXIxtOdKlr2Q5uu2x:2uY14uWL8IFcpc2Q5R2
MD5:	BA0890D7B3CF1A791E2889D74D426ED6
SHA1:	14E25C625CB14956A788D533E05961564F6B2AA6
SHA-256:	AE7FDBC07D7C18F865EC91E59913F6845E6147E724064D400197D8E98E88CE03
SHA-512:	C4989E6DF88AAFE6AEAA0950F7FE23ED77F238DBFA6733425268E208AB071611C6BBC17558D165F45EC9CB41C9B2A2875938550C082AA2802B2DB0FCE910DF81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fTG..:...:...:.......:..r;...:..r?...:..r>...:..r9...:.Tr;...:..a;...:..l;...:...;...:.Tr3...:.Tr:...:.Tr8...:.Rich..:.........PE..d......d.........." .....D...P............................................................`.........................................p...H...............T............................q..T...........................`q..8............`...............................text....C.......D.................. ..`.rdata...7...`...8...H..............@..@.data...(...........................@....pdata..............................@..@.rsrc...T...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101664
Entropy (8bit):	6.561877023049057
Encrypted:	false
SSDEEP:	1536:yCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+9C7ecbGSh9ZR0Fa:yFWY1WxgGStJ8HaC7ecbG2Ga
MD5:	18571D6663B7D9AC95F2821C203E471F
SHA1:	3C186018DF04E875D6B9F83521028A21F145E3BE
SHA-256:	0B040A314C19FF88F38FD9C89DCA2D493113A6109ADB8525733C3F6627DA888F
SHA-512:	C8CBCA1072B8CB04F9D82135C91FF6D7A539CB7A488671CECB6B5E2F11A4807F47AD9AF5A87EBEE44984AB71D7C44FC87850F9D04FD2C5019EC1B6A1B483CA21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d......^.........." .........^......................................................v=....`A.........................................0..4....9.......p.......P.......L.. A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44328
Entropy (8bit):	6.619269527509389
Encrypted:	false
SSDEEP:	384:qim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXfIfy85xM8AT5WrmKWkrWiS:qIe8kySL2iPQxdvjAevMM5vAWtNyjS
MD5:	A4F89FFC725CCAE3C7BBCB9A0C91302F
SHA1:	531194DAD6795B3CB50B02501B0856EFA694DD36
SHA-256:	BBCEA93943F7E28A4D904301FF4BB708ADAEC4CC27800020044085FB838D4E5D
SHA-512:	C8CE2DCB65CD1FD0A7FFDC1DF0076BE2882BADAC7082B49FF96EC2CA1E944CCAB8699AB28901A895CCA90783CD223434552E366103FB6FCD25D9AD033B95EEDF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d......^.........." .....:...4......pA...................................................`A.........................................j......\|k..x....................l..(A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63560
Entropy (8bit):	5.8738277266687575
Encrypted:	false
SSDEEP:	1536:ddA7ll/y7vFtIrfKqnXM7KXsssS9ZINsn8ByvK:dUll/WFAfnXMOX5PZINsnNK
MD5:	7DD62E9903D66377D49D592B6E6DAC82
SHA1:	2B6BEC5D58CD4A7F0EAA809179461DBDB527D4F7
SHA-256:	29712C65138FC02208D8575A8EF188D69947464DD0DC2BE53F34C8DA81A82F06
SHA-512:	9BC8526C6C9EBA3682848277079457BB443A516CDBF3F10D281763A37483E7C6929AFEDDD7D9663E3573DD03665230395CEC7C60EA3F1671DF93628A665822AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f."..."..."...+.R. ....... .......).............. ......!...y... ...".........#......#....>.#......#...Rich"...................PE..d...P.._.........." .....\................................................... ...........`.............................................P...`...d.......................H.......p....v..T............................v...............p..0............................text...<Z.......\.................. ..`.rdata..HI...p...J...`..............@..@.data...( ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86088
Entropy (8bit):	6.376772954999528
Encrypted:	false
SSDEEP:	1536:i2g2Q9bRpNtjKjhtgc7JV+kwu0D9sl8/PFXPpQBIN4V/y8R:Jg2Qbvo0cV4kwu0D9sK/9XPpQBIN4VJR
MD5:	FC0D862A854993E0E51C00DEE3EEC777
SHA1:	20203332C6F7BD51F6A5ACBBC9F677C930D0669D
SHA-256:	E5DE23DBAC7ECE02566E79B3D1923A8EEAE628925C7FB4B98A443CAD94A06863
SHA-512:	B3C2ADE15CC196E687E83DD8D21CE88B83C8137A83CFC20BC8F2C8F3AB72643EF7CA08E1DC23DE0695F508BA0080871956303AC30F92AB865F3E4249D4D65C2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.00..^c..^c..^c...c..^c.._b..^c.R.c..^c..[b..^c..Zb..^c..]b..^c.._b..^cN._b..^c.._ct.^c..Sb..^c..^b..^c...c..^c..\b..^cRich..^c........PE..d...e.._.........." .........h..............................................p.......^....`.........................................0...H...x........P.......@..4....6..H....`..........T...............................................H............................text............................... ..`.rdata..rB.......D..................@..@.data........0......................@....pdata..4....@......................@..@.rsrc........P.......(..............@..@.reloc.......`.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_cffi_backend.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177664
Entropy (8bit):	6.158534074101028
Encrypted:	false
SSDEEP:	3072:8QY/et3+F8qiO1dmSzbo0+tMv5J5S7wbSTLLKCR8LpA:xwEuF8qXsSzESxThbSTLeCOLp
MD5:	4173EC9FE8F83845BBAF61D8C313A30A
SHA1:	D0A6095964150230EDE434506E167F1DEE731296
SHA-256:	3DF50B1E9FADC6D006C712D2A80A96AE0A286EFD82F9A4160439C75D2BE4D7B4
SHA-512:	17C6E083CAFB7D6B6DCFAD4960F04E3754A5C0D1AE70F1AE8B91421C4AFCBE32D44611FEC29D295A36573007674510AF9992DAA3057548EFFCCCA772602FA435
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C..#...p...p...p...p...p.7.q...p.7\|p...p.7.q...p.7.q...p.7.q...pL.q...p...q...p...p...p.0.q...p...p...p.0.q...p.0~p...p.0.q...pRich...p........................PE..d...!~.f.........." ...(.....@.............................................. ............`.........................................pV..h....V.......................................=..............................p<..@............................................text............................... ..`.rdata..............................@..@.data....].......0...h..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	126024
Entropy (8bit):	5.9027294934540775
Encrypted:	false
SSDEEP:	3072:97uYeVDxa+yVfZgV2JjtiAEUBfeT0jJRZBFU8RdINVPS:9K383gIj/feTgJRX
MD5:	8ADB1345C717E575E6614E163EB62328
SHA1:	F1EE3FFF6E06DC4F22A5EB38C09C54580880E0A3
SHA-256:	65EDC348DB42347570578B979151B787CEEBFC98E0372C28116CC229494A78A8
SHA-512:	0F11673854327FD2FCD12838F54C080EDC4D40E4BCB50C413FE3F823056D189636DC661EA79207163F966719BF0815E1FFA75E2FB676DF4E56ED6321F1FF6CAE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........gq..............~.......k.......k.......k.......k......Xh.......n.......n......^o..........!...Xh......Xh......Xh......Xh......Rich............................PE..d...[.._.........." .................^....................................................`..........................................r......4s..................d.......H...........P-..T............................-............... ..p............................text...i........................... ..`.rdata...n... ...p..................@..@.data....>.......:...v..............@....pdata..d...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	266824
Entropy (8bit):	6.520816772363595
Encrypted:	false
SSDEEP:	6144:mYXkBpKJU7vSJL9cu4eSOolgjozIQk9qWMa3pLW1AG4visa2OGuQaN:oBpKJGSpslDsQ+Ju5N
MD5:	49B8CD4D750FE59ADFB1CF8252C3EFE0
SHA1:	01F6E81B46F417233262DF5282E233FDAD369686
SHA-256:	0AF14298B022D615FC12DE4034068985928FE6B7AB6BAE3F5BE3A8ADAD379074
SHA-512:	EEA62D90D09502EB1ED425DD7C43355356C94F35740B78469DB6D74B7C362ECEC01806B1E1071BB741D68391996F8960B4642E98831525EE2886867D202CD07C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@2F..S(..S(..S(..+...S(..>)..S(..>-..S(..>,..S(..>+..S(..=)..S(._;)..S(..S)..S(..=+..S(..=%..S(..=(..S(..=..S(..=..S(.Rich.S(.........PE..d...S.._.........." .........F......$........................................0......$.....`.........................................`...P........................+......H.... ..P.......T...............................................(............................text...@........................... ..`.rdata..............................@..@.data...H.......$..................@....pdata...+.......,..................@..@.rsrc...............................@..@.reloc..P.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46152
Entropy (8bit):	5.9492510690836475
Encrypted:	false
SSDEEP:	768:4OUT3iMTYwbDU5496lvj3UEPKhievaZoZINsIm0WDG4yHo:4OrBwbDQdjEphfvCoZINsImhyHo
MD5:	5FA7C9D5E6068718C6010BBEB18FBEB3
SHA1:	93E8875D6D0F943B4226E25452C2C7D63D22B790
SHA-256:	2E98F91087F56DFDFFBBDD951CD55CD7EA771CEC93D59CADB86B964ED8708155
SHA-512:	3104AA8B785740DC6A5261C27B2BDC6E14B2F37862FA0FBA151B1BC1BFC0E5FB5B6934B95488FA47C5AF3FC2B2283F333FF6517B6F8CF0437C52CF171DA58BF5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................?.....-......-....-....-......d............c............d......d......d.S.....d......Rich............PE..d...e.._.........." .....@...\.......2..............................................OQ....`..........................................v..P....v..........................H...........0X..T............................X...............P...............................text....>.......@.................. ..`.rdata..D4...P...6...D..............@..@.data...h............z..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162376
Entropy (8bit):	6.760133023586482
Encrypted:	false
SSDEEP:	3072:DfVedVAw2nIhmc8sWOwPhE8qENIawGWp1ZB4Vzxznfo9mNoF32YIUVbFBINH1d:DfVedVYnWmS9we8G9ZB4DwYOFZIUzU
MD5:	60E215BB78FB9A40352980F4DE818814
SHA1:	FF750858C3352081514E2AE0D200F3B8C3D40096
SHA-256:	C4D00582DEE45841747B07B91A3E46E55AF79E6518EC9F0CE59B989C0ACD2806
SHA-512:	398A441DE98963873417DA6352413D080620FAF2AE4B99425D7C9EAF96D5F2FDF1358E21F16870BDFF514452115266A58EE3C6783611F037957BFA4BCEC34230
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T......K...K...K...K...K..J...K..J...K..J...K..J...K..J...KK.J...K...Kq..K..J*..K..J...K..mK...K..J...KRich...K................PE..d...p.._.........." .....\|..........84....................................................`.........................................p6..L....6..x............`.......`..H.......$.......T...........................`...................0............................text...!z.......\|.................. ..`.rdata..............................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................R..............@..@.reloc..$............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29256
Entropy (8bit):	5.9682801135376815
Encrypted:	false
SSDEEP:	384:oQybRGaX9IGnrQa4qtpj4Y54JP7gR0478sn5pINkBLpXSnYPLxDG4y8RG4:oD8qCG0aZcJDux35pINktpiWDG4ys
MD5:	E322BEF009567F51A5B50580EA358B84
SHA1:	8518BCF80EBC1A7359EC924C7D246748EC3B0B08
SHA-256:	AC50CDC428714DD5F411CA45AA1196E99075755B4719D17B2929E94C5E868AEF
SHA-512:	3970106FA397B7B5F2C354E9A433AA50164A742296D102C94111F00F60972295E426486016341D180FDA05532E7CD5F753F9FDBAD158E9759FE55EBE5EFBC2D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v...............oi.....+z......+z......+z......+z......by....................by......by......by......by......Rich....................PE..d...T.._.........." ..... ...:......X...............................................z"....`..........................................@..`....@..x....p.. ....`.......X..H............3..T............................4...............0...............................text............ .................. ..`.rdata..$....0.......$..............@..@.data...h....P.......@..............@....pdata.......`.......F..............@..@.rsrc... ....p.......J..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45640
Entropy (8bit):	6.029273550521059
Encrypted:	false
SSDEEP:	768:GjJDGL+xD1jf2SnI1KseKVoYWE50vnIBkBovVINJtKkWDG4yR7:GjJ6+2CI1KJ20vnIBJvVINJtKRyJ
MD5:	DA51560431C584706D9A9E3E40E82CFE
SHA1:	E60C22A05FD6A34C95F46DC17292F8C4D5E8C332
SHA-256:	EF1BB6ABEDC9A6E156ECA16AA53E836948DEB224CDC0C5FC05E7816F860C38A9
SHA-512:	555AA6FD084B0675D629BF79711C91899D178735E4B1B9F9AC4C13D7F01E0A3D8F6436699E37922F04BAFFEF32EFF540EF4BACE6B58E3BAFAFA021DDC12564EB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................F................................D...........................D......D......D.*....D......Rich...........................PE..d...V.._.........." .....@...Z......h................................................4....`..........................................v..X...Hw..........................H...........@W..T............................W...............P...............................text...J?.......@.................. ..`.rdata...4...P...6...D..............@..@.data...`............z..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28232
Entropy (8bit):	6.026784322519284
Encrypted:	false
SSDEEP:	384:5fzd3kPmXE/K/15JGsNi6rDcDRmOnx+cECdINqUTnYPLxDG4y8RGF9uE:V7XE/KLJa6rDaRm4DdINqUTWDG4yF9uE
MD5:	1FC2C6B80936EFC502BFC30FC24CAA56
SHA1:	4E5B26FF3B225906C2B9E39E0F06126CFC43A257
SHA-256:	9C47A3B84012837C60B7FECED86ED0A4F12910A85FD259A4483A48CD940E3514
SHA-512:	D07655D78ACA969CCC0D7CEDF9E337C7B20082D80BE1D90D69C42BE933FBAB1C828316D2EB5461DED2FF35E52762E249FC0C2BCCBC2B8436488FB6A270D3D9EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f."..."..."...+.V. ....... .......).......*....... ......!...y... ..."...a......#......#....:.#......#...Rich"...........PE..d...T.._.........." .........8............................................................`.........................................`B..L....B..d....p.......`.......T..H.......l...@3..T............................3...............0..8............................text...l........................... ..`.rdata..J....0......."..............@..@.data........P.......>..............@....pdata.......`.......B..............@..@.rsrc........p.......F..............@..@.reloc..l............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78920
Entropy (8bit):	6.068138139328106
Encrypted:	false
SSDEEP:	1536:SKmx5snrlAdD68Asd9/s+7+pIlxRjDzrdINVwayv:JmxqnBwAsd9/se+pIxRPzrdINVw1
MD5:	1D53841BB21ACDCC8742828C3ADED891
SHA1:	CDF15D4815820571684C1F720D0CBA24129E79C8
SHA-256:	AB13258C6DA2C26C4DCA7239FF4360CA9166EA8F53BB8CC08D2C7476CAB7D61B
SHA-512:	0266BCBCD7CA5F6C9DF8DBEEA00E1275932DACC38E5DD83A47BFBB87F7CA6778458A6671D8B84A63AE9216A65975DA656BA487AC28D41140122F46D0174FA9F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...z...z...z...s.-.~......x......v......r......x......x...!..}...z.........{......{.....A.{......{...Richz...........................PE..d...f.._.........." .....x...................................................`...........`......................................... ...P...p........@.......0..........H....P...... ...T............................................................................text...Xv.......x.................. ..`.rdata...v.......x...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153672
Entropy (8bit):	5.895447412110481
Encrypted:	false
SSDEEP:	3072:HlO4VRd4tXxAhr2uVk/Zytv7OazgnBYi5qTEVfa+MuUqZBIN47+:FD4tXyZ2AQytCazgatqZS
MD5:	84DEA8D0ACCE4A707B094A3627B62EAB
SHA1:	D45DDA99466AB08CC922E828729D0840AE2DDC18
SHA-256:	DCF6B3FF84B55C3859D0F176C4CE6904C0D7D4643A657B817C6322933DBF82F6
SHA-512:	FDAA7EB10F8BF7B42A5C9691F600EFF48190041A8B28A5DAB977170DB717FFF58DD0F64B02CA30D274552FF30EE02A6577F1465792CF6760366C2588BF373108
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................'...'.....'.....'...n...i.....................n...n...n.i...n...Rich..........................PE..d...h.._.........." .........................................................p............`.............................................d............P.......@.......>..H....`..........T............................................................................text............................... ..`.rdata..............................@..@.data....k.......f..................@....pdata.......@......................@..@.rsrc........P.......$..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.729352106249244
Encrypted:	false
SSDEEP:	192:+zOGWZhWsWJWadJCsVWQ4OW4f/hHssDX01k9z3AHQH4i/vN:+zBWZhWZCsFf/FDR9zcQvv
MD5:	4A8F3A1847F216B8AC3E6B53BC20BD81
SHA1:	F5AADC1399A9DA38087DF52E509D919D743E3EA7
SHA-256:	29B7D786D9F421765A4F4904F79605C41E17C0A24D7F91E44C0B7B0DEA489FC3
SHA-512:	E70D2B719517C413FA967CA1A8D224299AF55D988B3CC28013AAA3677660FAE9ECB6F858D31C08CD8A0888F932AF1384F0EAA928C002200F0710C2D5BDDCED1B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...'6[o.........." ...&.....0...............................................@.......t....`A........................................p...,............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.582853727629458
Encrypted:	false
SSDEEP:	192:SWZhWpWEXCVWQ4KWgfYXxwVIX01k9z3A2rZ2Co:SWZhWGVWR9zL12j
MD5:	D7AD8DB12FF42D620A657127DADA1D88
SHA1:	0CA381C734A3A93DC5F19C58DADFDCA9D1AFCCD8
SHA-256:	26054D8FEBAB1AACF11AA5CB64055808CD33388A8E77D0B3BCBC7543B0EEA3BD
SHA-512:	7E2D6B60ADBF97B22AB4B66691E483827D5755CFC6FCB5224369ADA53CBD8CDA43C4694A000EA4B5CEBC69A475B54DF0E9694C20AFD9EC62B4DB7B22241BDC45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.56864151469395
Encrypted:	false
SSDEEP:	192:JWZhW9VWJWadJCsVWQ4mWJfTBm+0U8X01k9z3Ar+bP:JWZhWiCsofTBmo8R9zY+P
MD5:	C68A86C180FF1FCAC90D1DA9A08179C1
SHA1:	C287951441C957931DC4EBBEE4DC9426A4501554
SHA-256:	2C91C4861E88C92693A1B145EBE2F69FFB90797CD42061E2D84F3D7FC009A941
SHA-512:	857FBF9852596EF7263D8FAF970128487413C859246F58B15CEC32D11576894C47211A3BD9005F86C2A28FA6B67FBA96831C4953C0FA24E2373A6DAECB85E121
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......}.........." ...&.....0...............................................@.......n....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.635214855201274
Encrypted:	false
SSDEEP:	192:hPmxD3jPWZhWUzWJWadJCsVWQ4KW8xwVIX01k9z3A2rEUOdu:hPAPWZhWUqCsLR9zLANA
MD5:	A17FF429442D4E5298F0FAF95950A77D
SHA1:	522A365DAD26BEDC2BFE48164DC63C2C37C993C3
SHA-256:	8E9D1D206DA69DA744D77F730233344EBE7C2A392550511698A79CE2D9180B41
SHA-512:	7D4E31251C171B90A0C533718655C98D8737FF220BCC43F893FF42C57AB43D82E6BD13FA94DEF5BB4205CAEC68DC8178D6B2A25AD819689F25DAD01BE544D5AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...h..,.........." ...&.....0...............................................@............`A........................................p................0...............0..8&..............p............................................................................rdata..H...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-fibers-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.5745435750793515
Encrypted:	false
SSDEEP:	192:NyWZhWPWEXCVWQ4OW+shHssDX01k9z3AHQHBhuWC:QWZhWEnsFDR9zcQk
MD5:	73DD550364215163EA9EDB537E6B3714
SHA1:	C24FCADFEE877D5402E2B4F8518C4F5F4A2CE4B4
SHA-256:	0235C78780EFF0BD34FCE01D1C366E5E5936EA361676CB9711A4CFFF747D457A
SHA-512:	2406D9D44D3ED86A95248B25CF574E0C06533CD916048A2FACD68F4DB48E49E8E8CE1917091BCFB273D0ACC210697CEB659930C896E51464C300EC06476D8CC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....+............" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	4.87194572901717
Encrypted:	false
SSDEEP:	192:1whDPvVr8rFTsKWZhWgWEXCVWQ4KWiOcADB6ZX01k9z3AT2s7u:WJPvVrQWZhW7KcTR9zW2s6
MD5:	ECEE1B7DA6539C233E8DEC78BFC8E1F9
SHA1:	052BA049F6D8CD5579E01C9E2F85414B15E6CBF8
SHA-256:	249D7CD1C87738F87458B95ACE4AB8F87B0DE99EEEFB796F6B86CBA889D49B2C
SHA-512:	EA21FE20336B8170B2A8CD13DF217E9EE87AA1D2B0BA476BEE2A97C3FCE57648C9AB664B9BA895D5BBBCD119F2BB6633BEDC85DAFBD7BF6853AA48B168A927F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......b.........." ...&.....@...............................................P......A.....`A........................................p...x............@...............@..(&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.608548224344036
Encrypted:	false
SSDEEP:	192:u7xmWZhWlWEXCVWQ4KWs8HjKDUX01k9z3AmaS+5:u1mWZhWSYpR9zX78
MD5:	3473BC217562594B5B126D7AEB9380E9
SHA1:	B551B9D9AA80BE070F577376E484610E01C5171A
SHA-256:	0D8190FD619FEB20DF123931108D499132F7051F1EBB0EF246082F4C52C88B22
SHA-512:	036B93457ADE632AD68264D81FF26EE1156038E234C606882386D6BABCBE722A18E9CED1655F97CAECAF5FD514E261DAFE999A3E9FEC00CC677E177F0BF8E203
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...D............." ...&.....0...............................................@............`A........................................p...L............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.41968362445382
Encrypted:	false
SSDEEP:	192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
MD5:	50ABF0A7EE67F00F247BADA185A7661C
SHA1:	0CDDAC9AC4DB3BF10A11D4B79085EF9CB3FB84A1
SHA-256:	F957A4C261506484B53534A9BE8931C02EC1A349B3F431A858F8215CECFEC3F7
SHA-512:	C2694BB5D103BAFF1264926A04D2F0FE156B8815A23C3748412A81CC307B71A9236A0E974B5549321014065E393D10228A0F0004DF9BA677F03B5D244A64B528
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....mR.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.612550828747309
Encrypted:	false
SSDEEP:	192:/JWZhWdWJWadJCsVWQ4OWHhNy9hHssDX01k9z3AHQHXJw:/JWZhW8CsEh6FDR9zcQ5
MD5:	53B1BEEE348FF035FEF099922D69D588
SHA1:	7BC23B19568E2683641116F770773F8BCF03376B
SHA-256:	3A52229BF8A9DF9F69A450F1ED7AFC0D813D478D148C20F88EC4169D19B0D592
SHA-512:	85C7FFA63483D69870CD69BF40E2B4EA5992D6B82607EE9BFC354C3BD5079E18CFE2CA0BCAA2FE493B42226F4A8097737116EA023823CE3EF177596DD80EDCDB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....v$.........." ...&.....0...............................................@............`A........................................p...`............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.721465362736704
Encrypted:	false
SSDEEP:	192:gIxlyWZhW6WEXCVWQ4KW3YfyttuX01k9z3AwQoz/fI:gIxlyWZhWtMSR9zVQE4
MD5:	5846D53AC41102BB6F7E1F78717FEA7F
SHA1:	72254F1B93F17C2C6921179C31CD19B1B4C5292D
SHA-256:	059DFA16C1BBE5FF3A4B5443BA5E7AD1D41E392A873B09CFEF787020CA3E101F
SHA-512:	0C29C0F562F1CABD794D8BF7F5CEF0B0213FCF52A71EB254E0122F88C6E03558CB2259CAFF6B46D3B055101EF5422318E48D6C7568CBF2423212B8ED4E8F0F7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...,v............" ...&.....0...............................................@............`A........................................p................0...............0..(&..............p............................................................................rdata..\|...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.620454652680466
Encrypted:	false
SSDEEP:	192:NHWZhWjWEXCVWQ4iWM0JKxu3O6YX01k9z3AFs5Ks:tWZhWYj0J8R9z2s5Ks
MD5:	5A1569EFA80FD139B561A9677A661F8A
SHA1:	FB0C824688E65ED12F52FA961EF3BAE5674F32AF
SHA-256:	41C1EAF5545109E871ABEF7386AB1ABF9D2DE1762CB4720C945AFA8424858B00
SHA-512:	1D2594C7F9757A95B41A9E6496F89C81FC96448B32CACB0C10D0DB8C28A95CF33B3AD23348BCD8FB37D82BD72865D3C60944206F2E795686440DE49BBCC39D7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....D.........." ...&.....0...............................................@............`A........................................p................0...............0...%..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.842934040846033
Encrypted:	false
SSDEEP:	192:8TvuBL3BBLMWZhWNWJWadJCsVWQ4iWBRBm+0U8X01k9z3Ar6V2EzVL:8TvuBL3BiWZhWMCsGRBmo8R9zY6V2w
MD5:	5EB2D8E1B9C9BD462C808F492EF117C2
SHA1:	60D398EC6E72AB670A2D9EF1B6747387C8DE724E
SHA-256:	DB85F9AAE6E9A5F1664326FA3FB82FE1002A3053857724D6C8D979A07C1221A1
SHA-512:	DF0EF770368F153104F828F1C2381BEA9A79E69DEFD43AF53BDD419B7D80144831E0C4CC8695BAEE9F26928F0C4A00FE4837C872313C37BCE1B23E6690A93BDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....hp.........." ...&.....0...............................................@......L#....`A........................................p................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.343540756101008
Encrypted:	false
SSDEEP:	384:/naOMw3zdp3bwjGzue9/0jCRrndb5WZhW4Csq1IH6FDR9zcQ:SOMwBprwjGzue9/0jCRrndbkaSSl9z
MD5:	0414909B279EA61CA344EDBE8E33E40B
SHA1:	4ECE0DABE954C43F9BD5032DE76EC29C47B22E10
SHA-256:	05B0C773A77850F3D50DDB4B82CC4D5F19316FE1AAA65E21B4709AE73F60A28E
SHA-512:	EDBD33540CD1EF69F2CE824CFB991903EC6E4EDDA815F07D610247594CEEB2EBC78F05A44B4DE8C5C937191B7E8B2EF221423C06DF303D73DEEA721C25D15EED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....#w.........." ...&.....0...............................................@......`.....`A........................................p................0...............0..8&..............p............................................................................rdata..D...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.7496431210219505
Encrypted:	false
SSDEEP:	192:E6WZhW2WJWadJCsVWQ4KW7QLxwVIX01k9z3A2rgFl:E6WZhWTCsfR9zLUFl
MD5:	5E93BF4AA81616285858CA455343B6D3
SHA1:	8DE55BE56B6520801177F757D9E3235EC88085F7
SHA-256:	C44EC29A51145281372007D241A2CC15B00D0BACC8ADFAAC61E8E82EFE8EA6A3
SHA-512:	E6A46DAD1D7125DBAAF9D020100D7EC321620E38FDD1C931AF74E8EC25E841C52555EC9646A895AD4450DE94F70E82E9A237C2895DDFD16769B07CB73AD827E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...ee............" ...&.....0...............................................@............`A........................................p...l............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.6919844070599135
Encrypted:	false
SSDEEP:	192:VWZhWo9WJWadJCsVWQ4KWcrY00pyEuX01k9z3A2pCaCI9p8Y:VWZhWTCsnrEpcR9zjpCDY
MD5:	94FCE2F4B244D3968B75A4A61B2347AB
SHA1:	C5898AF5FD941C19FCDD949C6B4E2BB090D040D2
SHA-256:	C513BDC265654D2E9A304423F299FB46953631F0D78AF8C1D397CD58B491475A
SHA-512:	1AFE1F3A9B803C5758FF24376FE040D856B5CA814717B490464260C9C78E70CE6C166EFBCC98E26AC12DD6173285B4863DA7DF4FF644D1D8150F8AC4B47113E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d..._+..........." ...&.....0...............................................@............`A........................................p................0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.875726049629512
Encrypted:	false
SSDEEP:	192:wgFWGWZhWmWJWadJCsVWQ4KWRYrxwVIX01k9z3A2r/3:jFjWZhWjCsDR9zLT3
MD5:	DF64597430E1126C3BA0FE5ECF995004
SHA1:	3E32AD558501FB9D108F885A55841605BE641628
SHA-256:	9638950211CBDCDAEB886CAB277573391BF7DDA2FBDB24FC18D31125DC8A7C24
SHA-512:	E16C1F5468BF2FC90B66B4B66DBAD62CDBE29180F8DA8AB8AD28D1B0C418CB96EADF24BB54F2EE9BCFE3176256D05F7EB591B6F908E47BD420BA22768FE0EA61
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......e.........." ...&.....0...............................................@......Np....`A........................................p...H............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.215332998256423
Encrypted:	false
SSDEEP:	384:rck1JzNcKSIVWZhWBCsbEpcR9zjpC/l2pB:zcKSFAEpw9z8/leB
MD5:	D21BE88A58960EDFE83CCBBDF5C4103D
SHA1:	3CB0D010837B77102E77CA62E1033EF4EB5473AC
SHA-256:	3E909B4951E485DE391F9A101E513B32C6D3507674C4D666AD3105B939B25C24
SHA-512:	99B1FDA3EC9292A59ED528AB243B4F8AC63E2D7B219135F26050BB7DD124A5D5DC4A14A69383A8AA0B03F0F0A3BCCF0C233EF09B8E3D3BDF43D0AA1CFC1A3992
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...\.YE.........." ...&.....0...............................................@.......l....`A........................................p................0...............0..8&..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.761033474432705
Encrypted:	false
SSDEEP:	192:2kDfIeeWZhWsWJWadJCsVWQ4iWZzbTseUfX01k9z3AuqBXh/Y:2kDfIeeWZhWZCsaz/6fR9zBg/Y
MD5:	B1BA47D8389C40C2DDA3C56CBED14FC5
SHA1:	2EEF9FFA32171D53AFFA44E3DB7727AA383F7FAC
SHA-256:	C7277C05DC6B905FAD5CB930B0ECFBBC4676B46974B4571E54CA44CB6F6BE404
SHA-512:	466E31F17F73BDA5149343B23F4966502A8597D2A2E43F9A6C9C32387451D92C6B658CCAAE27044E68E4A9FD0EF9C89E32DC7639D59FCF04C596B6ABFA09658B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@......,.....`A........................................p................0...............0...%..............p............................................................................rdata..\...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.548179328701105
Encrypted:	false
SSDEEP:	192:gWZhWtWJWadJCsVWQ4iWocCJOowcLK+X01k9z3A+TU3v:gWZhWsCsNy6R9zZY3v
MD5:	430D7CDD96BC499BA9EB84BB36AA301A
SHA1:	48B43F6E4FFA8423966D06B417B82C5F72525DD9
SHA-256:	3E16B030A162EE3B4F6BF612AF75D02A768A87F2D6A41A83F5ADAB2EC3C24DD1
SHA-512:	51042EBCA24086E1D0015FA921816A2F3C56065E1E15190B48C58656EB88610D64ACACB87584981963CAB501985C2CB68E53075CF5E0C65761BBDDAF56FBBAB0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...x.\..........." ...&.....0...............................................@......C.....`A........................................p................0...............0...%..............p............................................................................rdata..P...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.742588003611338
Encrypted:	false
SSDEEP:	192:ahGeVfWZhWIlWEXCVWQ4KWEyttuX01k9z3AwQoz/C5N:ahGeVfWZhWDaSR9zVQEKz
MD5:	C03DAA9E875FF8638F631B1C95F4B342
SHA1:	71EAEACCEA8A302F87D1594CE612449C1195E882
SHA-256:	A281AE7A487ECEA619E696903E5A8119AE3F9E9EB2F0B64B31A8324B530A4D35
SHA-512:	EFA6CA2710F9827888F2CFCB87A321D66593B39988EBF743F37E2B8FE77DBA9517BDD8571D0BE7573CD6E1C786C1EDBA10857CFB6060E315AA0D46A16523D43B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................." ...&.....0...............................................@...........`A........................................p...<............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.653065529702944
Encrypted:	false
SSDEEP:	192:AO9qVQzyMvrSWZhWqWJWadJCsVWQ4OWI+tDohHssDX01k9z3AHQHP6b:ywyMvWWZhWHCsuRoFDR9zcQ
MD5:	9AB1BDE57B958090D53DE161469E5E8D
SHA1:	8452AED000B2E77040BA8B1E5762532CDF5A60AD
SHA-256:	199C988D566F19E8C67F4CD7147A7DF591CD2F2D648CBC511A5E4580346E75F4
SHA-512:	CF53C6885E154A05F8773D6B66A605049D70CC544F22A11D423C885608CD387446306CE6DFEE2CC4EE9387CDC0A50DA55948B5E55AD94ACDE7C7FD04FE38A137
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...epXN.........." ...&.....0...............................................@.......?....`A........................................p................0...............0..8&..............p............................................................................rdata..l...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.131579423253394
Encrypted:	false
SSDEEP:	384:zewidv3V0dfpkXc0vVaU8WZhWOCswEpcR9zjpCuSU:aHdv3VqpkXc0vVamKEpw9z8uj
MD5:	2C4BE18E4D56E056B3FB7C2AFB032E9E
SHA1:	9620C91A98175DDDCCC1F1AF78393143249E9EB9
SHA-256:	56657DA3DB3877624F5DAD3980DF3235FE7E1038916627C0845B5001199D513F
SHA-512:	18CBB5671ED99B475C7F6FF2D41943BA6D28FBBD781884BF069D1AA83F051C00D61BAA11459DCCA4FE2A4BC26C3540E1F598E4E0AE59A5E18D340A68B695ED78
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....Y.........." ...&.....0...............................................@............`A........................................p...X............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.795933306978902
Encrypted:	false
SSDEEP:	192:stZ3rWZhWrWEXCVWQ4iWJmDoSJj+iX01k9z3ATaF2k:stZ3rWZhWgSmDX+iR9zYaz
MD5:	B865442FB6836A9B933A216109FF3D0F
SHA1:	15011FCAEA649CA016FA93996639F59C23B74106
SHA-256:	498194CFE8B1138385595A7DB3863ADF29A9663551D746FB64648FFD075186B3
SHA-512:	EEB9FA00A941C4B30320FBB9ECC2717E53D13CD12394500D795BE742DBE25C5FDF8590E9FE7F3B210A9D9AA07C7392419823A6A947591E7A38707A87309A2B76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...^Q............" ...&.....0...............................................@............`A........................................p...x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.851336652526625
Encrypted:	false
SSDEEP:	192:wgdKIMFCbmaovWZhW4WJWadJCsVWQ42Wns9rxu3O6YX01k9z3AFzqw9Sl:dj78WZhWlCs4s9fR9z2On
MD5:	1F0AB051A3F210DB40A8C5E813BA0428
SHA1:	E2EC19439618DF1D6F34EE7C76108E3EA90A8B14
SHA-256:	2D4CDDA6D6AEC0B1A84D84528380C5650683B8EED680F3CAFD821AC7F422070C
SHA-512:	A8BA535580D6756AC30E725411980A8D17E9A8AA1229233BB7A9B15C55B18B61136772D5D75CCE0EDF21B0F300BBD4D2458A4C69762261E928EF3CB7D5A14BDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...8"0..........." ...&.....0...............................................@............`A........................................p...H............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22056
Entropy (8bit):	4.814262557975911
Encrypted:	false
SSDEEP:	192:ShmnWZhWQWEXCVWQ4KW6lho1NVAv+cQ0GX01k9z3AOHMCQH:SAWZhWLTH4NbZR9zDHMR
MD5:	953C63EF10EC30EF7C89A6F0F7074041
SHA1:	4B4F1FF3085FDED9DBD737F273585AD43175B0A3
SHA-256:	C93954167C12E15B58AC95240D2E0A2FBD94561D739D9F6ACA906D9C30453496
SHA-512:	B4534785E4D02AD387E3C6082884D438CC4B3CD8758AABCF99620052F5842DBD298351BC1723C274D4F7D3FCE0CC940DF3D47865FECE2F07CDB1151376BA852E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....*............" ...&.....0...............................................@............`A........................................p...H............0...............0..(&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22064
Entropy (8bit):	4.599333886916871
Encrypted:	false
SSDEEP:	192:hWZhWaWJWadJCsVWQ4qWiTl+hHssDX01k9z3AHQHFUUG:hWZhWXCs/+FDR9zcQDG
MD5:	85A8B925D50105DB8250FA0878BB146E
SHA1:	4B56D7EB81E0666E0CD047F9205584A97CE91A01
SHA-256:	F3324803591D2794BAD583C71D5036976941631A5F0E6D67C71FC8BA29F30BA8
SHA-512:	CB074508052FAFA8BAA2E988E0F4241411A543E55A6A9FEE915029C6AA87C93CCE1F0B14FE0658361B6B4AB6880B31A950C215404C0D71D8A862D4E74AB3B797
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A........................................p...<............0...............0..0&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.90510985681131
Encrypted:	false
SSDEEP:	192:LhoWZhWEWWJWadJCsVWQ4KWiJYCY00pyEuX01k9z3A2pCapIcR/3:+WZhWEzCs1REpcR9zjpCw3
MD5:	43760078912B411595BCDED3B2EB063D
SHA1:	BD00CD60FD094B87AB0CFF30CD2AFE0A78853F22
SHA-256:	0A9BCAA55326373200396BB1AF46B3058F8F7AF7BE3289544DDDBAFDEC420FEA
SHA-512:	D779F67BBB6E9867BCEF7667C28E0032C01F36B8EA418504E9683240A6C0D9640B24D1DC5FA78CC9DCC4515F7BE0D314F27EBCEBC047B2E0F71680905D87827B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...8q............" ...&.....0...............................................@.......@....`A.........................................................0...............0..8&..............p............................................................................rdata..p...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	4.868380796510273
Encrypted:	false
SSDEEP:	192:tk9cydWZhWVWEXCVWQ4KWvcADB6ZX01k9z3AT2BE:ttydWZhWiWcTR9zW2e
MD5:	55E742035343AF7B93CAEEB71D322BED
SHA1:	121134DFECA618EC3FAE3FB640E541141D0C7B65
SHA-256:	2364FA428DEBA813B8A27B369ACEA8ED365AA5C9DA776D57E146576920746F0E
SHA-512:	601474B8C9185CB734DF191F4382590F1466C0A32773E17C73AFA5C1446DC648253D44E4EBAD6CE0D29288AFB1D7794C09FF0D7CFE81A3ADC3DC26B3DA46103D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d.....!B.........." ...&.....@...............................................P......s.....`A.........................................................@...............@..(&..............p............................................................................rdata..n........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.728659141523223
Encrypted:	false
SSDEEP:	192:QhWZhWyWJWadJCsVWQ4KWQU2Y00pyEuX01k9z3A2pCa/IcbY:QhWZhWPCsPEpcR9zjpCuk
MD5:	4EEB879FCEEAE59927F98A1A199B59CA
SHA1:	3BB833EDF4C10B42B7B376B93644CCC7F9A4B0F8
SHA-256:	E1B95E27CAD9DA4F0BD8BF4C913F49B9B8DA6D28303F2946B55DA3BD7FEB36A3
SHA-512:	6A43EB0C660395A60D17401E948BC4DA010261197EA13B5C9E043E7EE93C30EB17EFB9B6B138ECDD77DDC3D0CAA98921B57BFC244F6CD554417A0FBA5C9407B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...F..5.........." ...&.....0...............................................@......a.....`A............................................"............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	5.169073785182673
Encrypted:	false
SSDEEP:	192:GEpnWlC0i5ClWZhWPWEXCVWQ4iWv6I8HNsAX01k9z3AqjEgr7HO:vnWm5ClWZhWENtHNsAR9zygr6
MD5:	1FD59E1DD71EB3BDADB313029710DC33
SHA1:	82F5DE117D9C55247DA873AB8AD23F4E07841366
SHA-256:	953E4403094EC0C3E8C3A9AB38012CC36D86AC5FE3FFF2D6B6C5F51F75737C46
SHA-512:	69608FF0127587B93DB86C8CB27A932FA4B550C7D8D908F9FB8579BA2BCCC6D43E7283363F7B46DD39A40A8C790A030028A78302703658FD5D68F5EE9452A5AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A.........................................................0...............0...%..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21960
Entropy (8bit):	4.827217723133749
Encrypted:	false
SSDEEP:	192:rvh8Y17aFBRIWZhWdWJWadJCsVWQ4iWwBxu3O6YX01k9z3AFAjjHVy:bLdWZhW8CsRFR9z2AjjHVy
MD5:	481282554B34E19C77978DC7888434E6
SHA1:	BD33F1189FC79AC57716F9D030EF0BDD30205115
SHA-256:	8895C5AB2152A7F25F0C44A3457867229046952106D422331A1C57AD7935B47E
SHA-512:	FBE98FDA91618DD980709BABD8E56B8C4C4FF370E6DE23075F89303AAFFFD723DDDFD270F388C573914385E957ADD756BFE2B1FCEF5F9F86CB30E111177A52E9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....eM..........." ...&.....0...............................................@......$.....`A.........................................................0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.790131923417916
Encrypted:	false
SSDEEP:	192:dDWZhWqqWEXCVWQ4iWEchBm+0U8X01k9z3Areh3:1WZhWaf2Bmo8R9zYs
MD5:	78FC4A7E489F64EA5E0A745C12477FD8
SHA1:	51AB73B5142EE2F742ABDAEDF427690613A19F4A
SHA-256:	C12C28E3391A8C8ADCABE4632470DE824118C56338F46FCD8B99257709F50604
SHA-512:	C9064FF0B39421B28720E65E70695A997995CBEC80F1534D88B886BDA1797A7316D9B61E458B894B528C7BCE21C36F1D4ACD916DE96D0CDFDE59107EA93CD5D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...j5O@.........." ...&.....0...............................................@.......{....`A............................................e............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30248
Entropy (8bit):	5.124756298989814
Encrypted:	false
SSDEEP:	384:r7yaFM4Oe59Ckb1hgmLhWZhWPC2R9zQaXy:/FMq59Bb1jMbK9zni
MD5:	A12569B252B6761A6330D2FFB6C2983B
SHA1:	CC6BDB88B252144AF816976A181D2B3B961CE389
SHA-256:	AB0DE0CF89F88B947E01A5AB630D71384AD69F903CEF063CCB10DE54D061EA2E
SHA-512:	EE9CB0E2C613374348A34E4A65C83DA8D35E6E841F50EED726FF397C7BB6EC430ED200B3B1A541041A91EBE5AE0C96270EE7B891C8C173B340C82ABD2CDF8750
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...K..G.........." ...&.....P...............................................`.......$....`A.............................................%...........P...............P..(&..............p............................................................................rdata...'.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21944
Entropy (8bit):	4.851114039202199
Encrypted:	false
SSDEEP:	192:HeXrqjd79WZhWHWEXCVWQ4iWs1lNowcLK+X01k9z3A++/+e:H4rEWZhWcRTN6R9zZK
MD5:	38D1C8D2AA2023D85ACA69286D79FB78
SHA1:	A97E806268DC4EE781EC2BFB654ED8BF91C2A83A
SHA-256:	381A09A63B5818A2499144ADBD8C5F6BBCFCE93D643E9920CC54485006FBCC48
SHA-512:	FC71441009EBE69DFBC04A791CB401306CB88F7BED5290CD899E234D290209917DC7FBD0D0D1A16CEB056858C77306B8EE5F3C17432F3594904B73B20162738E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d................" ...&.....0...............................................@............`A............................................x............0...............0...%..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26152
Entropy (8bit):	5.013491600663517
Encrypted:	false
SSDEEP:	192:pmGqX8mPrpJhhf4AN5/KixWZhWnWEXCVWQ4KWMKDUX01k9z3AmaSAWXH:pysyr7PWZhW83pR9zX7VH
MD5:	DC8BFCEEC3D20100F29FD4798415DC00
SHA1:	BD4764BE2833F40C1CC54229C759F83D67AE5294
SHA-256:	4950D0A97CB18971355247FECCFD6F8EA24E46BCA30F54540C050E4631EC57A8
SHA-512:	CC7899AD716A81AF46D73B1CB8DED51AEE9619F2ACCC35859E351FB8EE4F965F5BCC9ADBB7353CA7A3C8E39D36C09481F66519CB173DA1D2578718C764FB6FAE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....Xj..........." ...&.....@...............................................P............`A............................................4............@...............@..(&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26168
Entropy (8bit):	5.280902373266687
Encrypted:	false
SSDEEP:	192:cqy+OV2OlkuWYFxEpah7WZhWNWJWadJCsVWQ4KW2TaY00pyEuX01k9z3A2pCahIS:8+OV2oFVh7WZhWMCsveEpcR9zjpCKn
MD5:	4A3342BCE6B58EF810E804F1C5915E40
SHA1:	FE636CCA0A57E92BB27E0F76075110981D3B3639
SHA-256:	2509179079A598B3E5DFD856D8E03E45DE7379C628901DBD869EC4332DDB618C
SHA-512:	F0C626F88F016C17FA45EA62441DD862A9575666EC06734F61D8E153C5F46A016FE1D9271293A8E29AFBD167F7A381E3EE04CB413736BC224AC31E0FE760341C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...T.w..........." ...&.....@...............................................P......x.....`A............................................a............@...............@..8&..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26168
Entropy (8bit):	5.274613783530853
Encrypted:	false
SSDEEP:	768:7CV5yguNvZ5VQgx3SbwA71IkFhmwEpw9z8Eb:A5yguNvZ5VQgx3SbwA71IyVEp4z5
MD5:	2E657FE299572EACDAC67F4B9F603857
SHA1:	EB4FBC0147D4DF5D4EF81953BC1265D505A19297
SHA-256:	EC3C2BFF10B9469AC9C6ED109307731A1A4694FB54856DDD082A2FFD3CC34DF2
SHA-512:	EE3899584ECECE342ACCBD73D681358CFE8B4FD2ED07CF3034B14F3D04E3B03E5D6D041A0AFCB0B2B2B5AFAC118032317B5ECA00D11F7703D9D0DAE0E3AC38F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d......G.........." ...&.....@...............................................P......}.....`A.........................................................@...............@..8&..............p............................................................................rdata.._........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	5.236019047489365
Encrypted:	false
SSDEEP:	192:AlhwDiWZhWgWJWadJCsVWQ4KWIq4nzY00pyEuX01k9z3A2pCa0Il:yWZhWtCsDxzEpcR9zjpC2
MD5:	9BC895E2CC140E168FA55372FCE8682B
SHA1:	579D71E19331625DDA84BAA9D8B81DD3BAFC9913
SHA-256:	287F80B2B330CC5F9FDF47DE50B189993CE925B5E2B7A6DA5CDAEF9C7D5F36C1
SHA-512:	DE0E5C6F9656106FCF2443D863D26C4B16BBB5B40E676199F9C459BE02B4837A2D32BDDDA82543EB2E0BF14A27EDEA7F5D506914DA8D63DA77ED7CCD2204AA65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d...M.l..........." ...&.....0...............................................@...........`A.........................................................0...............0..8&..............p............................................................................rdata..=...........................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22072
Entropy (8bit):	4.794932075714544
Encrypted:	false
SSDEEP:	192:y/fHQdu3WZhWKWJWadJCsVWQ4KWbyg8Y00pyEuX01k9z3A2pCaFIpM:y/f5WZhWnCsmyg8EpcR9zjpCxM
MD5:	4653DA8959B7FE33D32E61E472507D54
SHA1:	6D071B52F40DC609F40989B3DD0FB53124607DF8
SHA-256:	B7E186A946119791E42F17E623732E23F864F98B592C41D95B3DA0532EA9D5F3
SHA-512:	81E17CF4B64ED5EFBA191D35B1877384544557C3001EFA0321A755A35413740AE66E39E39F573D3184EF8C893C739A74D37F170FE540F81177A83B44BC18BA6D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%$..aEw.aEw.aEw.....`Ew...w.`Ew...s.cEw....`Ew...u.`Ew.RichaEw.........PE..d....s$..........." ...&.....0...............................................@......f.....`A............................................^............0...............0..8&..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\base_library.zip

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1029627
Entropy (8bit):	5.501988597633617
Encrypted:	false
SSDEEP:	24576:fhidb8tosQNRs54PK4IMiVw59bfCEzX2TBEx7gR32Dq:fhidb8tosQNRs54PK4I29OTBA7iKq
MD5:	BF8C0D4A45F2C849F32485A563ECBF6F
SHA1:	463617160DCB24C679C40A53B5A89B8B199B1708
SHA-256:	0365E936E50D48B88DB4630735ED6D4D8A57FC933CAB533C36CA1267213E8B14
SHA-512:	01FC89A4BDCFCA4532930A58A02639151DBBAE0EF751D75ADCE258741CD09F3DA1625C8769856C0CCCB2DC8A4F2A713035F00792B3FB2DACB454BAE35CCCD528
Malicious:	false
Preview:	PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin....A

C:\Users\user\AppData\Local\Temp\_MEI60562\bcrypt\_bcrypt.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	304128
Entropy (8bit):	6.439270025490856
Encrypted:	false
SSDEEP:	6144:YotX4Kpgfhnyu9Bkio/5hV+6gSa/AUJed:YcXlOAuDkioBj+Md
MD5:	C00C889C86F1953954B15D59FB93F888
SHA1:	C642CB2C0A198999E1E8C22D0D5A329475B2D95F
SHA-256:	93477D20C0BF0235B0287FB8274F563EDE810838154C4EF841B3388B3BE6387B
SHA-512:	0EA1532C13302FD85707E7E33DB5A0E35C407EAAFC7CF5CC2DB6C0662A940C32D9925CFCBE385475883D2F1706EA4CADBAE65A9E4F857A963CC9E638E7F6B823
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..Q..Q..Q......Q.''P..Q.''R..Q.''U..Q.''T..Q.%P..Q..P..Q..P.d.Q..Q.Q.. Q..Q.. S..Q.Rich.Q.................PE..d......f.........." ...(.$...~......\|.....................................................`..........................................w..T....w..................x'..............4.......T.......................(.......@............@...............................text...6#.......$.................. ..`.rdata...F...@...H...(..............@..@.data...0............p..............@....pdata..x'.......(...t..............@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291528
Entropy (8bit):	6.047650375646611
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5NP:QWb/TRJLWURrI5RWavdF0J
MD5:	181AC9A809B1A8F1BC39C1C5C777CF2A
SHA1:	9341E715CEA2E6207329E7034365749FCA1F37DC
SHA-256:	488BA960602BF07CC63F4EF7AEC108692FEC41820FC3328A8E3F3DE038149AEE
SHA-512:	E19A92B94AEDCF1282B3EF561BD471EA19ED361334092C55D72425F9183EBD1D30A619E493841B6F75C629F26F28DC682960977941B486C59475F21CF86FFF85
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.672271015164389
Encrypted:	false
SSDEEP:	96:IdCh72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh2XQMtCFQHq0fcX6g8cim1qeSju1:Im2HzzU2bRYoeuHncqgvimoe
MD5:	38105DF780EDDD734027328E0DCA0CA3
SHA1:	45F1D9E3472478F8E1BA86675F5C81C00B183BEA
SHA-256:	9512896233D2119E78E2E1FCFD83643B2BE2B427F08D16FC568FE98B9D4913CB
SHA-512:	BA2A05C236CE47D87888F618BE2B23532D0D882578707B07AE220A96883B468F7088A19EBBE3BAC2ADF4035DA6B7EE6FA9E57B620E2BC67B28E54CD969D6BBB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B1...P...P...P...(...P.../...P..M(...P.../...P.../...P.../...P...$...P...P.. P..?...P..?...P..?.a..P..?...P..Rich.P..........................PE..d....gAe.........." ...%.....................................................p............`..........................................'..l...\(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.878471536699278
Encrypted:	false
SSDEEP:	3072:fwyXU0GUUIB37Jy/TcqxcBpAFbbC6CpmZ48q:YUqxEqCfEZpq
MD5:	073F09E1EDF5EC4173CE2DE1121B9DD1
SHA1:	6CDB2559A1B706446CDD993E6FD680095E119B2E
SHA-256:	7412969BFE1BCA38BBB25BAB02B54506A05015A4944B54953FCFDB179EC3F13C
SHA-512:	70A1A766001EC78A5FCE7EADF6CAE07F11B3CA6B08115E130C77D024524879577CCAB263C596102102B1569933C601592FBB5EE07C7DB123BB850965EF8E8E96
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............pr..pr..pr......pr...s..pr...s..pr...w..pr...v..pr...q..pr.#.s..pr..ps..pr...z..pr...r..pr......pr...p..pr.Rich.pr.........................PE..d....gAe.........." ...%........... -....................................... ............`.............................................`...P.......................................Px...............................w..@............@...............................text...H(......................... ..`.rdata...W...@...X..................@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	4.554768229532207
Encrypted:	false
SSDEEP:	6:h9Co8FyQjkDYc5tWreLBF/pn2mHr2DASvUSBT5+FL8tjivzn:h9aVM/mrGzRsvUSBT5+J8li7n
MD5:	BF405A8056A6647E7D077B0E7BC36ABA
SHA1:	36C43938EFD5C62DDEC283557007E4BDFB4E0797
SHA-256:	43DAD2CC752AB721CD9A9F36ECE70FB53AB7713551F2D3D8694D8E8C5A06D6E2
SHA-512:	16590110B2F659D9C131B2093E05D30919A67368154305DCFE8D54FB88525F49F9F9F385A77BA5BCBEA8092061011D72B1BCC65CDC784BCFDDE10CE4DCE5586F
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses...The code used in the OS random engine is derived from CPython, and is licensed.under the terms of the PSF License Agreement..

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\LICENSE.PSF

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2415
Entropy (8bit):	5.015031803022437
Encrypted:	false
SSDEEP:	48:xUXyp7TEJzIXFCPXB/XF/gwHsV3XF2iDaGkiCXF1u0A2s/8AMUiioTqNyPhIXF+v:KXG3EJ0EPX9rsV3ZdkZ8oAShTkyZIYAw
MD5:	43C37D21E1DBAD10CDDCD150BA2C0595
SHA1:	ACF6B1628B04FE43A99071223CDBD7B66691C264
SHA-256:	693EC0A662B39F995A4F252B03A6222945470C1B6F12CA02918E4EFE0DF64B9F
SHA-512:	96D7C63AD24F7543599F0FED919948E486B35D01694BE02D980A8BA3D2A8B5A0E42341D940841D3528F56F09A582D32B3E81DED44BB3AAD1874C92650CB08129
Malicious:	false
Preview:	1. This LICENSE AGREEMENT is between the Python Software Foundation ("PSF"), and. the Individual or Organization ("Licensee") accessing and otherwise using Python. 2.7.12 software in source or binary form and its associated documentation...2. Subject to the terms and conditions of this License Agreement, PSF hereby. grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,. analyze, test, perform and/or display publicly, prepare derivative works,. distribute, and otherwise use Python 2.7.12 alone or in any derivative. version, provided, however, that PSF's License Agreement and PSF's notice of. copyright, i.e., "Copyright . 2001-2016 Python Software Foundation; All Rights. Reserved" are retained in Python 2.7.12 alone or in any derivative version. prepared by Licensee...3. In the event Licensee prepares a derivative work that is based on or. incorporates Python 2.7.12 or any part thereof, and wants to make the. derivative work available to ot

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5068
Entropy (8bit):	5.076339504081192
Encrypted:	false
SSDEEP:	96:DDKVZ4WQIUQIhQIKQILbQIRIaMmPktxsx/1A0ivAEYaCjF04rpklE2jQech5mjvj:0acPuPXs/u0ivAEYaCjF04rpklE2jE03
MD5:	6723294F406FC0A1E70892680472A8E1
SHA1:	18802D07F5E3C416BD27B204AF13EE08316E0C4A
SHA-256:	CFB2C2C8067495438DC92FD335B51A04584A01283FCDDB6E4B03859049BEA2C6
SHA-512:	97DBDFF77AE87E5AED7A680668F9E8FB4A1FF5F3A7CB290E064896DF99ED2954E5D69433C605EAF97BE44D980FC4564C10A39176650BA4CBCE37FBCA0E22BE92
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: cryptography.Version: 3.4.8.Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers..Home-page: https://github.com/pyca/cryptography.Author: The Python Cryptographic Authority and individual contributors.Author-email: cryptography-dev@python.org.License: BSD or Apache License, Version 2.0.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language ::

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16213
Entropy (8bit):	5.517159774741598
Encrypted:	false
SSDEEP:	384:NUXaxfEhrvJzrPMOOZWGmAufMdpdNT2UbycOpCNOvUfomBN:NUKxfEhrvJzbI2kF/N
MD5:	B7B9537DB89E17783D25AFB4EC15F462
SHA1:	77B37400EE0F3751C9BED57C2B3BB38F0F801FE2
SHA-256:	771938223E14E33E82D4D16D8D4FA873D196C164CBEF5ECBADED8C5EE2A59DAC
SHA-512:	8DF93B200B10A55549BB04ABED1AECCCD4952FFFE829C3F90097602125B425C5E5812077DD3CC9F993E3FE02AC887C046AE06A345471419E77AC14F2A757EAB9
Malicious:	false
Preview:	cryptography-3.4.8.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-3.4.8.dist-info/LICENSE,sha256=Q9rSzHUqtyHNmp827OcPtTq3cTVR8tPYaU2OjFoG1uI,323..cryptography-3.4.8.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-3.4.8.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-3.4.8.dist-info/LICENSE.PSF,sha256=aT7ApmKzn5laTyUrA6YiKUVHDBtvEsoCkY5O_g32S58,2415..cryptography-3.4.8.dist-info/METADATA,sha256=z7LCyAZ0lUONyS_TNbUaBFhKASg_zdtuSwOFkEm-osY,5068..cryptography-3.4.8.dist-info/RECORD,,..cryptography-3.4.8.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-3.4.8.dist-info/WHEEL,sha256=g0Gp_9X_YiwOuaF1hZMQNaS1qKUg2WIXRJjlZWggGSw,100..cryptography-3.4.8.dist-info/top_level.txt,sha256=rR2wh6A6juD02TBZNJqqonh8x9UP9Sa5Z9Hl1pCPCiM,31..cryptography/__about__.py,sha256=Gma4uMyERDaqXMloHsN56Lo-XunkiH9-joZKZJPG5a8,805..cryptography/__ini

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.992787665793268
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViYHgP+tkKc5vKQLn:RtBMwlViYAWK/SQLn
MD5:	81473BB8DD3C8C2FAB84DF8D7FE8E9FB
SHA1:	F91348D2BD8A4A48F331C55ED939AA964C2503E1
SHA-256:	8341A9FFD5FF622C0EB9A17585931035A4B5A8A520D962174498E5656820192C
SHA-512:	C16213B3BEA153A781C3EBD1741CA34865F6240A7AA1F9DBF73F9D0C7D7FBAF2545EDAF9CEEA89C287725273EC5F744FF7FFEC073121EFDE3E7783671129301A
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.37.0).Root-Is-Purelib: false.Tag: cp36-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography-3.4.8.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.962103165155795
Encrypted:	false
SSDEEP:	3:DA1JjBHvAYuOv:DUOev
MD5:	62246E29EB9A005B743A15C18FE944DD
SHA1:	10A5E354DAA692FF714D3C49BED348ABD8A485C7
SHA-256:	AD1DB087A03A8EE0F4D93059349AAAA2787CC7D50FF526B967D1E5D6908F0A23
SHA-512:	F16FDA3B0A05A1B5F7D8F63E8A223B27CA4689F559D4A00357E129ECB24AD3E8B4519A70D59919DE8D93ADC8AD3B0EAF05192E3D18CE876D7DCA13ED498A0FCC
Malicious:	false
Preview:	_openssl._padding.cryptography.

C:\Users\user\AppData\Local\Temp\_MEI60562\cryptography\hazmat\bindings\_openssl.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3120128
Entropy (8bit):	6.664100235549327
Encrypted:	false
SSDEEP:	49152:FMVwASOyGtlql4IU6iAc1vdDP4GKJmhpdmdYTKugTt2mPTUT42Nr:JH+r1vphSaTm2QUT42l
MD5:	40646757F855E446AE37FEC76DE99A92
SHA1:	7013F6F293FF8DF18558147C7D05F7D453FAF447
SHA-256:	68F036B96D1BF85C5BB7BD15DF187E1BA3A848B2ABCF04FE5D2598CDEE13DCF0
SHA-512:	A25F689C85B9E19F6AA9E1CD10CB414D38CAB79BA476E52756F7D3879895DE225457D94384B7DFD4754C2A0753D7FF258B7DA52A829568BA6C8E9F2BB96D9FDE
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......tDW,0%9.0%9.0%9.9].."%9.bP8~2%9.bP<~<%9.bP=~8%9.bP:~4%9..Q8~2%9.$N8~=%9.0%8..%9.0%9.,%9..P=~.'9..P1~1%9..P9~1%9..P..1%9..P;~1%9.Rich0%9.........................PE..d...:+%a.........." .....L"......... .........................................0...........`......................................... N,.P...pN,.h...../......0...D............/.h}.................................0..8............`"..............................text....K"......L"................. ..`.rdata..,....`"......P".............@..@.data.......p,......T,.............@....pdata...D...0...F....-.............@..@.rsrc........./......./.............@..@.reloc..h}..../..~..../.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	189000
Entropy (8bit):	6.310516938504568
Encrypted:	false
SSDEEP:	3072:NLSp96+JvGNw61ctOjB5vrNm067VpwiKdF3+6xdvl18UfKIz4qztsOSSnVDNYWum:a97vkw61BB5vrNm0Kj5+vxfKdqfVTum
MD5:	11A886189EB726D5786926CC09F9E116
SHA1:	D94295368A1285681FB03BAC0553EB1495D43805
SHA-256:	DC38BDBE10CFAA99799E0C87AA8444FC062D445B87686D6593FFCA46CC938031
SHA-512:	405C56487A91AD1209029CA6EA125642076251F0A8C069EEF0E30CE484381DB7BF24D2F5CD74B83D1C8C1358F92F35FA6ED7B75601ACE611CF36BB2331588684
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........eb...1...1...1...1...1P..0...1P..0...1P..0...1P..0...1...0...1..0...1...1...1...0...1...0...1...1...1...0...1Rich...1........................PE..d...^.._.........." .................................................................$....`.........................................P...P....................... .......H............%..T............................&...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\python3.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58952
Entropy (8bit):	5.848741332074507
Encrypted:	false
SSDEEP:	768:FTS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSx5:q9xiEAnUvdkdINV0Eyv
MD5:	9779C701BE8E17867D1D92D470607948
SHA1:	6AAE834541CCC73D1C87C9F1A12DF4AC0CF9001F
SHA-256:	59E6421802D30326C1704F15ACC2B2888097241E291ABA4860D1E1FC3D26D4BF
SHA-512:	4E34BCDD2093347D2B4E5C0F8C25F5D36D54097283FAF5B2BE1C75D717F716D459A45336647D3360457F25417952E62F8F21F5A720204FE5B894D5513E43E782
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.....d...d...d...l...d...d...d......d...f...d.Rich..d.................PE..d...O.._.........." ................................................................M.....`.........................................` ..@...............................H............ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\python38.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4209224
Entropy (8bit):	6.419196959467616
Encrypted:	false
SSDEEP:	49152:qc3VjUbaXKKpiMo2eArGQgukWACEU05yTTysQHbhAT+JClyqA8qcW2d6RVFiT7PR:Fyw/rkTVElJHXZGU/DH4MbXEF9rQv
MD5:	1F2688B97F9827F1DE7DFEDB4AD2348C
SHA1:	A9650970D38E30835336426F704579E87FCFC892
SHA-256:	169EEB1BDF99ED93CA26453D5CA49339E5AE092662CD94CDE09FBB10046F83FC
SHA-512:	27E56B2D73226E36B0C473D8EB646813997CBDF955397D0B61FCAE37ED1F2C3715E589F9A07D909A967009ED2C664D14007CCF37D83A7DF7CE2A0FEFCA615503
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... M..X...5...X..H....X...5...X...5...X...5...X..0...X...X..Y..J6...X..J6...X..J6!..X..J6...X..Rich.X..................PE..d...F.._.........." .........."...............................................C.....m.@...`..........................................8.......9.\|....pB......p@.,.... @.H.....B..t.. r!.T............................r!............... .`............................text............................... ..`.rdata..l..... .....................@..@.data.........9.......9.............@....pdata..,....p@.......=.............@..@.rsrc........pB.......?.............@..@.reloc...t....B..v....?.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\pywin32_system32\pywintypes38.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	6.010139157748554
Encrypted:	false
SSDEEP:	3072:mjbngJOM0WyPQSst/1ZI32yYrrC0P0xsr1praPDe+4KKPu7UJdap:+bgp0BISst/16YrrC0Ju7e1Kuu7UJ
MD5:	F60DA44A33910EDA70D838D7635D8FB1
SHA1:	C35B4CF47349888384729386C74C374EDB6F6FF3
SHA-256:	13934599FF931F97E8EAC6106DC67D54609BEFD0B0E653B46F6C25B18830C572
SHA-512:	3C57ED384C23C89F99708BDF688EBD28629E84DF8756E7B64DFA8B6E0B52BEEFB0C62DE820F2C72E5679B7632279DCB414A781CFD2C5C9654D09D9DA24FA17B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .................,.......................................p............`.........................................0...`B......,....P..d....0...............`..0...@t..T............................t..8............................................text............................... ..`.rdata..............................@..@.data....-.......(..................@....pdata.......0......................@..@.rsrc...d....P.......$..............@..@.reloc..0....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\select.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26696
Entropy (8bit):	6.083258526295506
Encrypted:	false
SSDEEP:	768:hGNKrWZwhMHqSa/QtmI0dINqGSWDG4yiJ:hqKrWmhMKSa/QtmI0dINqGXye
MD5:	A2AB334E18222738DCB05BF820725938
SHA1:	2F75455A471F95AC814B8E4560A023034480B7B5
SHA-256:	7BA95624370216795EA4A087C326422CFCBCCC42B5ADA21F4D85C532C71AFAD7
SHA-512:	72E891D1C7E5EA44A569283B5C8BD8C310F2EE3D3CC9C25C6A7D7D77A62CB301C822C833B0792C3163CF0B0D6272DA2F667E6BC74B07ED7946082433F77D9679
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P...1...1...1...I~..1../\...1../\...1../\...1../\...1..f_...1..Y...1...1...1..f_...1..f_...1..f_...1..f_...1..Rich.1..................PE..d...V.._.........." .........4......X...............................................\|.....`......................................... @..L...l@..x....p.......`.......N..H.......,....2..T........................... 3...............0...............................text............................... ..`.rdata..X....0....... ..............@..@.data........P.......:..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc..,............L..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122768
Entropy (8bit):	6.6466118295886165
Encrypted:	false
SSDEEP:	24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
MD5:	3B337C2D41069B0A1E43E30F891C3813
SHA1:	EBEE2827B5CB153CBBB51C9718DA1549FA80FC5C
SHA-256:	C04DAEBA7E7C4B711D33993AB4C51A2E087F98F4211AEA0DCB3A216656BA0AB7
SHA-512:	FDB3012A71221447B35757ED2BDCA6ED1F8833B2F81D03AABEBD2CD7780A33A9C3D816535D03C5C3EDD5AAF11D91156842B380E2A63135E3C7F87193AD211499
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:K..:K..:K..K..:K..;K..:KK..K..:KK.:J..:KK.9J..:KK.?J..:KK.>J.:KK.4J..:KK..K..:KK.8J..:KRich..:K........PE..d................" .....0..........0^...............................................N....`A................................................................. ...........!...... .......p............................Z..8..............(............................text...X .......0.................. ..`.rdata......@.......@..............@..@.data....&....... ..................@....pdata....... ......................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1096264
Entropy (8bit):	5.342861808860828
Encrypted:	false
SSDEEP:	12288:reQqQOZ6K191SnFRFotduNdBjCmN/XlyCAx9++bBlhJk93cgewrxEeBpl8:reQGn4oghCc/+9nbDhG2wrxpl8
MD5:	549C9EEDA8546CD32D0713C723ABD12A
SHA1:	F84B2C529CFF58B888CC99F566FCD2EBA6FF2B8E
SHA-256:	5D5E733397EF7C4946CF26C84B07312CB12EAF339374613D4381E694EF38169B
SHA-512:	9432DAF045BAC3E322B1797F49AFE50F76FAF8B7D8DB063A1D56578016C813881AF3324E2529032A8644A04B58CCC9D2C363BF92B56115F06B9EEFEBFAB08180
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.{FU.(FU.(FU.(O-/(@U.(.8.)DU.(.8.)JU.(.8.)NU.(.8.)DU.(.;.)EU.(.=.)DU.(FU.(.U.(.;.)GU.(.;.)GU.(.;C(GU.(.;.)GU.(RichFU.(................PE..d...W.._.........." .....J...X.......)..............................................jL....`.............................................X...............................H...........@)..T............................)...............`...............................text...NI.......J.................. ..`.rdata...-...`.......N..............@..@.data................\|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI60562\win32wnet.pyd

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.572930724109382
Encrypted:	false
SSDEEP:	768:2uFLa14u3wdL8AKlcFcpXIxtOdKlr2Q5uu2x:2uY14uWL8IFcpc2Q5R2
MD5:	BA0890D7B3CF1A791E2889D74D426ED6
SHA1:	14E25C625CB14956A788D533E05961564F6B2AA6
SHA-256:	AE7FDBC07D7C18F865EC91E59913F6845E6147E724064D400197D8E98E88CE03
SHA-512:	C4989E6DF88AAFE6AEAA0950F7FE23ED77F238DBFA6733425268E208AB071611C6BBC17558D165F45EC9CB41C9B2A2875938550C082AA2802B2DB0FCE910DF81
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fTG..:...:...:.......:..r;...:..r?...:..r>...:..r9...:.Tr;...:..a;...:..l;...:...;...:.Tr3...:.Tr:...:.Tr8...:.Rich..:.........PE..d......d.........." .....D...P............................................................`.........................................p...H...............T............................q..T...........................`q..8............`...............................text....C.......D.................. ..`.rdata...7...`...8...H..............@..@.data...(...........................@....pdata..............................@..@.rsrc...T...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Software\lockfile

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.975418017913833
Encrypted:	false
SSDEEP:	3:RrGiC:EiC
MD5:	ACBF9D29C4729CF268B99F8FFC6143FB
SHA1:	8A95A4D55C1A0E012BBF2E4F24053D7F557327D0
SHA-256:	857A3C2BD75681CEFE05DC54BC70C82A4CC2B685CF9226749F0969A70DEAD604
SHA-512:	C98CDB84E39EED8898E60372D078E2A7CDDE347A8DE0F9789DC8A0482A63DDAF6EF06A4C405835DA353A6FBCFCF440FFB8EDDCA07F024E4F4391546C8C31DEDE
Malicious:	false
Preview:	registry_65f93d51.exe

C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe

Download File

Process:	C:\Users\user\Desktop\wsx.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10090064
Entropy (8bit):	7.993553292717728
Encrypted:	true
SSDEEP:	196608:Ad4d4uXu8mSxCyl9onJ5hrZERV5+ENFJzFcgut1W+4Xp+6PVuEv:CjuXu8mSxr9c5hlERV5RFJzFcgutQ+iF
MD5:	BFBEFE6213EA9B1D3D0F92C970998D80
SHA1:	DB7863DF94867D3522C47AB417437E0E8C81B124
SHA-256:	C337E536BB2195AD30D214FEE810360815797A4E3BD91A7D88949E4DF6948791
SHA-512:	FB84C92B1210B929590DC87E702312173C2D800EDF66A0163025B2C27406089B1C42F9C4B0EEE4F1BFB48C945A3D389A5C4B436E522FF95368B9CF75C34DBD8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.f}i.f}i.f}i..~h.f}i..xhSf}i..yh.f}i...i.f}i..xh.f}i..yh.f}i..~h.f}i..\|h.f}i.f\|igf}i..yh.f}i...h.f}iRich.f}i........................PE..d...c9.f..........".... .....\.................@.............................0......3'....`.....................................................x.... ........... ........... ..X... ...................................@............................................text... ........................... ..`.rdata...*.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..X.... ......................@..B................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.993553292717728
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	wsx.exe
File size:	10'090'064 bytes
MD5:	bfbefe6213ea9b1d3d0f92c970998d80
SHA1:	db7863df94867d3522c47ab417437e0e8c81b124
SHA256:	c337e536bb2195ad30d214fee810360815797a4e3bd91a7d88949e4df6948791
SHA512:	fb84c92b1210b929590dc87e702312173c2d800edf66a0163025b2c27406089b1c42f9c4b0eee4f1bfb48c945a3d389a5c4b436e522ff95368b9cf75c34dbd8f
SSDEEP:	196608:Ad4d4uXu8mSxCyl9onJ5hrZERV5+ENFJzFcgut1W+4Xp+6PVuEv:CjuXu8mSxr9c5hlERV5RFJzFcgutQ+iF
TLSH:	0AA6331966511CD6EEB75838D072C824C2B3B8260B90D34B6BF823BA6F977D45E7E311
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.f}i.f}i.f}i..~h.f}i..xhSf}i..yh.f}i...i.f}i..xh.f}i..yh.f}i..~h.f}i..\|h.f}i.f\|igf}i..yh.f}i...h.f}iRich.f}i...............

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000afb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F83963 [Sat Sep 28 17:14:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	a6cec5b1a631d592d80900ab7e1de8df

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F270CC1097Ch
dec eax
add esp, 28h
jmp 00007F270CC102EFh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001F20Bh]
dec eax
mov ecx, ebx
call dword ptr [0001F1FAh]
call dword ptr [0001F16Ch]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001F1F0h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001F1DCh]
test eax, eax
je 00007F270CC10479h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0004106Ah]
call 00007F270CC1063Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00041151h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [000410E1h], eax
dec eax
mov eax, dword ptr [0004113Ah]
dec eax
mov dword ptr [00040FABh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [000410AFh], eax
mov dword ptr [00040F85h], C0000409h
mov dword ptr [00040F7Fh], 00000001h
mov dword ptr [00000089h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bc94	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0xf49c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39420	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x392e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28720	0x28800	bde1e371902cf81ea9be7e3f95382cfd	False	0.5581657503858025	data	6.484685085891853	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12a9e	0x12c00	e93ec62c2718b446c5b2b08d5d0e0af5	False	0.5159765625	data	5.820343070836644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103e8	0xe00	baf7e08c61eeb50b5a3978422561c938	False	0.13113839285714285	data	1.8069121639354628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20c4	0x2200	306be8c7742d2c9622517b124ebf3ac1	False	0.4775965073529412	data	5.330382837068586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	e9000b5de7c8ee475c9ff9bfd52a2223	False	0.392578125	data	2.7647001855526416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0xf49c	0xf600	727c5c2ae29471efe875dab73af6dad2	False	0.8036553607723578	data	7.5555815867551965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0x758	0x800	bc11f54c2d33adf3a95c6af00e70eb22	False	0.5390625	data	5.236213438241001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x52208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x530b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x53958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x53ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x5d3ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x5f994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x60a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x60ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x60f0c	0x58f	XML 1.0 document, ASCII text, with CRLF line terminators	0.44694307800421645

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 11:37:24.745549917 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:24.750371933 CEST	80	49724	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:24.750466108 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:24.756974936 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:24.761832952 CEST	80	49724	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:25.474375963 CEST	80	49724	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:25.522439957 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:25.991578102 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:25.991622925 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:25.991691113 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:25.995946884 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:25.995960951 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:26.623302937 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:26.623912096 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:26.623938084 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:26.624900103 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:26.624977112 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:26.625828981 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:26.625951052 CEST	443	49725	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:26.625988007 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:26.626005888 CEST	49725	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:26.626488924 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:26.631544113 CEST	80	49724	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:26.631611109 CEST	49724	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:28.425179958 CEST	49727	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:28.430001974 CEST	80	49727	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:28.432830095 CEST	49727	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:28.444415092 CEST	49727	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:28.449332952 CEST	80	49727	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:29.138689995 CEST	80	49727	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:29.194298029 CEST	49727	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:29.235567093 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.235635996 CEST	443	49728	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:29.235702991 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.236824989 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.236841917 CEST	443	49728	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:29.858711004 CEST	443	49728	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:29.859286070 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.859304905 CEST	443	49728	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:29.860780001 CEST	443	49728	94.156.67.32	192.168.2.5
Oct 1, 2024 11:37:29.860841036 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.861408949 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.861536980 CEST	49728	443	192.168.2.5	94.156.67.32
Oct 1, 2024 11:37:29.861835957 CEST	49727	80	192.168.2.5	191.252.83.191
Oct 1, 2024 11:37:29.867203951 CEST	80	49727	191.252.83.191	192.168.2.5
Oct 1, 2024 11:37:29.867276907 CEST	49727	80	192.168.2.5	191.252.83.191

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 11:37:24.516484976 CEST	51855	53	192.168.2.5	1.1.1.1
Oct 1, 2024 11:37:24.741719007 CEST	53	51855	1.1.1.1	192.168.2.5
Oct 1, 2024 11:37:25.477189064 CEST	49617	53	192.168.2.5	1.1.1.1
Oct 1, 2024 11:37:25.986530066 CEST	53	49617	1.1.1.1	192.168.2.5
Oct 1, 2024 11:37:38.765292883 CEST	53	64658	162.159.36.2	192.168.2.5
Oct 1, 2024 11:37:39.695219040 CEST	53	59441	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 11:37:24.516484976 CEST	192.168.2.5	1.1.1.1	0x5883	Standard query (0)	pontoslivelobb.servicos.ws	A (IP address)	IN (0x0001)	false
Oct 1, 2024 11:37:25.477189064 CEST	192.168.2.5	1.1.1.1	0xb15	Standard query (0)	estudosadulto.educacao.ws	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 11:36:55.673516989 CEST	1.1.1.1	192.168.2.5	0x9b54	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 1, 2024 11:36:55.673516989 CEST	1.1.1.1	192.168.2.5	0x9b54	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 1, 2024 11:37:24.741719007 CEST	1.1.1.1	192.168.2.5	0x5883	No error (0)	pontoslivelobb.servicos.ws		191.252.83.191	A (IP address)	IN (0x0001)	false
Oct 1, 2024 11:37:25.986530066 CEST	1.1.1.1	192.168.2.5	0xb15	No error (0)	estudosadulto.educacao.ws		94.156.67.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pontoslivelobb.servicos.ws

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49724	191.252.83.191	80	2132	C:\Users\user\Desktop\wsx.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 11:37:24.756974936 CEST	166	OUT	GET /conta.php HTTP/1.1 Host: pontoslivelobb.servicos.ws User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Oct 1, 2024 11:37:25.474375963 CEST	353	IN	HTTP/1.1 302 Found Server: nginx/1.22.1 Date: Tue, 01 Oct 2024 09:37:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/8.3.0 Location: https://estudosadulto.educacao.ws/contador/contador.php X-Cache: BYPASS Lw-X-Id: a27aa96adf722c722add130787a1ac0a.3323052-8.46.123.33:11205@dinesh0014

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49727	191.252.83.191	80	5064	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 11:37:28.444415092 CEST	166	OUT	GET /conta.php HTTP/1.1 Host: pontoslivelobb.servicos.ws User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: / Connection: keep-alive
Oct 1, 2024 11:37:29.138689995 CEST	353	IN	HTTP/1.1 302 Found Server: nginx/1.22.1 Date: Tue, 01 Oct 2024 09:37:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/8.3.0 Location: https://estudosadulto.educacao.ws/contador/contador.php X-Cache: BYPASS Lw-X-Id: 618d92e75b6e05691382ec5c9d8d02f6.3323175-8.46.123.33:11242@dinesh0014

Target ID:	0
Start time:	05:37:19
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\wsx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wsx.exe"
Imagebase:	0x7ff7e71d0000
File size:	10'090'064 bytes
MD5 hash:	BFBEFE6213EA9B1D3D0F92C970998D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:37:21
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\wsx.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wsx.exe"
Imagebase:	0x7ff7e71d0000
File size:	10'090'064 bytes
MD5 hash:	BFBEFE6213EA9B1D3D0F92C970998D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""
Imagebase:	0x7ff7404a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /tn "registry_65f93d51.exe"
Imagebase:	0x7ff668780000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f"
Imagebase:	0x7ff7404a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:37:23
Start date:	01/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "registry_65f93d51.exe" /tr "C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe" /sc onlogon /rl highest /f
Imagebase:	0x7ff668780000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:37:24
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Imagebase:	0x7ff6bd5c0000
File size:	10'090'064 bytes
MD5 hash:	BFBEFE6213EA9B1D3D0F92C970998D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:37:26
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Software\registry_65f93d51.exe
Imagebase:	0x7ff6bd5c0000
File size:	10'090'064 bytes
MD5 hash:	BFBEFE6213EA9B1D3D0F92C970998D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:37:27
Start date:	01/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "schtasks /query /tn "registry_65f93d51.exe""
Imagebase:	0x7ff7404a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:37:27
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:37:27
Start date:	01/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /query /tn "registry_65f93d51.exe"
Imagebase:	0x7ff668780000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	29

Executed Functions

Function 00007FF7E71F4D50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E71F4D95

Part of subcall function 00007FF7E71F46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F46FC

Part of subcall function 00007FF7E71E9D48: RtlFreeHeap.NTDLL(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

Part of subcall function 00007FF7E71E9D00: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E71E9CDF,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71E9D09
Part of subcall function 00007FF7E71E9D00: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E71E9CDF,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71E9D2E

_get_daylight.LIBCMT ref: 00007FF7E71F4D84

Part of subcall function 00007FF7E71F4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F475C

_get_daylight.LIBCMT ref: 00007FF7E71F4FFA
_get_daylight.LIBCMT ref: 00007FF7E71F500B
_get_daylight.LIBCMT ref: 00007FF7E71F501C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71F525C), ref: 00007FF7E71F5043

Strings

Eastern Summer Time, xrefs: 00007FF7E71F5101
Eastern Standard Time, xrefs: 00007FF7E71F50E9

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 3cbab8ded4b22c9ecff02dc7d03bcb7a7c6bdc9119315e29a6b66e941e77c5ab
Instruction ID: 65339d913b94eb0a5e10f87a0746d84686f3380d16f0c102bb8684e649c7dbf7
Opcode Fuzzy Hash: 3cbab8ded4b22c9ecff02dc7d03bcb7a7c6bdc9119315e29a6b66e941e77c5ab
Instruction Fuzzy Hash: DBD1CF26A0875286E728BF25E8403B9A261FFC4794F844137EF6D47686DF3CE4538762

Function 00007FF7E71F5C9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5A11
Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5A8F
Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5AE0

CreateFileW.KERNELBASE ref: 00007FF7E71F5DA2
CreateFileW.KERNEL32 ref: 00007FF7E71F5DF2
GetLastError.KERNEL32 ref: 00007FF7E71F5E22
GetFileType.KERNELBASE ref: 00007FF7E71F5E37
GetLastError.KERNEL32 ref: 00007FF7E71F5E41
CloseHandle.KERNEL32 ref: 00007FF7E71F5E74
CloseHandle.KERNEL32 ref: 00007FF7E71F5FD7
CreateFileW.KERNEL32 ref: 00007FF7E71F600C
GetLastError.KERNEL32 ref: 00007FF7E71F601B

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 632e748b839932f5b00ec5f176d5a067dee1d4c4f3157cbf34afbb6f699b0397
Instruction ID: 96cc182db4407940e0487c6f38c8e5f2927640bbd52c924e9c8c78a9e02ff2e4
Opcode Fuzzy Hash: 632e748b839932f5b00ec5f176d5a067dee1d4c4f3157cbf34afbb6f699b0397
Instruction Fuzzy Hash: 48C1F536B24B4186EB14EF64D4807AC7761FB89B98B510236DF2E97394CF38D466C311

Function 00007FF7E71D6760 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF7E71D672D), ref: 00007FF7E71D67FA

Part of subcall function 00007FF7E71D6970: GetEnvironmentVariableW.KERNEL32(00007FF7E71D36C7), ref: 00007FF7E71D69AA
Part of subcall function 00007FF7E71D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E71D69C7

Part of subcall function 00007FF7E71E65E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E65FD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E71D68B1

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

_MEI%d, xrefs: 00007FF7E71D6808
TMP, xrefs: 00007FF7E71D6798, 00007FF7E71D6859, 00007FF7E71D68E7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7E71D67D8
TMP, xrefs: 00007FF7E71D67BE

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: dd061f857628f8cce594bc41954d9e76e8095696f5180e2e17042c5623d0381d
Instruction ID: 09ae2a45e22da233d4f2d3778be83b74bc8954915f471c0d8d42bd746dafbb5d
Opcode Fuzzy Hash: dd061f857628f8cce594bc41954d9e76e8095696f5180e2e17042c5623d0381d
Instruction Fuzzy Hash: 8B513F11B1974341ED58BB21F9953BA92519FC5BC1FC85033EE2E8779ADD3CE4034A22

Function 00007FF7E71F4FCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E71F4FFA

Part of subcall function 00007FF7E71F4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F475C

_get_daylight.LIBCMT ref: 00007FF7E71F500B

Part of subcall function 00007FF7E71F46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F46FC

_get_daylight.LIBCMT ref: 00007FF7E71F501C

Part of subcall function 00007FF7E71F4718: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F472C

Part of subcall function 00007FF7E71E9D48: RtlFreeHeap.NTDLL(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71F525C), ref: 00007FF7E71F5043

Strings

Eastern Summer Time, xrefs: 00007FF7E71F5101
Eastern Standard Time, xrefs: 00007FF7E71F50E9

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 6f592b97884ad86c6c5862fa308072426eccbbb8b3cbff7b01d41fc1ca71d458
Instruction ID: 8f04323fa3229e03df4e870a358000656c322c9fe85baf0497456a4b7b9c0a96
Opcode Fuzzy Hash: 6f592b97884ad86c6c5862fa308072426eccbbb8b3cbff7b01d41fc1ca71d458
Instruction Fuzzy Hash: A5518F32A1875286E724FF21E8803A9A764FF88784FC44137EB6D47696DF3CE4128761

Function 00007FF7E71D17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7E71D185C
_fread_nolock.LIBCMT ref: 00007FF7E71D190E

Part of subcall function 00007FF7E71DF2A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF2B4

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

malloc, xrefs: 00007FF7E71D18EA
MEI, xrefs: 00007FF7E71D17EF
Could not allocate buffer for TOC!, xrefs: 00007FF7E71D18E3
Failed to read cookie!, xrefs: 00007FF7E71D1867
fread, xrefs: 00007FF7E71D186E
Error on file., xrefs: 00007FF7E71D193D
fseek, xrefs: 00007FF7E71D1836
Failed to seek to cookie position!, xrefs: 00007FF7E71D182F
Cannot read Table of Contents., xrefs: 00007FF7E71D1995
Could not read full TOC!, xrefs: 00007FF7E71D1919

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 2efe959c749f8f76afec8a79fa2cafb61957af1c93f5bf12395ebeb40fb25534
Instruction ID: 3804ac050ed35f54fc5191fd7c15555d91f40baff757bbb0da3ad7d18b535726
Opcode Fuzzy Hash: 2efe959c749f8f76afec8a79fa2cafb61957af1c93f5bf12395ebeb40fb25534
Instruction Fuzzy Hash: 2C515F71A0970286EB18EF24E491378A3A1FF88B59B954137DB2D83395DF3CE542CB52

Function 00007FF7E71D1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E71D14F9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E71D14CA
malloc, xrefs: 00007FF7E71D1560
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E71D15E5
fread, xrefs: 00007FF7E71D15EC
fseek, xrefs: 00007FF7E71D1500
fopen, xrefs: 00007FF7E71D1491
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7E71D1559
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7E71D15D5
fwrite, xrefs: 00007FF7E71D15DC
Failed to extract %s: failed to open target file!, xrefs: 00007FF7E71D148A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 26ede4a3923a4e78372fec4ec80fbe8fe42b310783ff2391cbf4041856c1e0b0
Instruction ID: cdaeefedfa9b761a2e21f8ca31252b219a467ab49f8fce6b2e44a0d0dd270d34
Opcode Fuzzy Hash: 26ede4a3923a4e78372fec4ec80fbe8fe42b310783ff2391cbf4041856c1e0b0
Instruction Fuzzy Hash: E851BC21A0874281EA14FB15F4847B9A360AF82BDAF854133DF3D07695EF7CE1479B22

Function 00007FF7E71D7810 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7E71D683A,?,00007FF7E71D672D), ref: 00007FF7E71D7850
OpenProcessToken.ADVAPI32(?,00007FF7E71D672D), ref: 00007FF7E71D7861
GetTokenInformation.KERNELBASE(?,00007FF7E71D672D(TokenIntegrityLevel)), ref: 00007FF7E71D7883
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E71D788D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF7E71D78CA
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E71D78DC
CloseHandle.KERNEL32(?,00007FF7E71D672D), ref: 00007FF7E71D78F4
LocalFree.KERNEL32(?,00007FF7E71D672D), ref: 00007FF7E71D7926
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7E71D794D
CreateDirectoryW.KERNELBASE(?,00007FF7E71D672D), ref: 00007FF7E71D795E

Strings

S-1-3-4, xrefs: 00007FF7E71D78FF
D:(A;;FA;;;%s), xrefs: 00007FF7E71D7909

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: af43192e558f9788d8e79a42a8209ba7990e18510bead9af3882adaa3d55134e
Instruction ID: b5d095b00c771bbee19d2cdf917c9846ece1ec2a9ab33eb35bf610effbae209a
Opcode Fuzzy Hash: af43192e558f9788d8e79a42a8209ba7990e18510bead9af3882adaa3d55134e
Instruction Fuzzy Hash: F641303161878282EB50EF20F4847AAB361FFC5755F844232EB6E46695DF3CE44ACB11

Function 00007FF7E71D6F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7E71D3A10), ref: 00007FF7E71D6F9F
GetStartupInfoW.KERNEL32 ref: 00007FF7E71D6FBE

Part of subcall function 00007FF7E71E90B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E90C8

Part of subcall function 00007FF7E71E6E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E6E8F

GetCommandLineW.KERNEL32 ref: 00007FF7E71D7046
CreateProcessW.KERNELBASE ref: 00007FF7E71D7088
WaitForSingleObject.KERNEL32 ref: 00007FF7E71D709C
GetExitCodeProcess.KERNEL32 ref: 00007FF7E71D70AC

Strings

CreateProcessW, xrefs: 00007FF7E71D70BF
Error creating child process!, xrefs: 00007FF7E71D70B8

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 5f16b07142fd6e9cf00bc922e8cc9db10b45bb18e926ceaba9689dfbd1de94f9
Instruction ID: ce3afdf37619e254afc703cfd383904a7f29e46ed2b5127edc6b0632e26ad5d2
Opcode Fuzzy Hash: 5f16b07142fd6e9cf00bc922e8cc9db10b45bb18e926ceaba9689dfbd1de94f9
Instruction Fuzzy Hash: B8413132A08B8282EA14EB64F4553AEF3A4FFD5350F900136E6AD43795DF7CD0568B51

Function 00007FF7E71D1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E71D3B80: GetModuleFileNameW.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D3BB1

SetDllDirectoryW.KERNEL32 ref: 00007FF7E71D3885

Part of subcall function 00007FF7E71D6970: GetEnvironmentVariableW.KERNEL32(00007FF7E71D36C7), ref: 00007FF7E71D69AA
Part of subcall function 00007FF7E71D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E71D69C7

Strings

Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7E71D376E
Failed to convert DLL search path!, xrefs: 00007FF7E71D386D
_PYI_ONEDIR_MODE, xrefs: 00007FF7E71D36DC, 00007FF7E71D3707
MEI, xrefs: 00007FF7E71D37C7
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7E71D380C
_MEIPASS2, xrefs: 00007FF7E71D36B3, 00007FF7E71D371C, 00007FF7E71D39CB, 00007FF7E71D39DB

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 2ad61965439258a95240d1e8b3d15387b0a9c5941bbb79d89789d074da181918
Instruction ID: 206b906c5899189a66096f3e8e6ebf7fbd47e3c84ff32ff8bb89dec1a31cfcb7
Opcode Fuzzy Hash: 2ad61965439258a95240d1e8b3d15387b0a9c5941bbb79d89789d074da181918
Instruction Fuzzy Hash: E4B1A261A1C78381EE64BB21F4913B99251AFC5786FC40133EB6D47696EE3CE5078B22

Function 00007FF7E71D1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7E71D111F
malloc, xrefs: 00007FF7E71D10F8, 00007FF7E71D1126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7E71D1249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7E71D10B4
1.2.12, xrefs: 00007FF7E71D107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7E71D10F1

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message
String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1282086711
Opcode ID: 22e1c2c43cf533ad3848f8f618e0f2e8e668a48f2b461afd16613f1cd81aac3a
Instruction ID: 99c2ee190ca1ebcfd6159c8ca57f0d2af22056bc9655f696f0aadcff51b7e92f
Opcode Fuzzy Hash: 22e1c2c43cf533ad3848f8f618e0f2e8e668a48f2b461afd16613f1cd81aac3a
Instruction Fuzzy Hash: A851A322A0878285EA20BB11F4803BAA290FBC5795F994137DF6D47785EF3CE546DB12

Function 00007FF7E71EAE5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EB289

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3dbd079f25493cb00c0f377b89eb06eb2a655696f53ab85c59b8783cdb1b2f43
Instruction ID: 7c0fcea998c95bcc6e8c71980a1e775690048219f2d545c4a73dc03c9f4198d2
Opcode Fuzzy Hash: 3dbd079f25493cb00c0f377b89eb06eb2a655696f53ab85c59b8783cdb1b2f43
Instruction Fuzzy Hash: 59C1D232A0C78743EA20AB15F4447BDA6A1EFD1BD0F950133EA6D83691CE7CE4478762

Function 00007FF7E71EC360 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E71EC34B), ref: 00007FF7E71EC47C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E71EC34B), ref: 00007FF7E71EC507

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: d1123a7759acd2de89f70fbc91131bac1b02d2ce66ed859b546e10adeb5b6b1d
Instruction ID: 68c114b65b4ee6bc7ccd891c4980870f6b2a71a687c7335b76591960bca0899a
Opcode Fuzzy Hash: d1123a7759acd2de89f70fbc91131bac1b02d2ce66ed859b546e10adeb5b6b1d
Instruction Fuzzy Hash: 2091B672B1875146F750AF25E84037DABA0FF84B88F945137DE2E92784DE38E4438722

Function 00007FF7E71EE80C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E71EE8FC
_get_daylight.LIBCMT ref: 00007FF7E71EE90D
_get_daylight.LIBCMT ref: 00007FF7E71EE91E
_isindst.LIBCMT ref: 00007FF7E71EE9E9

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1dd24f7105ff8e7d48a2fb442a16f04649d1343116b9e24a6dd38911d1b00d9f
Instruction ID: 5fc05e566292fec6398c92f45ac60231415cde74061cfcb4584ba4808c90fa42
Opcode Fuzzy Hash: 1dd24f7105ff8e7d48a2fb442a16f04649d1343116b9e24a6dd38911d1b00d9f
Instruction Fuzzy Hash: 6451C872F083124BFB24EB64E94577CA6A5FB84368F900236DE2D926E5DB38A447C711

Function 00007FF7E71E4704 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF7E71E4737
GetFileInformationByHandle.KERNELBASE ref: 00007FF7E71E4799
GetLastError.KERNEL32 ref: 00007FF7E71E482A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71E463C), ref: 00007FF7E71E4876

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 2c803cf069e940bc8ce2885be35e730a536e5e4cf13c1f700208f7e9b675e8ba
Instruction ID: 5cf8ecda696eed258353274d534eb0b4151dec9a5927f01e5923ab60152cbe32
Opcode Fuzzy Hash: 2c803cf069e940bc8ce2885be35e730a536e5e4cf13c1f700208f7e9b675e8ba
Instruction Fuzzy Hash: 4C518F22E147418BF714EFA1E4517BDB3A1EF88B58F944136EE1997644DF38D4438362

Function 00007FF7E71DAE3C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E71DAE4B

Part of subcall function 00007FF7E71DB2AC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E71DB2CE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E71DAE60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E71DAECE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7E71DAF21

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: fe3ada7a8cc56a4ed65094338cfa1a217e5e95ba653fb5ab557310939df0f8c4
Instruction ID: 3a94079f42b44c5e37c0f907344d0347de1146785a8db8883c9040ddad85c647
Opcode Fuzzy Hash: fe3ada7a8cc56a4ed65094338cfa1a217e5e95ba653fb5ab557310939df0f8c4
Instruction Fuzzy Hash: A5312921A0831246EA24FB64F4913B9A2919FC5785FC45437EB6E476D3DE3CA8078A37

Function 00007FF7E71E45B0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E45DD
CreateFileW.KERNELBASE ref: 00007FF7E71E461C
CloseHandle.KERNEL32 ref: 00007FF7E71E4651

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: e466375c137080442015770c21472d3ddd744ca47b074c7543c7a5c04326b230
Instruction ID: cc6822e53737935bfb1f01499ba5502ff25baf10b94d21ea895256e1dee01bc2
Opcode Fuzzy Hash: e466375c137080442015770c21472d3ddd744ca47b074c7543c7a5c04326b230
Instruction Fuzzy Hash: D941A362D1878283F714AB61E500369A360FFD97A4F509336FAAC43AD1DF7CA5E28711

Function 00007FF7E71DF2CC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF310
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF407

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4e38ebb67bc940453e85471c4fa41f8c71406493bfbb1ff44c5ef19ba65e7d48
Instruction ID: 9507722e682e0b319e909525771aefb334cb4e2e9927a2759eecda63a6097426
Opcode Fuzzy Hash: 4e38ebb67bc940453e85471c4fa41f8c71406493bfbb1ff44c5ef19ba65e7d48
Instruction Fuzzy Hash: FB51EA31A093D246E624AD25F44477AA194AFC0BA9F444736DF7D477C5CF3CE602CA22

Function 00007FF7E71EB534 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF7E71EB6CD), ref: 00007FF7E71EB580
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7E71EB6CD), ref: 00007FF7E71EB58A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9f733d69f420b8b04d1076dad759c709488f53e52c8dcc29dc1aedb5cdeb4cec
Instruction ID: 46c1e04058d50701c9ad7c362c6e005b3294e36773825313b97414da1f64b7e2
Opcode Fuzzy Hash: 9f733d69f420b8b04d1076dad759c709488f53e52c8dcc29dc1aedb5cdeb4cec
Instruction Fuzzy Hash: 3D11D061A18B9182DA20AB25F400269A361EF85BF0F940332EA7D477E8CE3CD4528B01

Function 00007FF7E71E48AC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71E47C1), ref: 00007FF7E71E48DF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71E47C1), ref: 00007FF7E71E48F5

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3187d087db2b214abcb8657b9371278066060ab850da1b3f30db97418e55af6d
Instruction ID: dddedb3e1509ce50a058ccb0ccd1edee32fccbcefcea2b7bea857b2855c37995
Opcode Fuzzy Hash: 3187d087db2b214abcb8657b9371278066060ab850da1b3f30db97418e55af6d
Instruction Fuzzy Hash: 74116D2260C74282EA54AB14F44123AE760FBC57B1F901237FAAE819D8EF3CD016CB21

Function 00007FF7E71E9D48 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 09d488bb06d55175f79f30023c2eae0eb1538c267421da5f785fc5d583374eac
Instruction ID: 56119317a455c2fe1c1e022f8dcf8951f691162e55a215541eb9e279d3ef3799
Opcode Fuzzy Hash: 09d488bb06d55175f79f30023c2eae0eb1538c267421da5f785fc5d583374eac
Instruction Fuzzy Hash: 33E04F10E0874243FA18BBF2F8482399160AFC5740B840032DD2D86252DE3CB8574372

Function 00007FF7E71E9F58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7E71E9DD5,?,?,00000000,00007FF7E71E9E8A), ref: 00007FF7E71E9FC6
GetLastError.KERNEL32(?,?,?,00007FF7E71E9DD5,?,?,00000000,00007FF7E71E9E8A), ref: 00007FF7E71E9FD0

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ac9e98b412a5961d7460aa12ad0ec3afb474dab09b1a01e5b31658786db65771
Instruction ID: bec4cec3538b53e1461a5cddee4749516f011bb1ba5ac6c23ad791d10f884809
Opcode Fuzzy Hash: ac9e98b412a5961d7460aa12ad0ec3afb474dab09b1a01e5b31658786db65771
Instruction Fuzzy Hash: F6215021B1874242EA54A765F4503BDAA92DFC5BA0FD84237EA3E872D5CE7CA4464323

Function 00007FF7E71EB2AC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EB2D4

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 59b3af13fe784cb7670022fdd077a90ad3e77dba11ba07e1d20d2cc9a011fd15
Instruction ID: fa9a120880d1a5fade98091988aeb2a786dedd8acb76e18fa97861124e2816c5
Opcode Fuzzy Hash: 59b3af13fe784cb7670022fdd077a90ad3e77dba11ba07e1d20d2cc9a011fd15
Instruction Fuzzy Hash: D3418F3290834687EA34AA19F54177DB3A4EB95B50F941133DAAAC3A91CB3CE543C762

Function 00007FF7E71D7170 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E71D721A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7dd6549e8be6f0a463f4e0f196cf2dfdddde6daaea8a0a7483063f7990cb7187
Instruction ID: aa372ba579bfbf195e0dad4dc972a9685b8e909c75db49dc4680288dba8941c9
Opcode Fuzzy Hash: 7dd6549e8be6f0a463f4e0f196cf2dfdddde6daaea8a0a7483063f7990cb7187
Instruction Fuzzy Hash: E9218121B0839245EE10AA12B5447BAE651FF85BD5FC84432EE2D07786DF3CE142CA12

Function 00007FF7E71EAD3C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EADC2

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7d59e4c40900bb32387b6d96138c4a28a58e0b2ab210e317c35ca26ebe7fd99a
Instruction ID: 8ca389d3df96210f2daf9b2d89078c39742ad84ccb91c932e7b90b08df09c8a4
Opcode Fuzzy Hash: 7d59e4c40900bb32387b6d96138c4a28a58e0b2ab210e317c35ca26ebe7fd99a
Instruction Fuzzy Hash: F6315D31A1875286E755BB15E841379AA50EBD4B91F850237EA79833D2CF7CE8438722

Function 00007FF7E71E53F8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E535D

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 7614eb8eef91d19fff95c87f540fdc87e2564c46a683ab03cb68c3d88fb09363
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: F1112131A1874182EA60FF51F80037DE2A0FBC5B84F884436FA9D97695CFBDD5429762

Function 00007FF7E71F568C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F56AF

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 517f1388def26b6ea6af1a1c77ba5c260dc8b33e60c43458f0534b05beae82e8
Instruction ID: 2edfabc7aea7aca3999b4d266a4e3cb37beb4b3dcd736f35b180bb0ece25a381
Opcode Fuzzy Hash: 517f1388def26b6ea6af1a1c77ba5c260dc8b33e60c43458f0534b05beae82e8
Instruction Fuzzy Hash: 0621A132A18B4187D765AF18E440369B6A0FFC4BA4FA44236E76D876D9DF3CD4128B11

Function 00007FF7E71DF54C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF5A0

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
Instruction ID: 075add938526e6add54a656cdde05b1e9268bb35aeeac88a2200b88d2e4590d1
Opcode Fuzzy Hash: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
Instruction Fuzzy Hash: 0A01A021A0878241EA04EF52F940269E6A5ABC5FE4F884632EE7C43BD6CF3CE2124711

Function 00007FF7E71EDC70 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7E71EA7E6,?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E), ref: 00007FF7E71EDCC5

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 706319e4b74843d5ad32e6c0b7fb19fe3c01a362d6ca9e09dab64425b174a517
Instruction ID: a71774cc7092e3c5e5a55056abe55e41e5bebd263204b92ca1ad5a8b30404855
Opcode Fuzzy Hash: 706319e4b74843d5ad32e6c0b7fb19fe3c01a362d6ca9e09dab64425b174a517
Instruction Fuzzy Hash: D9F0AF54B1930642FE54B651F9003B4C2909FC9BC0F8C6436CDAEC72C1DD7CE4924272

Function 00007FF7E71EC9FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7E71DFD74,?,?,?,00007FF7E71E1286,?,?,?,?,?,00007FF7E71E2879), ref: 00007FF7E71ECA3A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 489c3d0cd44d140bc65b640a77535ff6cb9a2f4134c0d54aac00f59d377539c0
Instruction ID: dd13959df38b1a1274d4bb379bb72e64ecf6abcac5866464946b3c716423bd6f
Opcode Fuzzy Hash: 489c3d0cd44d140bc65b640a77535ff6cb9a2f4134c0d54aac00f59d377539c0
Instruction Fuzzy Hash: D0F0FE54B0935646FE64BAA1FD51775D1909FC5FA0F884A32DD3EC52C2EE3CB4429232

Non-executed Functions

Function 00007FF7E71D3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3DE6
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E25
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E4A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E6F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E97
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3EBF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3EE7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3F0F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3F37

Strings

Failed to get address for Py_IncRef, xrefs: 00007FF7E71D4019
Failed to get address for Py_UTF8Mode, xrefs: 00007FF7E71D3F79
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7E71D3EA9
PyImport_ImportModule, xrefs: 00007FF7E71D4255
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7E71D3ED1
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7E71D45E1
PyRun_SimpleStringFlags, xrefs: 00007FF7E71D43E5
Py_Finalize, xrefs: 00007FF7E71D3FD5
Failed to get address for PyErr_Restore, xrefs: 00007FF7E71D41D1
PyObject_Str, xrefs: 00007FF7E71D43BD
PyUnicode_Replace, xrefs: 00007FF7E71D4665
Failed to get address for PySys_SetObject, xrefs: 00007FF7E71D44A1
PyList_Append, xrefs: 00007FF7E71D427D
PyList_New, xrefs: 00007FF7E71D42A5
PyErr_Print, xrefs: 00007FF7E71D4165
Py_SetProgramName, xrefs: 00007FF7E71D409D
PySys_SetArgvEx, xrefs: 00007FF7E71D4435
PySys_AddWarnOption, xrefs: 00007FF7E71D440D
Failed to get address for Py_Finalize, xrefs: 00007FF7E71D3FF1
Py_OptimizeFlag, xrefs: 00007FF7E71D3EDD
Py_SetPath, xrefs: 00007FF7E71D404D
Py_SetPythonHome, xrefs: 00007FF7E71D40C5
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7E71D4631
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7E71D4519
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7E71D4389
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7E71D4109
PyUnicode_FromFormat, xrefs: 00007FF7E71D459D
Failed to get address for PyMem_RawFree, xrefs: 00007FF7E71D4591
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7E71D41F9
Py_BuildValue, xrefs: 00007FF7E71D3F85
PyErr_Clear, xrefs: 00007FF7E71D4115
Failed to get address for Py_GetPath, xrefs: 00007FF7E71D4091
Failed to get address for PyUnicode_Join, xrefs: 00007FF7E71D4659
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7E71D4681
PyObject_CallFunctionObjArgs, xrefs: 00007FF7E71D4345
PyObject_SetAttrString, xrefs: 00007FF7E71D436D
PyMarshal_ReadObjectFromString, xrefs: 00007FF7E71D44FD
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7E71D4541
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7E71D3E37
Failed to get address for Py_Initialize, xrefs: 00007FF7E71D4041
PyUnicode_FromString, xrefs: 00007FF7E71D4525
Failed to get address for Py_BuildValue, xrefs: 00007FF7E71D3FA1
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7E71D3EF9
Py_UnbufferedStdioFlag, xrefs: 00007FF7E71D3F2D
Py_NoSiteFlag, xrefs: 00007FF7E71D3E8D
Failed to get address for Py_SetPath, xrefs: 00007FF7E71D4069
Failed to get address for PyObject_Str, xrefs: 00007FF7E71D43D9
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7E71D45B9
PySys_GetObject, xrefs: 00007FF7E71D445D
PyEval_EvalCode, xrefs: 00007FF7E71D44D5
PyErr_Fetch, xrefs: 00007FF7E71D418D
PyErr_NormalizeException, xrefs: 00007FF7E71D41DD
PyUnicode_Decode, xrefs: 00007FF7E71D45C5
PyErr_Occurred, xrefs: 00007FF7E71D413D
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7E71D44F1
Failed to get address for PySys_GetObject, xrefs: 00007FF7E71D4479
Failed to get address for PyList_Append, xrefs: 00007FF7E71D4299
PyImport_ExecCodeModule, xrefs: 00007FF7E71D422D
Failed to get address for Py_DecRef, xrefs: 00007FF7E71D3FC9
Failed to get address for PyModule_GetDict, xrefs: 00007FF7E71D4311
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7E71D3F21
Py_DontWriteBytecodeFlag, xrefs: 00007FF7E71D3DDF
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7E71D4361
Failed to get address for PyErr_Fetch, xrefs: 00007FF7E71D41A9
Py_IncRef, xrefs: 00007FF7E71D3FFD
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7E71D3DF8
Failed to get address for PyList_New, xrefs: 00007FF7E71D42C1
Failed to get address for PyImport_AddModule, xrefs: 00007FF7E71D4221
PyUnicode_DecodeFSDefault, xrefs: 00007FF7E71D45ED
Py_NoUserSiteDirectory, xrefs: 00007FF7E71D3EB5
PySys_SetPath, xrefs: 00007FF7E71D44AD
Py_FrozenFlag, xrefs: 00007FF7E71D3E40
PyUnicode_AsUTF8, xrefs: 00007FF7E71D4615
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7E71D4429
Failed to get address for PyErr_Occurred, xrefs: 00007FF7E71D4159
Py_DecodeLocale, xrefs: 00007FF7E71D454D
Py_UTF8Mode, xrefs: 00007FF7E71D3F5D
PySys_SetObject, xrefs: 00007FF7E71D4485
Py_GetPath, xrefs: 00007FF7E71D4075
PyUnicode_Join, xrefs: 00007FF7E71D463D
PyObject_GetAttrString, xrefs: 00007FF7E71D4395
Py_DecRef, xrefs: 00007FF7E71D3FAD
Py_Initialize, xrefs: 00007FF7E71D4025
Failed to get address for PySys_SetPath, xrefs: 00007FF7E71D44C9
Failed to get address for PyErr_Print, xrefs: 00007FF7E71D4181
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7E71D4609
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7E71D4271
Failed to get address for PyErr_Clear, xrefs: 00007FF7E71D4131
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7E71D40E1
PyLong_AsLong, xrefs: 00007FF7E71D42CD
Failed to get address for Py_SetProgramName, xrefs: 00007FF7E71D40B9
PyImport_AddModule, xrefs: 00007FF7E71D4205
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7E71D4249
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7E71D4401
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7E71D4339
Py_FileSystemDefaultEncoding, xrefs: 00007FF7E71D3E1B
Failed to get address for PyLong_AsLong, xrefs: 00007FF7E71D42E9
PyModule_GetDict, xrefs: 00007FF7E71D42F5
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7E71D3F49
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7E71D3E81
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7E71D43B1
PyObject_CallFunction, xrefs: 00007FF7E71D431D
PyMem_RawFree, xrefs: 00007FF7E71D4575
PyDict_GetItemString, xrefs: 00007FF7E71D40ED
GetProcAddress, xrefs: 00007FF7E71D3DFF
Py_VerboseFlag, xrefs: 00007FF7E71D3F05
PyErr_Restore, xrefs: 00007FF7E71D41B5
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7E71D3E5C
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7E71D4569
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7E71D3E65
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7E71D4451

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
Instruction ID: df834e17569ee106f6798792afafe4d72a3a9553cfdd4f5c3a2d3814bb851c56
Opcode Fuzzy Hash: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
Instruction Fuzzy Hash: C142E975A0AF0391EA19FB24F890374A3B5AF85785BD45033CA2E06264EF7CF517C626

Function 00007FF7E71D1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF7E71D1BDE
MulDiv.KERNEL32 ref: 00007FF7E71D1BF2
MulDiv.KERNEL32 ref: 00007FF7E71D1C13
SystemParametersInfoW.USER32 ref: 00007FF7E71D1C5B
CreateFontIndirectW.GDI32 ref: 00007FF7E71D1C6F
#380.COMCTL32 ref: 00007FF7E71D1C93
CreateWindowExW.USER32 ref: 00007FF7E71D1CE6
CreateWindowExW.USER32 ref: 00007FF7E71D1D40
CreateWindowExW.USER32 ref: 00007FF7E71D1D9D
CreateWindowExW.USER32 ref: 00007FF7E71D1DFF
SendMessageW.USER32 ref: 00007FF7E71D1E1F
SendMessageW.USER32 ref: 00007FF7E71D1E39
SendMessageW.USER32 ref: 00007FF7E71D1E58
SendMessageW.USER32 ref: 00007FF7E71D1E77
SendMessageW.USER32 ref: 00007FF7E71D1E95
SendMessageW.USER32 ref: 00007FF7E71D1EB3
SendMessageW.USER32 ref: 00007FF7E71D1ED1
SendMessageW.USER32 ref: 00007FF7E71D1EE9
SendMessageW.USER32 ref: 00007FF7E71D1F01
GetClientRect.USER32 ref: 00007FF7E71D1F10

Part of subcall function 00007FF7E71D2030: GetDC.USER32 ref: 00007FF7E71D205B
Part of subcall function 00007FF7E71D2030: SelectObject.GDI32 ref: 00007FF7E71D20A2
Part of subcall function 00007FF7E71D2030: DrawTextW.USER32 ref: 00007FF7E71D20C5
Part of subcall function 00007FF7E71D2030: SelectObject.GDI32 ref: 00007FF7E71D20DB
Part of subcall function 00007FF7E71D2030: ReleaseDC.USER32 ref: 00007FF7E71D20EB
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D213B
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D217B
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D21CE

Strings

Close, xrefs: 00007FF7E71D1DA8
BUTTON, xrefs: 00007FF7E71D1DB6
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF7E71D1BBD
EDIT, xrefs: 00007FF7E71D1D4B
STATIC, xrefs: 00007FF7E71D1C9C, 00007FF7E71D1CF1

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 051afb74dd6d8b2a6ec501d8fa5556287ab5d0c90ea366ccf65a0a970d90b360
Instruction ID: 1d1a0cb43f91ef0e24f396f09ca13e3c6bed1fb45583a57d15057b8df10c25bc
Opcode Fuzzy Hash: 051afb74dd6d8b2a6ec501d8fa5556287ab5d0c90ea366ccf65a0a970d90b360
Instruction Fuzzy Hash: 8CA15A36218B8187E718DF21F59479AB360FB89B84F944126DB9D03B24CF7DE166CB50

Function 00007FF7E71F30FC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7E71F314A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F37B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F392C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F3BEA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F3E0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F4047
memcpy_s.LIBCPMT ref: 00007FF7E71F4122
memcpy_s.LIBCPMT ref: 00007FF7E71F41CD
memcpy_s.LIBCPMT ref: 00007FF7E71F429C

Strings

1#INF, xrefs: 00007FF7E71F3273
1#SNAN, xrefs: 00007FF7E71F325A
1#IND, xrefs: 00007FF7E71F3237
1#QNAN, xrefs: 00007FF7E71F3263

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 3af33b1c53459be822e3926673cf8556ce12eec6cba7b9f0bf56be9fb2bd3e29
Instruction ID: c3d2184ca58f3a9d1b273af9af287d3012baf7a66f7dad7f2289f9adecc984e0
Opcode Fuzzy Hash: 3af33b1c53459be822e3926673cf8556ce12eec6cba7b9f0bf56be9fb2bd3e29
Instruction Fuzzy Hash: 06B2F672A183928BE739DF64E4407FDB7A1FF94384F801136DB2957A84DB38A912CB51

Function 00007FF7E71D7420 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7447
FormatMessageW.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7476
WideCharToMultiByte.KERNEL32 ref: 00007FF7E71D74CC

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D74D6
WideCharToMultiByte, xrefs: 00007FF7E71D74DD
FormatMessageW, xrefs: 00007FF7E71D7487
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7E71D74E9
No error messages generated., xrefs: 00007FF7E71D7480
PyInstaller: FormatMessageW failed., xrefs: 00007FF7E71D7493

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 1ca30c699dbe1e4654e7c4d5696967e2b1b1a4f4c1085b5d0a2cfb7980eebcbf
Instruction ID: 50e6ff9aacf314b3e3bb16fee1a54029d1b3e6f875f7840070163eba1aeb2ac1
Opcode Fuzzy Hash: 1ca30c699dbe1e4654e7c4d5696967e2b1b1a4f4c1085b5d0a2cfb7980eebcbf
Instruction Fuzzy Hash: 3F21623160CB4281E664EF14F89436AE665BFC8345FC40037D76D826A5EF3CD1168B22

Function 00007FF7E71DB5DC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E71DB5F8
RtlCaptureContext.KERNEL32 ref: 00007FF7E71DB625
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E71DB63F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E71DB680
IsDebuggerPresent.KERNEL32 ref: 00007FF7E71DB6D4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71DB6F5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71DB700

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: fbdfe3cbec041ac85cd1f64ea4b15fcfe09a87be1aa09ac25d8a719fe1a921a3
Instruction ID: 6a170e19de84a04a5a7dd6c2fe6ecb5076a1c8cadb1c545ce46a6b5e4f70cd84
Opcode Fuzzy Hash: fbdfe3cbec041ac85cd1f64ea4b15fcfe09a87be1aa09ac25d8a719fe1a921a3
Instruction Fuzzy Hash: AF314D72608B8186EB64AF60F8803EDA364FB84744F84403ADB5E47A98DF3CD549CB21

Function 00007FF7E71E9A14 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E71E9A8D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E71E9AA5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E71E9AE0
IsDebuggerPresent.KERNEL32 ref: 00007FF7E71E9B19
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71E9B23
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71E9B2E

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e7141d2691e6fffc336151182819a094942dc067ac16da689744b042d81b35af
Instruction ID: 689917fe3688b6449a1ec3cd6be401314186454e50c72f5225b140fe20e322a4
Opcode Fuzzy Hash: e7141d2691e6fffc336151182819a094942dc067ac16da689744b042d81b35af
Instruction Fuzzy Hash: EF316D32618F8186DB20DB25E8803AAB3A4FBC9754F940136EBAD43B54DF3CD5568B11

Function 00007FF7E71F08E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F0930
FindFirstFileExW.KERNEL32 ref: 00007FF7E71F0A3A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: f73aa23eabfd20fda03901ff7faf855d9e478a94a0c2f1e1aa16d97b926a899c
Instruction ID: bda1bf0fb724d825237d6aa0043c1f567a7420a176fceb148ac7a232d2f75ef6
Opcode Fuzzy Hash: f73aa23eabfd20fda03901ff7faf855d9e478a94a0c2f1e1aa16d97b926a899c
Instruction Fuzzy Hash: 4AB1B226B1979241EA65AB21F4103B9E250FF84BD4F844137EF6E47A85DE3CE552C322

Function 00007FF7E71F2C60 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7E71F2CC6
memcpy_s.LIBCPMT ref: 00007FF7E71F2CF1

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 7ce8bdae114a4d1dcec361bfadaa5a88f902727c3215c81cfc9477547331ade6
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 0AC1D172B1878687E728DF19F04476EB791FB88B84F848136DB6A43744DA3DE852CB41

Function 00007FF7E71F8A98 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7E71F8CE7
RaiseException.KERNEL32 ref: 00007FF7E71F8CF8

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 90f8d2508151a2821edd8705c6830792bf37d4c2f418efb34635905aa3d93be8
Instruction ID: 74f0de4de8902b857353b526d41009256d2970d83e420d61a8f37399e755b1d6
Opcode Fuzzy Hash: 90f8d2508151a2821edd8705c6830792bf37d4c2f418efb34635905aa3d93be8
Instruction Fuzzy Hash: DCB18073610B898BEB19DF29D44636C7BE0FB84B48F548922DB6D837A4CB39D462C711

Function 00007FF7E71D7790 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7E71D77C1
FindClose.KERNEL32 ref: 00007FF7E71D77D0

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d7ae6b57d221e0bba94e95162e8d18faf84dbf886ae199d20af9c81c2035df64
Instruction ID: 3749f8084d51fd6d4e8adffe9ace1e571f3e85891ec870a9c851b9cff4b800e1
Opcode Fuzzy Hash: d7ae6b57d221e0bba94e95162e8d18faf84dbf886ae199d20af9c81c2035df64
Instruction Fuzzy Hash: E3F03122A1978286E7A0DF64F489766B360FB84729F844636D67D026D4DF3CD01A8A11

Function 00007FF7E71E2B34 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E71E2EE4
, xrefs: 00007FF7E71E2CA2

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: a020c1348df748786c6fc3e6f0d32bf571f59c10c0dece7ade91a17eca74ce91
Instruction ID: f78f865893c8ffc303c518ebaa73b496bc56f9af8bcfcdfbbb533d65d4fbdac4
Opcode Fuzzy Hash: a020c1348df748786c6fc3e6f0d32bf571f59c10c0dece7ade91a17eca74ce91
Instruction Fuzzy Hash: CBE1B932918B4683D768AE25E060239B3A0FF85B54F944137DA6E87794DF39E883C753

Function 00007FF7E71ECFC8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF7E71ED0D5
gfff, xrefs: 00007FF7E71ED152

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 5a7a9f69d7c0008c7cda2ee947bdc0d9f87d51e3163b40c536a3f3ccbb6c484c
Instruction ID: 0eaa55d35fe7a3651bf4267bfc91101c54089567d17b8c7cd93fea2d723c7445
Opcode Fuzzy Hash: 5a7a9f69d7c0008c7cda2ee947bdc0d9f87d51e3163b40c536a3f3ccbb6c484c
Instruction Fuzzy Hash: DA515872B183D547E7249B35E80176DE791E784B94F88A232CBB887AC5CF3DD4468712

Function 00007FF7E71EF938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: d9c3fe3541d8cc50b57763fefdf599488ea3422849496e59e15aa9730f7a25ee
Instruction ID: f2dd454f22d60c91614cf617baa1652c2cc57777ca81b4a4f08a86c72124bba9
Opcode Fuzzy Hash: d9c3fe3541d8cc50b57763fefdf599488ea3422849496e59e15aa9730f7a25ee
Instruction Fuzzy Hash: 1F029121A2979242EA95BB11F4043B9A698EF81B90FC44537ED7D8A3D1DF3CE4438323

Function 00007FF7E71ECB34 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7E71ECE76

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: cf9e926bd06e6296f4aba0f07622bacccd0840f3ce88d9759f2d176c501fd3f5
Instruction ID: 962dcf09b3d643bbf9898f225134eeda0ee62fbe6ad0461faa268bbf7fd07ff1
Opcode Fuzzy Hash: cf9e926bd06e6296f4aba0f07622bacccd0840f3ce88d9759f2d176c501fd3f5
Instruction Fuzzy Hash: CCA14863A187C547EB21DF29E8107A9BB91EB907C4F448132DEAD87785DA3DE502C712

Function 00007FF7E71E6EC8 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7E71E6EE7

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: ec640adac2f88b1d3391d3d7222849678fbd48a7668bf7398b1338a4f0517d20
Instruction ID: 3193839224de7a23e591e91662c2b0bcb8d78cf6986202538efc2bd3d63dbf25
Opcode Fuzzy Hash: ec640adac2f88b1d3391d3d7222849678fbd48a7668bf7398b1338a4f0517d20
Instruction Fuzzy Hash: F751B621B0871242FA58B726F9117BAE291EFC5BC4FC84436DE2D87796DE3CE4134222

Function 00007FF7E71F24D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E71F24D4

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9f41e9cda47aae22f82be4ce0ab7cd412b3cc0fc70eb2a248d538cdb5c6fb34a
Instruction ID: 6051da9bd5aff26dd01eb5fe72ff95593d28e7e44648a523080dc9236910a2de
Opcode Fuzzy Hash: 9f41e9cda47aae22f82be4ce0ab7cd412b3cc0fc70eb2a248d538cdb5c6fb34a
Instruction Fuzzy Hash: B3B09224E0BB06C3EA08BB11AC8231463B87F88700FD9007AC56C41320DF3C24B6A722

Function 00007FF7E71E2730 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d7714d5ca7358c377d8bb445432fedb4a83b36a583ecf09d0c06c9540aab40
Instruction ID: 3a0e4c99368c7df7aaf101cbe954a5be1a8084c4b5abdbee5dd5322b2ceff50b
Opcode Fuzzy Hash: 45d7714d5ca7358c377d8bb445432fedb4a83b36a583ecf09d0c06c9540aab40
Instruction Fuzzy Hash: FCD1C722E08B4247E768AA25E46073DA3A0FB85B58F945136CE2DC7694DF3DD843C363

Function 00007FF7E71D9CC0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b086e8f388e79d9875e8562cc3e7603ffd3c462abec3081be3315d6d619fb4b
Instruction ID: aa009d1ce4446c02a4bf2ba0dd280aa719fed0491c721f7ae60666d873bc17f5
Opcode Fuzzy Hash: 0b086e8f388e79d9875e8562cc3e7603ffd3c462abec3081be3315d6d619fb4b
Instruction Fuzzy Hash: 46C119721181E04BD289EB29E45A97A73D0F7C830AFD4442BEB9B67B85C63CE514DB21

Function 00007FF7E71E1DA0 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a137f81fa1c86087b3fd9088994328934f22d67f6cc1e45e2630c66c22d56c
Instruction ID: a58782060e5c35575d8f31dd95fcefa2223ffec8bd895100a1d6a3291f323272
Opcode Fuzzy Hash: 77a137f81fa1c86087b3fd9088994328934f22d67f6cc1e45e2630c66c22d56c
Instruction Fuzzy Hash: 72B16E72A08B8586E765AF39E05023CBBA0F785B48FA40136DB5D87395CF39D442D763

Function 00007FF7E71ED648 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d476ef08b322c58c4413e10f71b0ed5290530b08392bb97c7a41ba5f57d2c99
Instruction ID: 72e71467fbea611eb7b8b727aa8c49995738dd90447c4677c135bf955e578828
Opcode Fuzzy Hash: 3d476ef08b322c58c4413e10f71b0ed5290530b08392bb97c7a41ba5f57d2c99
Instruction Fuzzy Hash: DA81F572A0878187EB74DB19F44137AA690FBC9794F845236DAED87B85CF3CD4018B12

Function 00007FF7E71F5750 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1095f843d98438b20cb337fae70872a3e7dc8e72d94470ea3cbe73f8aa7f40ad
Instruction ID: a1db5332457f00f03dea9453f5787c8b10bcab2b5c83141271a19c77a3f5cca5
Opcode Fuzzy Hash: 1095f843d98438b20cb337fae70872a3e7dc8e72d94470ea3cbe73f8aa7f40ad
Instruction Fuzzy Hash: B3610822E1875242FB2CA929E445339E681BFC0770FD4023BD77D866D1DE3CE8129722

Function 00007FF7E71E0EE4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: 8248c0f7b1e5a493101586b3e27fa67187c972af485000f596dc0309fd3902c2
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: 1D51B636A18B5187E7649B29E080338B3A0EB94F58F744136DE5C87795CB3AE853C792

Function 00007FF7E71E0AD4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: 1e71e5037091552256c88e78aefeeb60d7bd754bc329150de9114305a4331599
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: C4519536A2875183E7249B29F04032873A0FB95B6CF744136CE9D87795CB3AE983C751

Function 00007FF7E71E12F4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: 75315bc339704efb4bc26169b61a4df4173e5881f03c4f554b8cd27819c62340
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: 0C51A676A1875183E7249B29E04033CB3A1EBC5F68F644132CE6D87B94DB3AE843D752

Function 00007FF7E71E08D0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: 011339ba88183f058a771e0a76db2ec91a7d6e61b365107838f9fa4df2a8bbce
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: 50519036A18B5186E7249F29F040328B7A0EBC5F58FB44136CA5D97798CB3AE843C761

Function 00007FF7E71E10F0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: d215e46b5477d5228ea5f4ab5fece96c87796e16015c06a2e629acde5da3512d
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: 4551B036A18752C7E7249B29E44033CB7A1EB85F58FA84132CE5C97794CB3AE843D752

Function 00007FF7E71E0CE0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: 3e8d417fd49f72ea2cd5bb0881d1fb8ef8b31c8dc42e06d07d0013f46510df55
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: 5D518436A1875587E7249B29F040338B7A0EB84F58FB44136CE5D97798CB3AE843C751

Function 00007FF7E71E4E80 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: cad44f5ed68e2f1abb25802f5c577b47c34db094c743e0c8d1a5458e937b61f9
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 0341ED72C0974A47F995991C9900774A6C0DFE2BA0ED412B2FEBA933C3EC3C65879123

Function 00007FF7E71E8AD0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 78dcf682790de8efd8091c6720d965e488dfd40db2a2618002f9ee551094d6b6
Instruction ID: 2f238f937705afc9f962f18c730eb199805eca6a92a0b3b0cfea633da1e91181
Opcode Fuzzy Hash: 78dcf682790de8efd8091c6720d965e488dfd40db2a2618002f9ee551094d6b6
Instruction Fuzzy Hash: B141E262715B5482EF04DF2AE9542A9A3A5FB88FC4F89A033DE2D87B54DE3CD0428301

Function 00007FF7E71E6490 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction ID: b24673a814da7e47fd8a8dad66cf5596350c0bca58d19bddfc6d32e6fa4cf95e
Opcode Fuzzy Hash: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction Fuzzy Hash: E2319631708B8243E714AB25B44026EA595EFC5BE0F94423AFA6D93BD9DF3CD4138715

Function 00007FF7E71F88E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc313cde0fef028e89f201561a38ee75bc55530e34bae0ee9c1053def84ead7
Instruction ID: 02ebb9ce954a5bb3d17f1f49a2c06275e6b77a60ef4d72b2bfe2247ece9a33c2
Opcode Fuzzy Hash: 5cc313cde0fef028e89f201561a38ee75bc55530e34bae0ee9c1053def84ead7
Instruction Fuzzy Hash: D2F068717182958BDBB4AF2DE802729B7E4F748380F80803ED6DD83B04D63C90618F15

Function 00007FF7E71DB7C0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c002e7d7884e8c4061cd0b6b52ae5efdc83914f73eae79fef453be1d5e57078
Instruction ID: 34a0e0a8272977b22c21c701e1d525471c8ff1c796662d108f769d47b27fd242
Opcode Fuzzy Hash: 6c002e7d7884e8c4061cd0b6b52ae5efdc83914f73eae79fef453be1d5e57078
Instruction Fuzzy Hash: 57A0012294CE06D1E658AB08F8A0220A220FB91381BC51036D22E414A0DE3CA5128622

Function 00007FF7E71D55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D7120: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D7143

GetProcAddress.KERNEL32 ref: 00007FF7E71D5F47
GetProcAddress.KERNEL32 ref: 00007FF7E71D5F86
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FAB
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FD0
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FF8
GetProcAddress.KERNEL32 ref: 00007FF7E71D6020
GetProcAddress.KERNEL32 ref: 00007FF7E71D6048
GetProcAddress.KERNEL32 ref: 00007FF7E71D6070
GetProcAddress.KERNEL32 ref: 00007FF7E71D6098

Strings

Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7E71D637A
Tcl_SetVar2Ex, xrefs: 00007FF7E71D62BE
Tcl_ThreadAlert, xrefs: 00007FF7E71D61A6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7E71D6352
Tcl_ThreadQueueEvent, xrefs: 00007FF7E71D617E
Failed to get address for Tcl_GetString, xrefs: 00007FF7E71D6262
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7E71D6302
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF7E71D55FA
Tcl_DoOneEvent, xrefs: 00007FF7E71D5FC6
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7E71D62DA
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7E71D62B2
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7E71D623A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7E71D619A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7E71D6082
Tcl_SetVar2, xrefs: 00007FF7E71D61F6
Tcl_ConditionFinalize, xrefs: 00007FF7E71D6106
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7E71D5F98
Tcl_EvalEx, xrefs: 00007FF7E71D6336
Tcl_CreateThread, xrefs: 00007FF7E71D6066
Tcl_EvalFile, xrefs: 00007FF7E71D630E
Failed to get address for Tk_Init, xrefs: 00007FF7E71D63F2
Tk_GetNumMainWindows, xrefs: 00007FF7E71D63FE
Failed to get address for Tcl_Finalize, xrefs: 00007FF7E71D600A
Tcl_CreateInterp, xrefs: 00007FF7E71D5F7C
Tk_Init, xrefs: 00007FF7E71D63D6
Tcl_FinalizeThread, xrefs: 00007FF7E71D6016
Tcl_CreateObjCommand, xrefs: 00007FF7E71D621E
Tcl_MutexUnlock, xrefs: 00007FF7E71D60DE
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7E71D6212
Failed to get address for Tcl_Free, xrefs: 00007FF7E71D63CA
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7E71D60D2
Tcl_GetVar2, xrefs: 00007FF7E71D61CE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7E71D632A
Tcl_MutexLock, xrefs: 00007FF7E71D60B6
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7E71D60FA
Tcl_EvalObjv, xrefs: 00007FF7E71D635E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7E71D6032
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7E71D60AA
Tcl_Alloc, xrefs: 00007FF7E71D6386
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7E71D614A
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7E71D641A
Failed to get address for Tcl_Alloc, xrefs: 00007FF7E71D63A2
Tcl_NewByteArrayObj, xrefs: 00007FF7E71D6296
Tcl_FindExecutable, xrefs: 00007FF7E71D5FA1
Failed to get address for Tcl_Init, xrefs: 00007FF7E71D5F59
Tcl_GetObjResult, xrefs: 00007FF7E71D62E6
Tcl_Init, xrefs: 00007FF7E71D5F40
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7E71D5FE2
Tcl_GetString, xrefs: 00007FF7E71D6246
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7E71D628A
Tcl_ConditionWait, xrefs: 00007FF7E71D6156
Tcl_GetCurrentThread, xrefs: 00007FF7E71D608E
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7E71D6172
Tcl_ConditionNotify, xrefs: 00007FF7E71D612E
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7E71D61EA
Tcl_NewStringObj, xrefs: 00007FF7E71D626E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7E71D61C2
Tcl_Free, xrefs: 00007FF7E71D63AE
GetProcAddress, xrefs: 00007FF7E71D5F60
Tcl_DeleteInterp, xrefs: 00007FF7E71D603E
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7E71D605A
Tcl_Finalize, xrefs: 00007FF7E71D5FEE
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7E71D5FBD
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7E71D6122

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
Instruction ID: a6a6f7c2f1052388bc12e8ac0ec233fdad21ad056fb5a60da5f625dbbcc32115
Opcode Fuzzy Hash: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
Instruction Fuzzy Hash: 16E1BB64A09B0390EA19FF14F890374E3B5BF85781BD85037D62D06258EF7CA566E732

Function 00007FF7E71D2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E71D205B
SelectObject.GDI32 ref: 00007FF7E71D20A2
DrawTextW.USER32 ref: 00007FF7E71D20C5
SelectObject.GDI32 ref: 00007FF7E71D20DB
ReleaseDC.USER32 ref: 00007FF7E71D20EB
MoveWindow.USER32 ref: 00007FF7E71D213B
MoveWindow.USER32 ref: 00007FF7E71D217B
MoveWindow.USER32 ref: 00007FF7E71D21CE
MoveWindow.USER32 ref: 00007FF7E71D2216

Strings

P%, xrefs: 00007FF7E71D20AF

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: f5a3bd79b12c7c571d23b6b5ebdfb181c7e65479c9c05912b09222cce72f5b00
Instruction ID: 6d9390407a4113db7ae316737b7813eef607f3b35c3ebf1f5d29cdc32ef4c1df
Opcode Fuzzy Hash: f5a3bd79b12c7c571d23b6b5ebdfb181c7e65479c9c05912b09222cce72f5b00
Instruction Fuzzy Hash: 7D5108266047A186D628AF26F4582BAF7A1FB98B61F044122EBDF43684DF3CD046DB10

Function 00007FF7E71E0158 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E0198
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E0560
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E07FF

Strings

f, xrefs: 00007FF7E71E03E5
f, xrefs: 00007FF7E71E029A
p, xrefs: 00007FF7E71E02A2
f, xrefs: 00007FF7E71E0230
p, xrefs: 00007FF7E71E023D

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 96c756b5a3e0b0bef854b95385ee20e4488c726cb2be084469cde4e9576dd0bf
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 53126571E0C24387FB24BA14F1547B9E6A1EBC0754FE4403BD6E9866C4DB7CE5828B62

Function 00007FF7E71D12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E71D1312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E71D12E2
malloc, xrefs: 00007FF7E71D1353
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E71D134C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E71D13E2
fread, xrefs: 00007FF7E71D13E9
fseek, xrefs: 00007FF7E71D1319

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: a4535b3149898708a8536aacd51805d4cd497b3deda664be73552712e11ba28b
Instruction ID: eca12d9aa26068d544d76436a529178d321094646e9c759a61895fbc2ec8e82a
Opcode Fuzzy Hash: a4535b3149898708a8536aacd51805d4cd497b3deda664be73552712e11ba28b
Instruction Fuzzy Hash: 0E418C22A0874281EA14FB16F4803AAE3A0EF84795F854433DF6D03A45EF7CE5439B22

Function 00007FF7E71DDB70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E71DDBCD

Part of subcall function 00007FF7E71DEAD0: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E71DEB13
Part of subcall function 00007FF7E71DEAD0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E71DEB38

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E71DDCA5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E71DDEFA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E71DE006

Strings

csm, xrefs: 00007FF7E71DDC4E
csm, xrefs: 00007FF7E71DDCC8
csm, xrefs: 00007FF7E71DDBE7

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 905927d9e3da027d40e91907a7f1dd58b6d09944997845db9437df3d999e9f33
Instruction ID: 713e6248c0ecfd966b2f92868e7acb6914b167638dd30f27ebe2a9a3f232615d
Opcode Fuzzy Hash: 905927d9e3da027d40e91907a7f1dd58b6d09944997845db9437df3d999e9f33
Instruction Fuzzy Hash: 51E18572A087428AEB20AF65E4803ADB7A0FB85799F400537DF9D57B55CF38E442CB52

Function 00007FF7E71EDCE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF7E71EE082,?,?,000001AA02346A18,00007FF7E71EA153,?,?,?,00007FF7E71EA04A,?,?,?,00007FF7E71E53A2), ref: 00007FF7E71EDE64
GetProcAddress.KERNEL32(?,00000000,?,00007FF7E71EE082,?,?,000001AA02346A18,00007FF7E71EA153,?,?,?,00007FF7E71EA04A,?,?,?,00007FF7E71E53A2), ref: 00007FF7E71EDE70

Strings

api-ms-, xrefs: 00007FF7E71EDDAE
ext-ms-, xrefs: 00007FF7E71EDDC1

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 3f9ea5ddd66982662272f3b60427da02763780b89cc10366f1f57cf1354b879c
Instruction ID: 100252fd72319c2d09cb58a25e04e957f7e378fbed65c7fdda360ac2aefbe4c2
Opcode Fuzzy Hash: 3f9ea5ddd66982662272f3b60427da02763780b89cc10366f1f57cf1354b879c
Instruction Fuzzy Hash: 66411561B19B0242FA19EB16F804775A395FF85B90F886136DD6D97784DE3CE4078322

Function 00007FF7E71D7570 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D760F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D765F

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF7E71D76A1
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D7688
Out of memory., xrefs: 00007FF7E71D7691
WideCharToMultiByte, xrefs: 00007FF7E71D76A8
win32_utils_to_utf8, xrefs: 00007FF7E71D7698

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 4c75aad5540be6d6cf442b20722a3a637b86b79be2c0eb90bd337d9e394b857c
Instruction ID: 4aab514cde0e967852d60a72bdd8a14dc72df504e4199cf27e6a52de262b073a
Opcode Fuzzy Hash: 4c75aad5540be6d6cf442b20722a3a637b86b79be2c0eb90bd337d9e394b857c
Instruction Fuzzy Hash: 5641A232A08B8282E624EF55F48026AE764FBC4790F984136DBAD47B94EF3CD063D711

Function 00007FF7E71D7AB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D7AF1

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

WideCharToMultiByte.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D7B65

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF7E71D7AFE
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D7B6F
Out of memory., xrefs: 00007FF7E71D7B2B
WideCharToMultiByte, xrefs: 00007FF7E71D7B05, 00007FF7E71D7B76
win32_utils_to_utf8, xrefs: 00007FF7E71D7B32

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 92b52a23bf177b804bd471eb00781d9ecb554dad94de0916a037b448ee798d7d
Instruction ID: d81bcbf32050d9b801744e2b7cb9527cadd10143e343d2308dea5af5a4d8786a
Opcode Fuzzy Hash: 92b52a23bf177b804bd471eb00781d9ecb554dad94de0916a037b448ee798d7d
Instruction Fuzzy Hash: 43219C21A08B4285EA14EF22F880279FB61AFD4B90B884136CB2D43795EF7CE5169712

Function 00007FF7E71E9194 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E91D7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E95C4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E9860

Strings

p, xrefs: 00007FF7E71E9301
f, xrefs: 00007FF7E71E92F9
p, xrefs: 00007FF7E71E9289

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: d667d1d2ee45fe2bab7a4adfb1054cdcdffa8b75a8591027b87a6e9f1006e6e3
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 7B127161E0C34347FB24BA15F0547B9B6A2EBC0754FD44137E6AA866C4DB3CE5868B23

Function 00007FF7E71D7BA0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7C35
MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7C77

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF7E71D7CB6
MultiByteToWideChar, xrefs: 00007FF7E71D7CBD
Out of memory., xrefs: 00007FF7E71D7CA6
win32_utils_from_utf8, xrefs: 00007FF7E71D7CAD
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7E71D7C9D

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 0d5216bbebe1e4d5e4fda212484cc9b67e4195dbf35dd583a6e8b35915cdcea1
Instruction ID: a326c3631a424c61c4f2bb30ed4db7270bdb43f4ad8eda935f0b7159c388c215
Opcode Fuzzy Hash: 0d5216bbebe1e4d5e4fda212484cc9b67e4195dbf35dd583a6e8b35915cdcea1
Instruction Fuzzy Hash: BD419132A18B4386EA24EF15F480369A6A5FB84790F940136DF6D47B94DF3CD053DB11

Function 00007FF7E71DCE28 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEAD
GetLastError.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEBB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEE5
FreeLibrary.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCF2B
GetProcAddress.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCF37

Strings

api-ms-, xrefs: 00007FF7E71DCECD

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5875a968ec1c8163f4728790c5c34772c02e6e55674a02490018482c9d800bcd
Instruction ID: 7122505794d3db4ce6846e81bd5e274dafe3da37f6e8322764a8bacdae13f511
Opcode Fuzzy Hash: 5875a968ec1c8163f4728790c5c34772c02e6e55674a02490018482c9d800bcd
Instruction Fuzzy Hash: E531C721A1A74295EE15EF02F8507B5A294BF89BA1F994936DF3D46340DF3CE0428B21

Function 00007FF7E71D6460 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E71D67AF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7E71D64BF

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E71D64D3
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E71D651A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E71D6496

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: b60e1185c9f9ee707b49e7ed4e3a4a995e0c101ca8882adb9a2ed2a45595f786
Instruction ID: 471986698c023c7814121b0a59bd2f0f3d2c1a25d4ca826ee8db91370bf53ed6
Opcode Fuzzy Hash: b60e1185c9f9ee707b49e7ed4e3a4a995e0c101ca8882adb9a2ed2a45595f786
Instruction Fuzzy Hash: EF316611B1874241FA24F725F9953BAD251AFD87C1FC44433DB6E4279AEE3CE5068B22

Function 00007FF7E71D79A0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7A60

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF7E71D79E7
MultiByteToWideChar, xrefs: 00007FF7E71D79EE, 00007FF7E71D7A71
Out of memory., xrefs: 00007FF7E71D7A22
win32_utils_from_utf8, xrefs: 00007FF7E71D7A29
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7E71D7A6A

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: ee2ee3c888b621b3c3f4dc33b354bcabab4fe5f972038a38ac2187e11a85846b
Instruction ID: 6fc51b0188ca401f5155f5789f42d0d9afe3a7026cf13a31c9b9a137a37c7bf3
Opcode Fuzzy Hash: ee2ee3c888b621b3c3f4dc33b354bcabab4fe5f972038a38ac2187e11a85846b
Instruction Fuzzy Hash: CD219322B08B4241EB14EB19F440265E761EFC57C4F984132DB6C93BA9EE3CD5529B11

Function 00007FF7E71EA550 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA55F
FlsGetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA574
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA595
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5C2
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5D3
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5E4
SetLastError.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5FF

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 408c089a3b640914283472138efc63105aff7241411df2dd409cda215309df11
Instruction ID: 2cdc1f76e22c140503dc4f6202bb88e74fb60d1487d4eb87ba5a3e31dbe94fe6
Opcode Fuzzy Hash: 408c089a3b640914283472138efc63105aff7241411df2dd409cda215309df11
Instruction Fuzzy Hash: FF215E20B0D34283FA58B321F645379E2669FC47B4F940636D93E866C6DE3CE4478223

Function 00007FF7E71F6F9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E71F6FCD
GetLastError.KERNEL32 ref: 00007FF7E71F6FD9
CloseHandle.KERNEL32 ref: 00007FF7E71F6FF1
CreateFileW.KERNEL32 ref: 00007FF7E71F701C
WriteConsoleW.KERNEL32 ref: 00007FF7E71F703B

Strings

CONOUT$, xrefs: 00007FF7E71F6FFD

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5d0318ae55f50b6dcee6d616b573d53fae0e0d17b0b79c1b3a6779b9b80778ff
Instruction ID: 455925103bbc5498292e1f086ab2c81de9bc46348fe3237b168950e5ef8dba74
Opcode Fuzzy Hash: 5d0318ae55f50b6dcee6d616b573d53fae0e0d17b0b79c1b3a6779b9b80778ff
Instruction Fuzzy Hash: AD11D021B18B4186E750AB02F854329F2A4FFC9FE4F840236EA2D83794DF3CD8168761

Function 00007FF7E71EA6C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA6D7
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA70D
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA73A
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA74B
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA75C
SetLastError.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA777

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b9ed1a4e590336ba34b9cc0adcda05e316cd19dcf21a64e85ad9e9ab5a233fdb
Instruction ID: 573673b260cbd9232b9956ed372057351566bb338d231c068c2d9f32bc78cba5
Opcode Fuzzy Hash: b9ed1a4e590336ba34b9cc0adcda05e316cd19dcf21a64e85ad9e9ab5a233fdb
Instruction Fuzzy Hash: 5F113824E0D34243FA58F331E645279E2A69FC47B0F840236E93E866D6DE3DA4478222

Function 00007FF7E71DE3A4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E71DE3CC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7E71DE4B4
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E71DE600

Strings

csm, xrefs: 00007FF7E71DE506
csm, xrefs: 00007FF7E71DE3EE

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 9800ab22ff9ec3031df11c68b1b6988b1d6dca39287b35c2ac61cac3dceebb2d
Instruction ID: f9d572aae82b4524633bbc8b1dc4c96f076c1c135c5ddcd665fdf515b58185dd
Opcode Fuzzy Hash: 9800ab22ff9ec3031df11c68b1b6988b1d6dca39287b35c2ac61cac3dceebb2d
Instruction Fuzzy Hash: 1B61B33290C74286EB24AF25E484368B7A0EB94B96F844133DBAD47795DF3CE456CF12

Function 00007FF7E71DC7E8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E71DC813
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E71DC8A8
RtlUnwindEx.KERNEL32 ref: 00007FF7E71DC8F7

Strings

csm, xrefs: 00007FF7E71DC88E
f, xrefs: 00007FF7E71DC826

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2ca7bf8577ec542d0e69192cc971812b89960c92109ccbd26765ab8ebdf2d4b6
Instruction ID: 8ab03f1e5c5987b3be264e862fcf2da6be140608e34c9f9cc8f31f93b4334bd9
Opcode Fuzzy Hash: 2ca7bf8577ec542d0e69192cc971812b89960c92109ccbd26765ab8ebdf2d4b6
Instruction Fuzzy Hash: 2E51DA31A097018EEB18EF15F480B29B756FB80789F908536DB6E47744EF38E842CB15

Function 00007FF7E71D2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7E71D242F), ref: 00007FF7E71D2278
DialogBoxIndirectParamW.USER32 ref: 00007FF7E71D233C
DeleteObject.GDI32 ref: 00007FF7E71D236F
DestroyIcon.USER32 ref: 00007FF7E71D2381

Strings

Unhandled exception in script, xrefs: 00007FF7E71D22A8

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1c75f085d0d1285afa7d256397b39d5154ba0e32df1410c11512219579e8eefc
Instruction ID: cb5b9fe37d844b8ddb4b340d25d16d1e1dec8a841a9e313814fce1d7be4a8038
Opcode Fuzzy Hash: 1c75f085d0d1285afa7d256397b39d5154ba0e32df1410c11512219579e8eefc
Instruction Fuzzy Hash: 29314032609B8289EB24EF61F8552E9B360FF89784F840136EA5E4BB55DF3CD146C712

Function 00007FF7E71D2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654

Part of subcall function 00007FF7E71D7420: GetLastError.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7447
Part of subcall function 00007FF7E71D7420: FormatMessageW.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7476

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D272C
MessageBoxA.USER32 ref: 00007FF7E71D2748

Strings

Fatal error detected, xrefs: 00007FF7E71D2700, 00007FF7E71D273A
%s%s: %s, xrefs: 00007FF7E71D26AD

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 69e3767f8cdd6c35a8cd2c47750a455f0093d4d97caca0efebb433e2d8ab7874
Instruction ID: 8cd49527202bd84aa7e6a306efb4d982036f231539c084f11b1ba1fc7675df7c
Opcode Fuzzy Hash: 69e3767f8cdd6c35a8cd2c47750a455f0093d4d97caca0efebb433e2d8ab7874
Instruction Fuzzy Hash: 4B315E72628B8291EA24EB10F4917EAA364FFC4785FC44037EB9D06699DF3CD206CB51

Function 00007FF7E71E8810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E71E8835
GetProcAddress.KERNEL32 ref: 00007FF7E71E884B
FreeLibrary.KERNEL32 ref: 00007FF7E71E8872

Strings

CorExitProcess, xrefs: 00007FF7E71E8844
mscoree.dll, xrefs: 00007FF7E71E882C

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b22ba27cf5ec64e3c37270bb25822a4f1a3ee3e342d89922054c394a8bf0263d
Instruction ID: c011b0edebd2ce68d606edbfcfa141f3ee425825320ecfe4ea0731393e438a4a
Opcode Fuzzy Hash: b22ba27cf5ec64e3c37270bb25822a4f1a3ee3e342d89922054c394a8bf0263d
Instruction Fuzzy Hash: 91F0A461A09B0241EB14AB24F8453399330EFC5755FC81236DA7D451E4CF3CD006C321

Function 00007FF7E71F86D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7E71F86FC
_set_statfp.LIBCMT ref: 00007FF7E71F8717
_set_statfp.LIBCMT ref: 00007FF7E71F8733
_set_statfp.LIBCMT ref: 00007FF7E71F876F

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 84eff07cf34d7ef4d1c68c6f3ca1ac7bb33ca5062f75dc06944f343170a53951
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: D9118F66E5CB4305F75C3164F45237994406FD53A4F940B36EB7E1A2E6CE3CA8A34132

Function 00007FF7E71EA790 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7AF
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7CE
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7F6
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA807
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA818

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1866f34fa7f79f3022db2fd0a4456b1afab4f469433fcd6442c1cb9f0b531661
Instruction ID: d5eeabedc25729b4e0f8c0f6eed0f2754fa6855549d79e58a5f6690bfc32d516
Opcode Fuzzy Hash: 1866f34fa7f79f3022db2fd0a4456b1afab4f469433fcd6442c1cb9f0b531661
Instruction Fuzzy Hash: 4B114D20F0D70243FA58B325F645779D2569F847B0F885236D93D866D6DE3CA4478222

Function 00007FF7E71EA624 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA635
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA654
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA67C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA68D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA69E

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e6a4540a5dfa42a6e095f599f9e5a878cb7ff9b4d696c427789b65f028acb1c3
Instruction ID: 856011661a76659a8d524d540cf2a579bb0b887f4891215d89f394e2167bbaf1
Opcode Fuzzy Hash: e6a4540a5dfa42a6e095f599f9e5a878cb7ff9b4d696c427789b65f028acb1c3
Instruction Fuzzy Hash: 2611C520E0930343FA58B631E5553B992569FCA374E991636D93E8A2D6DD3CB8478233

Function 00007FF7E71EF0C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EF3A7

Part of subcall function 00007FF7E71F53A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F53C1

Strings

ccs, xrefs: 00007FF7E71EF2E2
UTF-8, xrefs: 00007FF7E71EF326
UTF-16LEUNICODE, xrefs: 00007FF7E71EF345

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0a85a650483ad60012865602343b5a273e15b3a1a81ddf8674274c6c15df3bc7
Instruction ID: 3d3c0ff671adf808035cb89a4006415650950afda0442d3fb5a85e081d6be77c
Opcode Fuzzy Hash: 0a85a650483ad60012865602343b5a273e15b3a1a81ddf8674274c6c15df3bc7
Instruction Fuzzy Hash: FA817376D283C387F6E46E25E100378A698EB95784FD54036DE29D7285DB3DE5039323

Function 00007FF7E71DE048 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7E71DE094
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E71DE0E3

Strings

RCC, xrefs: 00007FF7E71DE0B1
MOC, xrefs: 00007FF7E71DE0A8

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: b915d9317e93b4a578d272aa80a630b017422358f6ab493f0d79254b27da14c1
Instruction ID: a9a77a9b453d8a5502f18ddc12444421bc0db40da9cca548e5723c79b417445b
Opcode Fuzzy Hash: b915d9317e93b4a578d272aa80a630b017422358f6ab493f0d79254b27da14c1
Instruction Fuzzy Hash: 1F618033A08B468AE710DF65E4803ADB7A0F784B89F444226EF5D17B94DF38E146CB11

Function 00007FF7E71D24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D25D7
MessageBoxA.USER32 ref: 00007FF7E71D25F3

Strings

Fatal error detected, xrefs: 00007FF7E71D25AB, 00007FF7E71D25E5
%s%s: %s, xrefs: 00007FF7E71D2558

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 87d498f1f2eba1085113bd965dcd85bf0b0aec07eea02affa6468b175f4c1a2f
Instruction ID: 65cf70271a4ebc3dcbe2358d7cd2b2d53040f320e6b37d7d9817d12062056351
Opcode Fuzzy Hash: 87d498f1f2eba1085113bd965dcd85bf0b0aec07eea02affa6468b175f4c1a2f
Instruction Fuzzy Hash: 62314E72628B8291EA24FB10F4517EAA365FFC4784FC44036EB9D46699DE3CD306CB61

Function 00007FF7E71D3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D3BB1

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

Strings

GetModuleFileNameW, xrefs: 00007FF7E71D3BC2
Failed to get executable path., xrefs: 00007FF7E71D3BBB
Failed to convert executable path to UTF-8., xrefs: 00007FF7E71D3BEA

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: ecd9224541c82b8805659ffed1dacaf8541a9c5a4d14f69c88a104199cf53391
Instruction ID: 523180b79b99d85201dc5fe24b8380c5988acbd7e05506e52c36f2574e962741
Opcode Fuzzy Hash: ecd9224541c82b8805659ffed1dacaf8541a9c5a4d14f69c88a104199cf53391
Instruction Fuzzy Hash: 16018D21B1C74281FA54F714F4863B59355AFD87C5FC41033DA6E86252DE7DE2078B22

Function 00007FF7E71EB9A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7E71EBA1F
WriteFile.KERNEL32 ref: 00007FF7E71EBCE7
WriteFile.KERNEL32 ref: 00007FF7E71EBD2D
GetLastError.KERNEL32 ref: 00007FF7E71EBDE3

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3b6644ee017022d719a3afab9fc978a5fba374dbb9fb0623c46dfb0064678277
Instruction ID: 88e532a4fdf59903b4ca8d8e429bf82b801224b392058e119db59032fe288263
Opcode Fuzzy Hash: 3b6644ee017022d719a3afab9fc978a5fba374dbb9fb0623c46dfb0064678277
Instruction Fuzzy Hash: 2CD10632B18B418AE721DF65E4806AC77B1FB84798B844137DE6E97B99DE38E017C311

Function 00007FF7E71D1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7E71D1FA4
SetWindowLongPtrW.USER32 ref: 00007FF7E71D1FC6
GetWindowLongPtrW.USER32 ref: 00007FF7E71D1FF0
InvalidateRect.USER32 ref: 00007FF7E71D2010

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 7ae150d53b8b86cb67fa86c5e81452d3956d568a63a99bc336b13b90577f37e1
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 8C110021E1834241F654A759F5843FA9292EFC9BC1FC94032EB6907B8DCE3CD4D75612

Function 00007FF7E71F4C6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71F07D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F0803

_get_daylight.LIBCMT ref: 00007FF7E71F4D84
_get_daylight.LIBCMT ref: 00007FF7E71F4D95

Strings

?, xrefs: 00007FF7E71F4D15

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 0b8ca87835c30e7dd9a6d8efabbb9b2e46a436efc16959cb60937fa9fb99071e
Instruction ID: dc742c933d4e5f9f3e476a8444e1fed128d1e19b09272340315672a4defe11e4
Opcode Fuzzy Hash: 0b8ca87835c30e7dd9a6d8efabbb9b2e46a436efc16959cb60937fa9fb99071e
Instruction Fuzzy Hash: BD41B312A1878246FB78AB25F401379E6A0EFD07A4F944237EF6C46AD9DE3CD4538711

Function 00007FF7E71E7D9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E7DCE

Part of subcall function 00007FF7E71E9D48: RtlFreeHeap.NTDLL(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E71DADA5), ref: 00007FF7E71E7DEC

Strings

C:\Users\user\Desktop\wsx.exe, xrefs: 00007FF7E71E7DDA

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\wsx.exe
API String ID: 3580290477-2252155340
Opcode ID: 51e6a1df85e6b8727f5a5399446d791ce4e9a1b0ebf56f2411f665e3e6ab5c6a
Instruction ID: fe6651bf93def5140c5bd12bbebf4bdb83f707dac9fad70197528b0497c54f1c
Opcode Fuzzy Hash: 51e6a1df85e6b8727f5a5399446d791ce4e9a1b0ebf56f2411f665e3e6ab5c6a
Instruction Fuzzy Hash: 07414136A0871286F715EF25E8402F9B7A4FF84794B944036E96E87745DF3CE4928362

Function 00007FF7E71EC038 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7E71EC14F
GetLastError.KERNEL32 ref: 00007FF7E71EC171

Strings

U, xrefs: 00007FF7E71EC0FB

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 25d3c82af5dee18dec41a6839be42a4efbc899a14913ea0c1072e724c64aea02
Instruction ID: 64e6eb64b230df994e44bf9ac783c5bdef570d073f992b6904f266874684ede3
Opcode Fuzzy Hash: 25d3c82af5dee18dec41a6839be42a4efbc899a14913ea0c1072e724c64aea02
Instruction Fuzzy Hash: 6D41B432718B4186DB20EF25F8443AAA761FB88794F944032EE5D87798DF3CE442C751

Function 00007FF7E71EE438 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E71EE478
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E71EE4CA

Strings

:, xrefs: 00007FF7E71EE48E

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 337811278158943dc12376dc7550913df66d0a9835a82896272fb1d86e1f30b6
Instruction ID: 0e7b3ad9aa68a1b4ae70c4cad15029da38746bf6741badb2a76affc70e5b4bf7
Opcode Fuzzy Hash: 337811278158943dc12376dc7550913df66d0a9835a82896272fb1d86e1f30b6
Instruction Fuzzy Hash: 85218472A0874282FB24EB25E44836DA3B1FBC4B44F854036D65D87284DF7CE946C762

Function 00007FF7E71D2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D2951
MessageBoxA.USER32 ref: 00007FF7E71D296D

Strings

Error detected, xrefs: 00007FF7E71D2925, 00007FF7E71D295F

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 06108ee8a0dfea952a12a3b0306062f889501f0bb9d520917d4d6b2389df326d
Instruction ID: 094f0d00a12819bf5f8a6c9c30803a48a007b073309cc76c9c2b49e011c6878f
Opcode Fuzzy Hash: 06108ee8a0dfea952a12a3b0306062f889501f0bb9d520917d4d6b2389df326d
Instruction Fuzzy Hash: DA21517262878291EA24E710F4917EAA365FFC4788FC04136EB9D47699DF3CD206CB61

Function 00007FF7E71D2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D2841
MessageBoxA.USER32 ref: 00007FF7E71D285D

Strings

Fatal error detected, xrefs: 00007FF7E71D2815, 00007FF7E71D284F

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: d8350b2dd45537fcb102945a95e56e5fec4cbfd54fbf68520de5e8d25681b826
Instruction ID: 468673be7787a2b0a75197d78600a4527fcd4a99ff5bfd34723f3cd4a0fe18c5
Opcode Fuzzy Hash: d8350b2dd45537fcb102945a95e56e5fec4cbfd54fbf68520de5e8d25681b826
Instruction Fuzzy Hash: 7421817262878281EA24E710F4917EAA365FFC4788FC04036EB9D47699DF3CD206CB61

Function 00007FF7E71DEEE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7E71DEF24
RaiseException.KERNEL32 ref: 00007FF7E71DEF6A

Strings

csm, xrefs: 00007FF7E71DEF57

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 858846fea34555fb8d2c4f12b26bdb04a58b0d9f624c4d397e9619eb30fde2ff
Instruction ID: 51e7e37a19076e4a38b42c99c9743db245e0ba8b02f0341c161e5c65c3fa885a
Opcode Fuzzy Hash: 858846fea34555fb8d2c4f12b26bdb04a58b0d9f624c4d397e9619eb30fde2ff
Instruction Fuzzy Hash: 6B113A32618B8582EB259F15F4403A9B7A5FB88B95F9C4232EF9C07768DF3CD5568B00

Function 00007FF7E71EEF3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EEF6C
GetDriveTypeW.KERNEL32 ref: 00007FF7E71EEFAC

Strings

:, xrefs: 00007FF7E71EEF95

Memory Dump Source

Source File: 00000000.00000002.4718407837.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000000.00000002.4718374099.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718463663.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718491963.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4718597831.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 4110ab54a1292af6c610fc14bebcfde478b3b42ba13f09fd81a5f0b3dffa68e3
Instruction ID: 407fd904f0be0d672ba40c8579cc8de132fd051b5582f0ab71f645abf26379fc
Opcode Fuzzy Hash: 4110ab54a1292af6c610fc14bebcfde478b3b42ba13f09fd81a5f0b3dffa68e3
Instruction Fuzzy Hash: 24015E6191C30387FB20BB60F45137EA3A0EF84744FC40137D66DC2691DE3CE54A8A26

Analysis Process: wsx.exePID: 2132, Parent PID: 6056COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	980
Total number of Limit Nodes:	64

Executed Functions

Function 00007FF8A93001F0 Relevance: 46.3, APIs: 18, Strings: 8, Instructions: 787COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8A9300628
EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8A9300630
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8A9300809
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A9300811
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8A930088A

Strings

CONNE, xrefs: 00007FF8A9300EE8
GET , xrefs: 00007FF8A9300E74
HEAD , xrefs: 00007FF8A9300EB5
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A93006AD, 00007FF8A9300F08, 00007FF8A9300FB0
PUT , xrefs: 00007FF8A9300ED4
, xrefs: 00007FF8A9300790
POST , xrefs: 00007FF8A9300E97
@, xrefs: 00007FF8A93009EA

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: D_sizeO_memcmpR_flagsX_cipherX_md
String ID: $..\s\ssl\record\ssl3_record.c$@$CONNE$GET $HEAD $POST $PUT
API String ID: 2456506815-352295518
Opcode ID: 78c7445cb9e8f13d37dab6a83bc7be3f6aca956914f3d1ac50c01b0496899a75
Instruction ID: d5e9553c1d9f032e5604ae9f25c31afbee01197f86c9d8ffdfad49741c946e42
Opcode Fuzzy Hash: 78c7445cb9e8f13d37dab6a83bc7be3f6aca956914f3d1ac50c01b0496899a75
Instruction Fuzzy Hash: 7072A032A0EAC296FB208E55D4447BA76B1EB44BC8F145175DA8E8B7D8CF7CE585CB00

Function 00007FF8A92F1BF9 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9314DBD
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9314E0F
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9314E34

Strings

ssl3-md5, xrefs: 00007FF8A9314FD7
ssl3-sha1, xrefs: 00007FF8A9314FFF
..\s\ssl\ssl_lib.c, xrefs: 00007FF8A9314DB3, 00007FF8A9314DFF, 00007FF8A9314E1F, 00007FF8A9314E5E, 00007FF8A9314EBE, 00007FF8A9314EE4, 00007FF8A9315073
ALL:!COMPLEMENTOFDEFAULT:!eNULL, xrefs: 00007FF8A9314F97
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256, xrefs: 00007FF8A9314F65

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c$ALL:!COMPLEMENTOFDEFAULT:!eNULL$TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256$ssl3-md5$ssl3-sha1
API String ID: 1767461275-1115027282
Opcode ID: 8f48da3a84b31fc95d831133bfce5bd43d82fa839a3b326f7652dd2b7ced4813
Instruction ID: 98da5515411dbd37aaf86b035f3d177731a54fa6152162e2d0b42b534840ec0f
Opcode Fuzzy Hash: 8f48da3a84b31fc95d831133bfce5bd43d82fa839a3b326f7652dd2b7ced4813
Instruction Fuzzy Hash: A5A14B61A0EFC2A5FF50DF25E4553A832B0EF48B88F542135DA4C8A39AEF7CE5548321

Function 00007FF8A92F16B8 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8A933E178
d2i_X509.LIBCRYPTO-1_1 ref: 00007FF8A933E29B
X509_free.LIBCRYPTO-1_1 ref: 00007FF8A933E6C2
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A933E6D1

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933E238, 00007FF8A933E69D

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeX509X509_freed2i_
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1068509327-1507966698
Opcode ID: d60065ac7b169bd453d18a6eac763743a4a4253f155781a9ab999192c92f6d1b
Instruction ID: 8e821ebc99aeb1ea6773b5278ca11ddc84d9eb8579bd655efba05d879894ad77
Opcode Fuzzy Hash: d60065ac7b169bd453d18a6eac763743a4a4253f155781a9ab999192c92f6d1b
Instruction Fuzzy Hash: B2E1AF72B0EAC196E7309F16D4407AA77A0EB84BC8F449139DA9D87B99DF3CE551CB00

Function 00007FF7E71F4D50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E71F4D95

Part of subcall function 00007FF7E71F46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F46FC

Part of subcall function 00007FF7E71E9D48: HeapFree.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

Part of subcall function 00007FF7E71E9D00: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7E71E9CDF,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71E9D09
Part of subcall function 00007FF7E71E9D00: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E71E9CDF,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71E9D2E

_get_daylight.LIBCMT ref: 00007FF7E71F4D84

Part of subcall function 00007FF7E71F4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F475C

_get_daylight.LIBCMT ref: 00007FF7E71F4FFA
_get_daylight.LIBCMT ref: 00007FF7E71F500B
_get_daylight.LIBCMT ref: 00007FF7E71F501C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71F525C), ref: 00007FF7E71F5043

Strings

Eastern Summer Time, xrefs: 00007FF7E71F5101
Eastern Standard Time, xrefs: 00007FF7E71F50E9

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 9604240e68820e5562e5c5bdf89ef322da5820e448d3a90649f181d06af63343
Instruction ID: 65339d913b94eb0a5e10f87a0746d84686f3380d16f0c102bb8684e649c7dbf7
Opcode Fuzzy Hash: 9604240e68820e5562e5c5bdf89ef322da5820e448d3a90649f181d06af63343
Instruction Fuzzy Hash: DBD1CF26A0875286E728BF25E8403B9A261FFC4794F844137EF6D47686DF3CE4538762

Function 00007FF7E71F5C9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5A11
Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5A8F
Part of subcall function 00007FF7E71F59D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F5AE0

CreateFileW.KERNEL32 ref: 00007FF7E71F5DA2
CreateFileW.KERNEL32 ref: 00007FF7E71F5DF2
GetLastError.KERNEL32 ref: 00007FF7E71F5E22
GetFileType.KERNEL32 ref: 00007FF7E71F5E37
GetLastError.KERNEL32 ref: 00007FF7E71F5E41
CloseHandle.KERNEL32 ref: 00007FF7E71F5E74
CloseHandle.KERNEL32 ref: 00007FF7E71F5FD7
CreateFileW.KERNEL32 ref: 00007FF7E71F600C
GetLastError.KERNEL32 ref: 00007FF7E71F601B

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 632e748b839932f5b00ec5f176d5a067dee1d4c4f3157cbf34afbb6f699b0397
Instruction ID: 96cc182db4407940e0487c6f38c8e5f2927640bbd52c924e9c8c78a9e02ff2e4
Opcode Fuzzy Hash: 632e748b839932f5b00ec5f176d5a067dee1d4c4f3157cbf34afbb6f699b0397
Instruction Fuzzy Hash: 48C1F536B24B4186EB14EF64D4807AC7761FB89B98B510236DF2E97394CF38D466C311

Function 00007FF7E71F4FCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7E71F4FFA

Part of subcall function 00007FF7E71F4748: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F475C

_get_daylight.LIBCMT ref: 00007FF7E71F500B

Part of subcall function 00007FF7E71F46E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F46FC

_get_daylight.LIBCMT ref: 00007FF7E71F501C

Part of subcall function 00007FF7E71F4718: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F472C

Part of subcall function 00007FF7E71E9D48: HeapFree.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71F525C), ref: 00007FF7E71F5043

Strings

Eastern Summer Time, xrefs: 00007FF7E71F5101
Eastern Standard Time, xrefs: 00007FF7E71F50E9

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 35e2d5c93137b8b0a027e840dca31b369a239d429a1659609ffe838318533280
Instruction ID: 8f04323fa3229e03df4e870a358000656c322c9fe85baf0497456a4b7b9c0a96
Opcode Fuzzy Hash: 35e2d5c93137b8b0a027e840dca31b369a239d429a1659609ffe838318533280
Instruction Fuzzy Hash: A5518F32A1875286E724FF21E8803A9A764FF88784FC44137EB6D47696DF3CE4128761

Function 00007FF8A9313410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931345A
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A9313499
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A93134C4
CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A93134ED

Strings

..\s\ssl\ssl_init.c, xrefs: 00007FF8A9313435

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: D_run_once$R_put_error
String ID: ..\s\ssl\ssl_init.c
API String ID: 511881677-1166085723
Opcode ID: 8dc15caf5e793a17cf2c4443d9441d652af2a4ece5e413b0ca58bf89426d50fc
Instruction ID: f0c8337ab6000670e738c5b2d637c8fb32b2c754739da04c44a371f8defcdca1
Opcode Fuzzy Hash: 8dc15caf5e793a17cf2c4443d9441d652af2a4ece5e413b0ca58bf89426d50fc
Instruction Fuzzy Hash: 72210C25E0E983AAFE419F15E8502B622B1EF947C4F996034D90DC21A6EF7CE9598704

Function 00007FF7E71D17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7E71D185C
_fread_nolock.LIBCMT ref: 00007FF7E71D190E

Part of subcall function 00007FF7E71DF2A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF2B4

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

Error on file., xrefs: 00007FF7E71D193D
malloc, xrefs: 00007FF7E71D18EA
Failed to read cookie!, xrefs: 00007FF7E71D1867
MEI, xrefs: 00007FF7E71D17EF
Could not allocate buffer for TOC!, xrefs: 00007FF7E71D18E3
Could not read full TOC!, xrefs: 00007FF7E71D1919
Cannot read Table of Contents., xrefs: 00007FF7E71D1995
fread, xrefs: 00007FF7E71D186E
fseek, xrefs: 00007FF7E71D1836
Failed to seek to cookie position!, xrefs: 00007FF7E71D182F

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 8ec4f6c900cc7d0aa3490cd3924a88f7ba7b866ef6c0a43daa6862f8611de3f4
Instruction ID: 3804ac050ed35f54fc5191fd7c15555d91f40baff757bbb0da3ad7d18b535726
Opcode Fuzzy Hash: 8ec4f6c900cc7d0aa3490cd3924a88f7ba7b866ef6c0a43daa6862f8611de3f4
Instruction Fuzzy Hash: 2C515F71A0970286EB18EF24E491378A3A1FF88B59B954137DB2D83395DF3CE542CB52

Function 00007FF8A92F1A0F Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8A93360FA
SetLastError.KERNEL32 ref: 00007FF8A9336101
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9336208
BUF_MEM_grow.LIBCRYPTO-1_1 ref: 00007FF8A9336293
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A93362DA
BUF_MEM_free.LIBCRYPTO-1_1 ref: 00007FF8A93363E2
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9336446
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9336499

Part of subcall function 00007FF8A9336680: ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,?,00007FF8A93363AE), ref: 00007FF8A9336A1D

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A93361F8, 00007FF8A93362CA, 00007FF8A9336436, 00007FF8A9336489

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error$ErrorLastM_freeM_growR_clear_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 2562538362-2512360314
Opcode ID: 296d12bbc42577eb09a30cebe784a923d4f0f2cde1909dd2651feff315b0fb17
Instruction ID: ce181e72181a057c7167721e5a441e0856c5625c9299ea9090b35d315a7081a0
Opcode Fuzzy Hash: 296d12bbc42577eb09a30cebe784a923d4f0f2cde1909dd2651feff315b0fb17
Instruction Fuzzy Hash: 49B18432A4EAC2AAFB648F16C44137E36B0EB44B9CF146439D94DC6699CF7DE885C700

Function 00007FF8A92F15D7 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 570COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A92FC9E5
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A92FC9F2
memcpy.VCRUNTIME140 ref: 00007FF8A92FCA35
memcpy.VCRUNTIME140 ref: 00007FF8A92FCBD0

Strings

SSL alert number , xrefs: 00007FF8A92FCD22
..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A92FC5D9, 00007FF8A92FCCEE

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: memcpy$O_clear_flagsO_set_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$SSL alert number
API String ID: 1692547093-34800109
Opcode ID: 5d05621fcc1348929402f3f859357ca16d7f05f02e401d34754fc350e2027cd8
Instruction ID: 05f373016bf8b362c9536b9cb95594a327d69fffa61a0eca58608ddebb813a13
Opcode Fuzzy Hash: 5d05621fcc1348929402f3f859357ca16d7f05f02e401d34754fc350e2027cd8
Instruction Fuzzy Hash: 9342A932A0EAC2E6FA68CE15D5447B936A5FB85BC4F144135CA6D87B8CCFBDE4618700

Function 00007FF7E71D12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E71D1312
malloc, xrefs: 00007FF7E71D1353
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E71D12E2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7E71D134C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E71D13E2
fread, xrefs: 00007FF7E71D13E9
fseek, xrefs: 00007FF7E71D1319

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 2e5092e6f90f0761c3f02bbacc60715018b286ec10017a78fb6877a498183532
Instruction ID: eca12d9aa26068d544d76436a529178d321094646e9c759a61895fbc2ec8e82a
Opcode Fuzzy Hash: 2e5092e6f90f0761c3f02bbacc60715018b286ec10017a78fb6877a498183532
Instruction Fuzzy Hash: 0E418C22A0874281EA14FB16F4803AAE3A0EF84795F854433DF6D03A45EF7CE5439B22

Function 00007FF7E71D1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E71D3B80: GetModuleFileNameW.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D3BB1

SetDllDirectoryW.KERNEL32 ref: 00007FF7E71D3885

Part of subcall function 00007FF7E71D6970: GetEnvironmentVariableW.KERNEL32(00007FF7E71D36C7), ref: 00007FF7E71D69AA
Part of subcall function 00007FF7E71D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E71D69C7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF7E71D36DC, 00007FF7E71D3707
MEI, xrefs: 00007FF7E71D37C7
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7E71D380C
Failed to convert DLL search path!, xrefs: 00007FF7E71D386D
_MEIPASS2, xrefs: 00007FF7E71D36B3, 00007FF7E71D371C, 00007FF7E71D39CB, 00007FF7E71D39DB
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7E71D376E

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 66f6e979e7117d0fd9cffebc0098d017bf6a8aea12f951111d67548da8fee6b4
Instruction ID: 206b906c5899189a66096f3e8e6ebf7fbd47e3c84ff32ff8bb89dec1a31cfcb7
Opcode Fuzzy Hash: 66f6e979e7117d0fd9cffebc0098d017bf6a8aea12f951111d67548da8fee6b4
Instruction Fuzzy Hash: E4B1A261A1C78381EE64BB21F4913B99251AFC5786FC40133EB6D47696EE3CE5078B22

Function 00007FF7E71D1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.2.12, xrefs: 00007FF7E71D107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7E71D10B4
malloc, xrefs: 00007FF7E71D10F8, 00007FF7E71D1126
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7E71D10F1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7E71D1249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7E71D111F

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message
String ID: 1.2.12$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1282086711
Opcode ID: 46025cdabab53e8e2b2efccd93d99b66e202f7486fae8c287b4d96ca92b427b8
Instruction ID: 99c2ee190ca1ebcfd6159c8ca57f0d2af22056bc9655f696f0aadcff51b7e92f
Opcode Fuzzy Hash: 46025cdabab53e8e2b2efccd93d99b66e202f7486fae8c287b4d96ca92b427b8
Instruction Fuzzy Hash: A851A322A0878285EA20BB11F4803BAA290FBC5795F994137DF6D47785EF3CE546DB12

Function 00007FF7E71EAE5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EB289

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 52e28160fca86a7eeceb88bd81f6b9396e1938daf65dac55fe125d3a7a8202fa
Instruction ID: 7c0fcea998c95bcc6e8c71980a1e775690048219f2d545c4a73dc03c9f4198d2
Opcode Fuzzy Hash: 52e28160fca86a7eeceb88bd81f6b9396e1938daf65dac55fe125d3a7a8202fa
Instruction Fuzzy Hash: 59C1D232A0C78743EA20AB15F4447BDA6A1EFD1BD0F950133EA6D83691CE7CE4478762

Function 00007FF8A92F2428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A92FD1F7
memcpy.VCRUNTIME140 ref: 00007FF8A92FD25D
SetLastError.KERNEL32 ref: 00007FF8A92FD355
BIO_read.LIBCRYPTO-1_1 ref: 00007FF8A92FD37C

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A92FD306, 00007FF8A92FD3F5

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: memcpy$ErrorLastO_read
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1958097105-2209325370
Opcode ID: edae120d9fe35d59facf5a4fe08dee76e3214904c657c5600ab7b13dad1e873c
Instruction ID: e1c399bfcc0dc470b554768ae458b1e705e2cd10e0a91a6c415f2dc9ca16912f
Opcode Fuzzy Hash: edae120d9fe35d59facf5a4fe08dee76e3214904c657c5600ab7b13dad1e873c
Instruction Fuzzy Hash: EA817932A0EAC5D1FB509E25D5443A922E0FB44BC8F588135DEAC8BB8DDFB8D465C780

Function 00007FF8A9335BE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

BUF_MEM_grow_clean.LIBCRYPTO-1_1(?,?,?,00000000,?,-00000031,00007FF8A9336392), ref: 00007FF8A9335D94
ERR_put_error.LIBCRYPTO-1_1(?,?,?,00000000,?,-00000031,00007FF8A9336392), ref: 00007FF8A9335EAC
ERR_put_error.LIBCRYPTO-1_1(?,?,?,00000000,?,-00000031,00007FF8A9336392), ref: 00007FF8A9335F72

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A9335E9B, 00007FF8A9335F53

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error$M_grow_clean
String ID: ..\s\ssl\statem\statem.c
API String ID: 1147295381-2512360314
Opcode ID: ee35d050ad6db79da5008e9e714a3e8c6f452bf8ee6c6557c9d3fa53c98701f8
Instruction ID: feab8c32ead732277f1726ab72e29e3ee4188fc9e3284f95dccb601d977b8d5f
Opcode Fuzzy Hash: ee35d050ad6db79da5008e9e714a3e8c6f452bf8ee6c6557c9d3fa53c98701f8
Instruction Fuzzy Hash: 6CA19C3664FAC2E5FB608F25D4483BA27A0EB44B88F58513ADA5D876D8CF7DE485C700

Function 00007FF8A92F118B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A931E541

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931E59E

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_new
String ID: ..\s\ssl\ssl_lib.c
API String ID: 458078758-1080266419
Opcode ID: ae28cb8009324df947ebf838b1cee4652da6ae79bd4c65a6c612b91cd11983c7
Instruction ID: 9983e4f1534679151f4b84a06f898164cdca9220e803177c55fa3206c13147f6
Opcode Fuzzy Hash: ae28cb8009324df947ebf838b1cee4652da6ae79bd4c65a6c612b91cd11983c7
Instruction Fuzzy Hash: 57117762B0EA8266EA50DF66F4017A972B0EF487C4F542530EA0D87796EF3DE5518600

Function 00007FF7E71EE80C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7E71EE8FC
_get_daylight.LIBCMT ref: 00007FF7E71EE90D
_get_daylight.LIBCMT ref: 00007FF7E71EE91E
_isindst.LIBCMT ref: 00007FF7E71EE9E9

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 1dd24f7105ff8e7d48a2fb442a16f04649d1343116b9e24a6dd38911d1b00d9f
Instruction ID: 5fc05e566292fec6398c92f45ac60231415cde74061cfcb4584ba4808c90fa42
Opcode Fuzzy Hash: 1dd24f7105ff8e7d48a2fb442a16f04649d1343116b9e24a6dd38911d1b00d9f
Instruction Fuzzy Hash: 6451C872F083124BFB24EB64E94577CA6A5FB84368F900236DE2D926E5DB38A447C711

Function 00007FF7E71E4704 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7E71E4737
GetFileInformationByHandle.KERNEL32 ref: 00007FF7E71E4799
GetLastError.KERNEL32 ref: 00007FF7E71E482A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7E71E463C), ref: 00007FF7E71E4876

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 2c803cf069e940bc8ce2885be35e730a536e5e4cf13c1f700208f7e9b675e8ba
Instruction ID: 5cf8ecda696eed258353274d534eb0b4151dec9a5927f01e5923ab60152cbe32
Opcode Fuzzy Hash: 2c803cf069e940bc8ce2885be35e730a536e5e4cf13c1f700208f7e9b675e8ba
Instruction Fuzzy Hash: 4C518F22E147418BF714EFA1E4517BDB3A1EF88B58F944136EE1997644DF38D4438362

Function 00007FF7E71DAE3C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E71DAE4B

Part of subcall function 00007FF7E71DB2AC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7E71DB2CE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E71DAE60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E71DAECE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7E71DAF21

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: fe3ada7a8cc56a4ed65094338cfa1a217e5e95ba653fb5ab557310939df0f8c4
Instruction ID: 3a94079f42b44c5e37c0f907344d0347de1146785a8db8883c9040ddad85c647
Opcode Fuzzy Hash: fe3ada7a8cc56a4ed65094338cfa1a217e5e95ba653fb5ab557310939df0f8c4
Instruction Fuzzy Hash: A5312921A0831246EA24FB64F4913B9A2919FC5785FC45437EB6E476D3DE3CA8078A37

Function 00007FF7E71E45B0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E45DD
CreateFileW.KERNEL32 ref: 00007FF7E71E461C
CloseHandle.KERNEL32 ref: 00007FF7E71E4651

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: e466375c137080442015770c21472d3ddd744ca47b074c7543c7a5c04326b230
Instruction ID: cc6822e53737935bfb1f01499ba5502ff25baf10b94d21ea895256e1dee01bc2
Opcode Fuzzy Hash: e466375c137080442015770c21472d3ddd744ca47b074c7543c7a5c04326b230
Instruction Fuzzy Hash: D941A362D1878283F714AB61E500369A360FFD97A4F509336FAAC43AD1DF7CA5E28711

Function 00007FF8A92F14CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9317069
ASYNC_get_current_job.LIBCRYPTO-1_1 ref: 00007FF8A93170B6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A9317050

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: C_get_current_jobR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 4281227279-1080266419
Opcode ID: 35882b277f4ccf6b679517ba44a77984db9ce87ed62e302cee43e7f28ac90b82
Instruction ID: f14f0b25d80a6812154d49c50fca8175c2671ff929145c0d5983a252e72ceffe
Opcode Fuzzy Hash: 35882b277f4ccf6b679517ba44a77984db9ce87ed62e302cee43e7f28ac90b82
Instruction Fuzzy Hash: 2C215622A1DA8696EE50DF25F4402B923A0EF84BC4F585131DE59873AAEF7CD5558A00

Function 00007FF8A9336680 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1(?,?,00000000,?,00007FF8A93363AE), ref: 00007FF8A9336A1D

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A9336A0C

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\statem\statem.c
API String ID: 1767461275-2512360314
Opcode ID: 5da4c13888971a3ceaf264271430cc03a6bbf4e53f30d701daf9ea4bde550c43
Instruction ID: 38cac7238045f3e3460c881a54af5a936a49408d849116ed8cacb580b429a2de
Opcode Fuzzy Hash: 5da4c13888971a3ceaf264271430cc03a6bbf4e53f30d701daf9ea4bde550c43
Instruction Fuzzy Hash: B7B17E3265EAC2EAFF648F26C45537A23B1EB45B8CF44613ACA4D86698DF3DD844C701

Function 00007FF7E71DF2CC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF310
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF407

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 93d406eb751f86c607dc13eaaa054d8705ba3ff266a8700b2758b39221051539
Instruction ID: 9507722e682e0b319e909525771aefb334cb4e2e9927a2759eecda63a6097426
Opcode Fuzzy Hash: 93d406eb751f86c607dc13eaaa054d8705ba3ff266a8700b2758b39221051539
Instruction Fuzzy Hash: FB51EA31A093D246E624AD25F44477AA194AFC0BA9F444736DF7D477C5CF3CE602CA22

Function 00007FF7E71EB534 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF7E71EB6CD), ref: 00007FF7E71EB580
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7E71EB6CD), ref: 00007FF7E71EB58A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9f733d69f420b8b04d1076dad759c709488f53e52c8dcc29dc1aedb5cdeb4cec
Instruction ID: 46c1e04058d50701c9ad7c362c6e005b3294e36773825313b97414da1f64b7e2
Opcode Fuzzy Hash: 9f733d69f420b8b04d1076dad759c709488f53e52c8dcc29dc1aedb5cdeb4cec
Instruction Fuzzy Hash: 3D11D061A18B9182DA20AB25F400269A361EF85BF0F940332EA7D477E8CE3CD4528B01

Function 00007FF7E71E48AC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71E47C1), ref: 00007FF7E71E48DF
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71E47C1), ref: 00007FF7E71E48F5

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3187d087db2b214abcb8657b9371278066060ab850da1b3f30db97418e55af6d
Instruction ID: dddedb3e1509ce50a058ccb0ccd1edee32fccbcefcea2b7bea857b2855c37995
Opcode Fuzzy Hash: 3187d087db2b214abcb8657b9371278066060ab850da1b3f30db97418e55af6d
Instruction Fuzzy Hash: 74116D2260C74282EA54AB14F44123AE760FBC57B1F901237FAAE819D8EF3CD016CB21

Function 00007FF7E71E9F58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF7E71E9DD5,?,?,00000000,00007FF7E71E9E8A), ref: 00007FF7E71E9FC6
GetLastError.KERNEL32(?,?,?,00007FF7E71E9DD5,?,?,00000000,00007FF7E71E9E8A), ref: 00007FF7E71E9FD0

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ac9e98b412a5961d7460aa12ad0ec3afb474dab09b1a01e5b31658786db65771
Instruction ID: bec4cec3538b53e1461a5cddee4749516f011bb1ba5ac6c23ad791d10f884809
Opcode Fuzzy Hash: ac9e98b412a5961d7460aa12ad0ec3afb474dab09b1a01e5b31658786db65771
Instruction Fuzzy Hash: F6215021B1874242EA54A765F4503BDAA92DFC5BA0FD84237EA3E872D5CE7CA4464323

Function 00007FF7E71EB2AC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EB2D4

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4ee447531585d2975da1dcda293718dbcf43dcc67f1dbe5b8b161bd0b0a82fe6
Instruction ID: fa9a120880d1a5fade98091988aeb2a786dedd8acb76e18fa97861124e2816c5
Opcode Fuzzy Hash: 4ee447531585d2975da1dcda293718dbcf43dcc67f1dbe5b8b161bd0b0a82fe6
Instruction Fuzzy Hash: D3418F3290834687EA34AA19F54177DB3A4EB95B50F941133DAAAC3A91CB3CE543C762

Function 00007FF7E71D7170 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7E71D721A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 866df6a28d0bcd7ea47bf40bb513fc932a7af652c437135df0e43163510efb48
Instruction ID: aa372ba579bfbf195e0dad4dc972a9685b8e909c75db49dc4680288dba8941c9
Opcode Fuzzy Hash: 866df6a28d0bcd7ea47bf40bb513fc932a7af652c437135df0e43163510efb48
Instruction Fuzzy Hash: E9218121B0839245EE10AA12B5447BAE651FF85BD5FC84432EE2D07786DF3CE142CA12

Function 00007FF7E71EAD3C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EADC2

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 625c65bdf04db2eb988633523b03424b3a376101dc7d8821f14340521426cd90
Instruction ID: 8ca389d3df96210f2daf9b2d89078c39742ad84ccb91c932e7b90b08df09c8a4
Opcode Fuzzy Hash: 625c65bdf04db2eb988633523b03424b3a376101dc7d8821f14340521426cd90
Instruction Fuzzy Hash: F6315D31A1875286E755BB15E841379AA50EBD4B91F850237EA79833D2CF7CE8438722

Function 00007FF8A92F17C6 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A9309103

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 8404de09c8b81130bff0e68f6028756ac13c454de2e81964f73fa35bec372ec7
Instruction ID: e869c2664e24be311152780fb06324f3d7ca48ea1800faadc9bfa0a38691f052
Opcode Fuzzy Hash: 8404de09c8b81130bff0e68f6028756ac13c454de2e81964f73fa35bec372ec7
Instruction Fuzzy Hash: 5A319C33708B8586DB548F55E440BAE77A0F789B88F484136EE8D4BB49CF79C5948B10

Function 00007FF7E71E53F8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E535D

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 7614eb8eef91d19fff95c87f540fdc87e2564c46a683ab03cb68c3d88fb09363
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: F1112131A1874182EA60FF51F80037DE2A0FBC5B84F884436FA9D97695CFBDD5429762

Function 00007FF7E71F568C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F56AF

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 517f1388def26b6ea6af1a1c77ba5c260dc8b33e60c43458f0534b05beae82e8
Instruction ID: 2edfabc7aea7aca3999b4d266a4e3cb37beb4b3dcd736f35b180bb0ece25a381
Opcode Fuzzy Hash: 517f1388def26b6ea6af1a1c77ba5c260dc8b33e60c43458f0534b05beae82e8
Instruction Fuzzy Hash: 0621A132A18B4187D765AF18E440369B6A0FFC4BA4FA44236E76D876D9DF3CD4128B11

Function 00007FF7E71DF54C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71DF5A0

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
Instruction ID: 075add938526e6add54a656cdde05b1e9268bb35aeeac88a2200b88d2e4590d1
Opcode Fuzzy Hash: 1748ab499dec2cd63d41733e33088bccb1bfcf71d5c0ce3e5d0110a60e1804e7
Instruction Fuzzy Hash: 0A01A021A0878241EA04EF52F940269E6A5ABC5FE4F884632EE7C43BD6CF3CE2124711

Function 00007FF8A9335A80 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9335AB6

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID:
API String ID: 1767461275-0
Opcode ID: 00dd9aa0f52b20b2f250f88351cccc6dc7c495ae7f96e3d9caa135d60be24943
Instruction ID: de6251b0518d7d7ab494ca5b05153f76f9d02d6a2db05d1f19501e111aac5797
Opcode Fuzzy Hash: 00dd9aa0f52b20b2f250f88351cccc6dc7c495ae7f96e3d9caa135d60be24943
Instruction Fuzzy Hash: BE01D63261E6C186E7658E29D44836962A0FB45BCCF141139EE5D877EACA7DD840CF01

Function 00007FF8A9336620 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A9336646

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrl
String ID:
API String ID: 3605655398-0
Opcode ID: 92d6e5a1c29aaee1e2fe7278d4f29ff922a1999f8b65debc09121ab47c522004
Instruction ID: 6ff8918c3a7974e71065f48f125004f0a7b83fd6933952c4f8010fc0f1b156be
Opcode Fuzzy Hash: 92d6e5a1c29aaee1e2fe7278d4f29ff922a1999f8b65debc09121ab47c522004
Instruction Fuzzy Hash: B3E048E3B0654146F7109B659486B6526A0EB4C758F542030DA0CC6682E6A9D8E28A00

Function 00007FF7E71D7120 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D7143

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 6a36299e949ae3c67a600344f3c976aeb7534549cea4526ad6a1ea83c7cd138f
Instruction ID: 3342655acf62e96bd6b93de5f1fbcce7503727bc5507f8fe18ba90ee7f425037
Opcode Fuzzy Hash: 6a36299e949ae3c67a600344f3c976aeb7534549cea4526ad6a1ea83c7cd138f
Instruction Fuzzy Hash: 4EE02612B1824142DE0CA767F90116AE1519FC8BD0B889032EF1D03B05DD3CD4924A00

Function 00007FF8A92F1A1E Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ERR_load_strings_const.LIBCRYPTO-1_1 ref: 00007FF8A93133EF

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_load_strings_const
String ID:
API String ID: 78401305-0
Opcode ID: 41b3fefb282b4bb2d6b3f724a89cad23257ca65c3e26364c7391ff96daeb620e
Instruction ID: 5546cb2350607fcc8e2b96247a9604abbe0f5a7a0a36d95664f1d43e711579c6
Opcode Fuzzy Hash: 41b3fefb282b4bb2d6b3f724a89cad23257ca65c3e26364c7391ff96daeb620e
Instruction Fuzzy Hash: AFE0E205E1FCC3B5F944BF6188522B95171EFAD388FD13872E10EC22EAED0CA9084681

Function 00007FF7E71EDC70 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7E71EA7E6,?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E), ref: 00007FF7E71EDCC5

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 706319e4b74843d5ad32e6c0b7fb19fe3c01a362d6ca9e09dab64425b174a517
Instruction ID: a71774cc7092e3c5e5a55056abe55e41e5bebd263204b92ca1ad5a8b30404855
Opcode Fuzzy Hash: 706319e4b74843d5ad32e6c0b7fb19fe3c01a362d6ca9e09dab64425b174a517
Instruction Fuzzy Hash: D9F0AF54B1930642FE54B651F9003B4C2909FC9BC0F8C6436CDAEC72C1DD7CE4924272

Function 00007FF7E71EC9FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7E71DFD74,?,?,?,00007FF7E71E1286,?,?,?,?,?,00007FF7E71E2879), ref: 00007FF7E71ECA3A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 489c3d0cd44d140bc65b640a77535ff6cb9a2f4134c0d54aac00f59d377539c0
Instruction ID: dd13959df38b1a1274d4bb379bb72e64ecf6abcac5866464946b3c716423bd6f
Opcode Fuzzy Hash: 489c3d0cd44d140bc65b640a77535ff6cb9a2f4134c0d54aac00f59d377539c0
Instruction Fuzzy Hash: D0F0FE54B0935646FE64BAA1FD51775D1909FC5FA0F884A32DD3EC52C2EE3CB4429232

Non-executed Functions

Function 00007FF8A92F1924 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 207COMMON

Download Yara Rule

APIs

OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8A9311071
OBJ_nid2sn.LIBCRYPTO-1_1 ref: 00007FF8A93110B7
EVP_get_digestbyname.LIBCRYPTO-1_1 ref: 00007FF8A93110BF
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A93110DE
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8A9311141
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8A9311161
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A9311175
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8A93111B3
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8A93111D3
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A93111E7
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8A9311228
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8A9311248
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A931125C
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8A9311288
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8A93112A8
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A93112BC
EVP_PKEY_asn1_find_str.LIBCRYPTO-1_1 ref: 00007FF8A93112E8
EVP_PKEY_asn1_get0_info.LIBCRYPTO-1_1 ref: 00007FF8A9311308
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A931131C

Strings

gost2012_512, xrefs: 00007FF8A93112DA
gost2012_256, xrefs: 00007FF8A931127A
`, xrefs: 00007FF8A93110FD
gost-mac, xrefs: 00007FF8A9311129
gost-mac-12, xrefs: 00007FF8A93111A5
gost2001, xrefs: 00007FF8A931121A

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: E_finishY_asn1_find_strY_asn1_get0_info$J_nid2sn$D_sizeP_get_digestbyname
String ID: `$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512
API String ID: 910905907-344903700
Opcode ID: d5179f1fa81bdf37aa0ac4a0b56a7b177f04c52ff0e7c9f8530797e90c000734
Instruction ID: cfef1fd8e47a37be59311b2228d9be8f9898ae980414231d70fa26aa800b6998
Opcode Fuzzy Hash: d5179f1fa81bdf37aa0ac4a0b56a7b177f04c52ff0e7c9f8530797e90c000734
Instruction Fuzzy Hash: 54A16872A0EED29AEB209F64D8406A936B1FB497DCF152235E64DC7AA9DF3CD100C744

Function 00007FF7E71D1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF7E71D1BDE
MulDiv.KERNEL32 ref: 00007FF7E71D1BF2
MulDiv.KERNEL32 ref: 00007FF7E71D1C13
SystemParametersInfoW.USER32 ref: 00007FF7E71D1C5B
CreateFontIndirectW.GDI32 ref: 00007FF7E71D1C6F
#380.COMCTL32 ref: 00007FF7E71D1C93
CreateWindowExW.USER32 ref: 00007FF7E71D1CE6
CreateWindowExW.USER32 ref: 00007FF7E71D1D40
CreateWindowExW.USER32 ref: 00007FF7E71D1D9D
CreateWindowExW.USER32 ref: 00007FF7E71D1DFF
SendMessageW.USER32 ref: 00007FF7E71D1E1F
SendMessageW.USER32 ref: 00007FF7E71D1E39
SendMessageW.USER32 ref: 00007FF7E71D1E58
SendMessageW.USER32 ref: 00007FF7E71D1E77
SendMessageW.USER32 ref: 00007FF7E71D1E95
SendMessageW.USER32 ref: 00007FF7E71D1EB3
SendMessageW.USER32 ref: 00007FF7E71D1ED1
SendMessageW.USER32 ref: 00007FF7E71D1EE9
SendMessageW.USER32 ref: 00007FF7E71D1F01
GetClientRect.USER32 ref: 00007FF7E71D1F10

Part of subcall function 00007FF7E71D2030: GetDC.USER32 ref: 00007FF7E71D205B
Part of subcall function 00007FF7E71D2030: SelectObject.GDI32 ref: 00007FF7E71D20A2
Part of subcall function 00007FF7E71D2030: DrawTextW.USER32 ref: 00007FF7E71D20C5
Part of subcall function 00007FF7E71D2030: SelectObject.GDI32 ref: 00007FF7E71D20DB
Part of subcall function 00007FF7E71D2030: ReleaseDC.USER32 ref: 00007FF7E71D20EB
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D213B
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D217B
Part of subcall function 00007FF7E71D2030: MoveWindow.USER32 ref: 00007FF7E71D21CE

Strings

Close, xrefs: 00007FF7E71D1DA8
BUTTON, xrefs: 00007FF7E71D1DB6
EDIT, xrefs: 00007FF7E71D1D4B
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF7E71D1BBD
STATIC, xrefs: 00007FF7E71D1C9C, 00007FF7E71D1CF1

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 051afb74dd6d8b2a6ec501d8fa5556287ab5d0c90ea366ccf65a0a970d90b360
Instruction ID: 1d1a0cb43f91ef0e24f396f09ca13e3c6bed1fb45583a57d15057b8df10c25bc
Opcode Fuzzy Hash: 051afb74dd6d8b2a6ec501d8fa5556287ab5d0c90ea366ccf65a0a970d90b360
Instruction Fuzzy Hash: 8CA15A36218B8187E718DF21F59479AB360FB89B84F944126DB9D03B24CF7DE166CB50

Function 00007FF8A9314900 Relevance: 38.6, APIs: 21, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

X509_VERIFY_PARAM_free.LIBCRYPTO-1_1 ref: 00007FF8A9314937
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314950
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314974
CRYPTO_free_ex_data.LIBCRYPTO-1_1 ref: 00007FF8A93149AB
OPENSSL_LH_free.LIBCRYPTO-1_1 ref: 00007FF8A93149B4
X509_STORE_free.LIBCRYPTO-1_1 ref: 00007FF8A93149BD
CTLOG_STORE_free.LIBCRYPTO-1_1 ref: 00007FF8A93149C9
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A93149D2
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A93149DB
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A93149E4
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A03
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A16
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A29
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A40
ENGINE_finish.LIBCRYPTO-1_1 ref: 00007FF8A9314A54
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A6D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A86
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314A9F
CRYPTO_secure_free.LIBCRYPTO-1_1 ref: 00007FF8A9314AB8
CRYPTO_THREAD_lock_free.LIBCRYPTO-1_1 ref: 00007FF8A9314AC4
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9314AD9

Part of subcall function 00007FF8A92F1B4A: CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8A9322F45
Part of subcall function 00007FF8A92F1B4A: OPENSSL_LH_set_down_load.LIBCRYPTO-1_1 ref: 00007FF8A9322F7C
Part of subcall function 00007FF8A92F1B4A: CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8A9322F88

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A9314943, 00007FF8A931495C, 00007FF8A9314A60, 00007FF8A9314A79, 00007FF8A9314A92, 00007FF8A9314AAB, 00007FF8A9314ACF

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$L_sk_free$L_sk_pop_free$E_freeX509_$D_lock_freeD_unlockD_write_lockE_finishH_freeH_set_down_loadM_freeO_free_ex_dataO_secure_free
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1978915437-1080266419
Opcode ID: 963b2aa0bef5b1a1c29060d8ccbb4a70c0f3694ca6c4e8ef8f33aa609e4a3b7e
Instruction ID: f32d7f60d7a27dc833992c5865c9a9f7d5b8ca8dfe68d28ad3aa9445ede1fdfd
Opcode Fuzzy Hash: 963b2aa0bef5b1a1c29060d8ccbb4a70c0f3694ca6c4e8ef8f33aa609e4a3b7e
Instruction Fuzzy Hash: C8410A61A0EEC2A5EB00EF66D8517F82330EB89BCCF447131E90DDB2AADE68D545C311

Function 00007FF8A931CB90 Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931CBDF
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931CC2F

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931CBC4, 00007FF8A931CC10, 00007FF8A931CC49, 00007FF8A931CCAB, 00007FF8A931CCDE, 00007FF8A931CD26, 00007FF8A931CD5D, 00007FF8A931CD89, 00007FF8A931CDBE, 00007FF8A931CEEF, 00007FF8A931D011, 00007FF8A931D05B, 00007FF8A931D08A

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 94c1324b787a801633dba7bb4ef5eedc7beded623dd66a05d76f6519222e4afe
Instruction ID: 502323c0d5becbd57fe8351be5bea1a4e8a1aa96ae2ab1504594f4285e08d493
Opcode Fuzzy Hash: 94c1324b787a801633dba7bb4ef5eedc7beded623dd66a05d76f6519222e4afe
Instruction Fuzzy Hash: DFD1B162A0EAD266FE20DF12E4107BA72B1EB847C8F506535DA4D877E5EF3CD5828700

Function 00007FF8A9346B00 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A9346B43
X509_get0_pubkey.LIBCRYPTO-1_1 ref: 00007FF8A9346BA3
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8A934700E
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A9347028
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9347039

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A9346B50, 00007FF8A9346B81, 00007FF8A9346DD2, 00007FF8A9346E19, 00007FF8A9346FA3, 00007FF8A9346FD5, 00007FF8A9346FF1

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$X509_get0_pubkeyX_freeX_new
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 1476775391-2839845709
Opcode ID: c67be3e57d0090ebd1ff3e0bddfe18cfb2956b76ef896d0b00e2ddf66be9d8bc
Instruction ID: 63335c5375788147cfc788edf20fff7ea60c1328f0ddfaf6c7af874a787a55cd
Opcode Fuzzy Hash: c67be3e57d0090ebd1ff3e0bddfe18cfb2956b76ef896d0b00e2ddf66be9d8bc
Instruction Fuzzy Hash: BEE18E3260EAC2A6EB249F12D4407AA77B4FB84BC9F456031DA8D8BB95DF7CE545C700

Function 00007FF8A9305980 Relevance: 27.3, APIs: 18, Instructions: 273COMMON

Download Yara Rule

APIs

EVP_sha256.LIBCRYPTO-1_1 ref: 00007FF8A93059B9
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A93059F3
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305A01
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A9305A12
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305A25
OPENSSL_sk_new_reserve.LIBCRYPTO-1_1 ref: 00007FF8A9305AD6
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A9305AED
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305B05
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A9305B19
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305B2B
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A9305B3F
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A9305B77
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305B95
OPENSSL_sk_find.LIBCRYPTO-1_1 ref: 00007FF8A9305CA8
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305D02
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A9305D11
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A9305D41
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A9305D56

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_value$L_sk_num$L_sk_push$L_sk_findL_sk_freeL_sk_new_reserveP_sha256
String ID:
API String ID: 1426113972-0
Opcode ID: acb547e4507013a0a7d8a9383266d5c1f62a86160be9c10087eb4094dd91ec03
Instruction ID: 5dcbbaae2d779882a8ad2a27e34a75d9f733e660d019a361f6acf6ee53549752
Opcode Fuzzy Hash: acb547e4507013a0a7d8a9383266d5c1f62a86160be9c10087eb4094dd91ec03
Instruction Fuzzy Hash: B8A1CE69A0FAC25AEB649E56808477A22F1FB84BC8F547475DD4EC7796CF3CE8818700

Function 00007FF8A92F191F Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931722F

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931721F, 00007FF8A93173A1

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 6cec8d3873de1cde41f267993ccb6412c4c53de7e19fb531cd3d6bfe4fe4fdbd
Instruction ID: 4c98cc557349f78b59f187b1aa3d3c6c040feb75de8991473516e6d7e83dc1f4
Opcode Fuzzy Hash: 6cec8d3873de1cde41f267993ccb6412c4c53de7e19fb531cd3d6bfe4fe4fdbd
Instruction Fuzzy Hash: 13D14A2260AEC2A6EB58DF65D4403BD73B0FB48B84F586035DB1E87795EF38E4628710

Function 00007FF8A8084471 Relevance: 21.2, APIs: 14, Instructions: 246fileCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8220B7E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8220BCD
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8220BDB
memset.VCRUNTIME140 ref: 00007FF8A8220BF7
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8220C19
GetLastError.KERNEL32 ref: 00007FF8A8220C2A
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8220C4D
MultiByteToWideChar.KERNEL32 ref: 00007FF8A8220DD5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A8220DE6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8220DEF
FindFirstFileW.KERNEL32 ref: 00007FF8A8220E31
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A8220E50
FindNextFileW.KERNEL32 ref: 00007FF8A8220E68
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8220EC2

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide_errno$FileFind$ErrorFirstLastNextfreemallocmemset
String ID:
API String ID: 3372420414-0
Opcode ID: 9d4875aaf23f410f68e283139661865cbaf76c1e9f82268e5aeab3ef4883c66a
Instruction ID: 8e91fb524ecbca7a72ba529a4229507ef15ccfcd7dd8964b988c1970a24ece82
Opcode Fuzzy Hash: 9d4875aaf23f410f68e283139661865cbaf76c1e9f82268e5aeab3ef4883c66a
Instruction Fuzzy Hash: 56B1B362E06A8296EB109F25D4542B977A1FF49BE4F444731DA6E437D9FF3CE0418328

Function 00007FF8A80849A8 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 169COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A8249441
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A8249462
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A824947D
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A8249498
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A82494E0
WideCharToMultiByte.KERNEL32 ref: 00007FF8A8249516
WideCharToMultiByte.KERNEL32 ref: 00007FF8A824956B

Strings

RANDFILE, xrefs: 00007FF8A8249429
SYSTEMROOT, xrefs: 00007FF8A8249489
HOME, xrefs: 00007FF8A8249450
.rnd, xrefs: 00007FF8A824961A
USERPROFILE, xrefs: 00007FF8A824946E

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 5ebd83b74752af6dfb4dc67d560d70e7a8fd861d60dd0b3d1ec21f852282ba6c
Instruction ID: d9be1bc3931b1e90c95352b4f7c605fd94cdc1ddf606ab93d6f71aaf047bb17f
Opcode Fuzzy Hash: 5ebd83b74752af6dfb4dc67d560d70e7a8fd861d60dd0b3d1ec21f852282ba6c
Instruction Fuzzy Hash: 2261D52260AB82A5EB108F25A85017967A1FF45BF4F588231DE6E437E8DF7DE016C724

Function 00007FF8A9340E00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FF8A9340463), ref: 00007FF8A9340E3B
ERR_put_error.LIBCRYPTO-1_1(?,00007FF8A9340463), ref: 00007FF8A9340E63
CRYPTO_malloc.LIBCRYPTO-1_1(?,00007FF8A9340463), ref: 00007FF8A9340E84
ERR_put_error.LIBCRYPTO-1_1(?,00007FF8A9340463), ref: 00007FF8A9340EAC
CRYPTO_free.LIBCRYPTO-1_1(?,00007FF8A9340463), ref: 00007FF8A9340EBF

Strings

R, xrefs: 00007FF8A9340EFA
..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A9340E2D, 00007FF8A9340E48, 00007FF8A9340E7A, 00007FF8A9340E91, 00007FF8A9340EB5, 00007FF8A9340EDF, 00007FF8A9340EF3, 00007FF8A9340F1A

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_mallocR_put_error$O_free
String ID: ..\s\ssl\statem\statem_dtls.c$R
API String ID: 1091011155-469809446
Opcode ID: 02adae34f141b8c54bdd98b7501d703c722505631c2a981cd8a002c201db5def
Instruction ID: 7d2611b7374c3920856fb839a45b0c94d0523ba7118fba36aa9d526b80ddc8b3
Opcode Fuzzy Hash: 02adae34f141b8c54bdd98b7501d703c722505631c2a981cd8a002c201db5def
Instruction Fuzzy Hash: AB31603261EE82A6E710DF12E5006A973B0FB887C4F842435EA4D83B49EF3DE615DB00

Function 00007FF8A930DE70 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

COMP_zlib.LIBCRYPTO-1_1 ref: 00007FF8A930DE7F
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A930DE8C
OPENSSL_sk_new.LIBCRYPTO-1_1 ref: 00007FF8A930DE98
COMP_get_type.LIBCRYPTO-1_1 ref: 00007FF8A930DEA7
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A930DED1
COMP_get_name.LIBCRYPTO-1_1 ref: 00007FF8A930DEEB
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A930DEFE
OPENSSL_sk_sort.LIBCRYPTO-1_1 ref: 00007FF8A930DF0A
CRYPTO_mem_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A930DF19

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A930DEC5

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_mem_ctrl$L_sk_newL_sk_pushL_sk_sortO_mallocP_get_nameP_get_typeP_zlib
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 680475741-1847046956
Opcode ID: 15a78374f493de6d1e0e83a03a872b9186b544d640128c05cf70f427dcdf1e1b
Instruction ID: a8eecb5037bde47a672e00c68db5490cb82cb52fdccd2713af4b31b856a4eaac
Opcode Fuzzy Hash: 15a78374f493de6d1e0e83a03a872b9186b544d640128c05cf70f427dcdf1e1b
Instruction Fuzzy Hash: 36112520E0FE83A5FA04AF65E8553B862B5EF897C4F407035E95D8B3E7DE6CE4008650

Function 00007FF8A933ABF0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(..\s\ssl\statem\statem_clnt.c,?,?,00000000,?,?,?,00007FF8A933BB5E), ref: 00007FF8A933AC65
OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FF8A933BB5E), ref: 00007FF8A933AE46
OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FF8A933BB5E), ref: 00007FF8A933AE55
CRYPTO_clear_free.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FF8A933BB5E), ref: 00007FF8A933AE69
CRYPTO_clear_free.LIBCRYPTO-1_1(?,?,00000000,?,?,?,00007FF8A933BB5E), ref: 00007FF8A933AE7D

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933ABFE, 00007FF8A933AC46, 00007FF8A933ACB6, 00007FF8A933ACD5, 00007FF8A933AD13

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_cleanseO_clear_free$memset
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 4057395051-1507966698
Opcode ID: 931c0870414b731bb70572bcfe3b284e2c2f09d41bc11b512cc96aebba91fae1
Instruction ID: 0c5d0e35e20f5cf35b44d0adb91ee66daed3de8811fb26c87c4dbb200fb3d0f8
Opcode Fuzzy Hash: 931c0870414b731bb70572bcfe3b284e2c2f09d41bc11b512cc96aebba91fae1
Instruction Fuzzy Hash: F561906270EA81A5FA609F12E840BAA7760FB88BC8F446035DE4DDB795DF7CD5458700

Function 00007FF8A8A018F0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON38 ref: 00007FF8A8A01958
PyUnicode_FromKindAndData.PYTHON38 ref: 00007FF8A8A01B59
PyMem_Free.PYTHON38 ref: 00007FF8A8A01B67
PyMem_Realloc.PYTHON38 ref: 00007FF8A8A01C43
PyMem_Free.PYTHON38 ref: 00007FF8A8A03F90
PyErr_NoMemory.PYTHON38 ref: 00007FF8A8A03F96

Strings

0, xrefs: 00007FF8A8A01B43

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Mem_$Free$DataErr_FromKindMallocMemoryReallocUnicode_
String ID: 0
API String ID: 857045822-4108050209
Opcode ID: 1a47aedec9f05daa56cfb0ff537c540f67868b508df260ed41287c4b5fb163ae
Instruction ID: 9c0fe9d879bd06b2b76213e46a7f48dbb913096c0fe009b89ad6dd9d3ceb025f
Opcode Fuzzy Hash: 1a47aedec9f05daa56cfb0ff537c540f67868b508df260ed41287c4b5fb163ae
Instruction Fuzzy Hash: 88121172A0F652A2E7248B14944A6B926B1FB857C4F244135EA8E47790FF3DF941C32A

Function 00007FF8A8A012C0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 371COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A8A018F0: PyMem_Malloc.PYTHON38 ref: 00007FF8A8A01958

PyMem_Malloc.PYTHON38 ref: 00007FF8A8A0134A
PyMem_Free.PYTHON38 ref: 00007FF8A8A01487
PyErr_NoMemory.PYTHON38 ref: 00007FF8A8A03E01
_Py_Dealloc.PYTHON38 ref: 00007FF8A8A03E11

Strings

0, xrefs: 00007FF8A8A0131E

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Mem_$Malloc$DeallocErr_FreeMemory
String ID: 0
API String ID: 1635361834-4108050209
Opcode ID: be2e3ae1962b5689be12c3a2b13f836e7886129ce40add6d4d3dc9dc83349451
Instruction ID: 45c555acbabf7612892446756db36e2942f5fd3b8af0224a0f875015a3982c9d
Opcode Fuzzy Hash: be2e3ae1962b5689be12c3a2b13f836e7886129ce40add6d4d3dc9dc83349451
Instruction Fuzzy Hash: B9F1F072A0F652A6E7648B15D41A6BE33B4FB447C4F100531EA8E86690FF3DF941C72A

Function 00007FF8A92F1C03 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8A92FFF78
EVP_CIPHER_CTX_block_size.LIBCRYPTO-1_1 ref: 00007FF8A92FFFA3
memset.VCRUNTIME140 ref: 00007FF8A92FFFD4
EVP_Cipher.LIBCRYPTO-1_1 ref: 00007FF8A9300018
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8A9300029
EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8A930003A
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A9300042

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A9300058

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: X_md$CipherD_sizeX_block_sizeX_ciphermemset
String ID: ..\s\ssl\record\ssl3_record.c
API String ID: 2928813329-2721125279
Opcode ID: cc6391ea16ba08961653e77c545628519763c374c602f0d570cc0b84e1784acd
Instruction ID: f3f1d88ecf8782fb4b7c11e6ef14c12cf75f3696c878a30add7d5433c4a04a89
Opcode Fuzzy Hash: cc6391ea16ba08961653e77c545628519763c374c602f0d570cc0b84e1784acd
Instruction Fuzzy Hash: 9B511B26B0EED162FA288E66D5506B967A0FB49BD8F046135DF0E87B95DF3CE061C700

Function 00007FF8A92F1B18 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A932A800
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A932A93B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932A978
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A932A990
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A932A9E7
CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8A932AB78

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A932A7B9, 00007FF8A932A897, 00007FF8A932A8CB, 00007FF8A932A951, 00007FF8A932A9C2

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_cleanse$O_freeO_memcmpO_memdupmemset
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 780863833-592572767
Opcode ID: f34f8ad460171ccb75fa4ef03933ab231f42fe6f42b40a894bd514656ab7bc40
Instruction ID: f5a3b008afb84c4b7ac55521be7c1163c45a762f2866f672ac85d707bc4de68a
Opcode Fuzzy Hash: f34f8ad460171ccb75fa4ef03933ab231f42fe6f42b40a894bd514656ab7bc40
Instruction Fuzzy Hash: 2CE17E31A0EAC2A6EB608F11E4443BA67B1EB947C4F146135EA8DC7AD9DF7CE545CB00

Function 00007FF8A92F1C26 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 143COMMON

Download Yara Rule

Strings

..\s\ssl\t1_enc.c, xrefs: 00007FF8A9352917, 00007FF8A93529D4
, xrefs: 00007FF8A9352A94
, xrefs: 00007FF8A9352AA9
key expansion, xrefs: 00007FF8A9352AA2

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID:
String ID: $ $..\s\ssl\t1_enc.c$key expansion
API String ID: 0-2405982772
Opcode ID: 83c8b71be77f7df1eec28a2096d3371710a9eb22271c69bf8a74428a5bc70789
Instruction ID: a9769e4749e74d3781922f3740c140ee025ff5cf9fcddf7868e73640d11b0d1d
Opcode Fuzzy Hash: 83c8b71be77f7df1eec28a2096d3371710a9eb22271c69bf8a74428a5bc70789
Instruction Fuzzy Hash: F1712932609BC1AAEAA4CF15E4803AD77A4F789B94F449136DA8C47B55CF78D1A9CB00

Function 00007FF7E71D6760 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF7E71D672D), ref: 00007FF7E71D67FA

Part of subcall function 00007FF7E71D6970: GetEnvironmentVariableW.KERNEL32(00007FF7E71D36C7), ref: 00007FF7E71D69AA
Part of subcall function 00007FF7E71D6970: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7E71D69C7

Part of subcall function 00007FF7E71E65E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E65FD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E71D68B1

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

_MEI%d, xrefs: 00007FF7E71D6808
TMP, xrefs: 00007FF7E71D67BE
TMP, xrefs: 00007FF7E71D6798, 00007FF7E71D6859, 00007FF7E71D68E7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7E71D67D8

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 4828d69836246918269f07bf884f0db2084dfee84ed506a5a3d02a588ff47569
Instruction ID: 09ae2a45e22da233d4f2d3778be83b74bc8954915f471c0d8d42bd746dafbb5d
Opcode Fuzzy Hash: 4828d69836246918269f07bf884f0db2084dfee84ed506a5a3d02a588ff47569
Instruction Fuzzy Hash: 8B513F11B1974341ED58BB21F9953BA92519FC5BC1FC85033EE2E8779ADD3CE4034A22

Function 00007FF8A932FAF0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A932FB36
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A932FBA6
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A932FBC6
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932FC2A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932FC40
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932FC69

Strings

..\s\ssl\statem\extensions_cust.c, xrefs: 00007FF8A932FB25, 00007FF8A932FB94, 00007FF8A932FBAF, 00007FF8A932FC1D, 00007FF8A932FC33, 00007FF8A932FC62

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\extensions_cust.c
API String ID: 3962629258-3973221358
Opcode ID: affe7a8860928615d7d6bb568a7be11a3244f159c59a68a1cf976d3fc19fdad4
Instruction ID: e056820b1a786fb225bd0a1cacc999564379563deb4ed00063a9d04fd142d027
Opcode Fuzzy Hash: affe7a8860928615d7d6bb568a7be11a3244f159c59a68a1cf976d3fc19fdad4
Instruction Fuzzy Hash: 5D418C76A0EEA2A1EB11DF06E4406A963B4FB58BC8F456032DE8D87A54EF7CD581C700

Function 00007FF8A92F1ABE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CONF_parse_list.LIBCRYPTO-1_1 ref: 00007FF8A9357BDF
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A9357C2A
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9357C52

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FF8A9357C01, 00007FF8A9357C37, 00007FF8A9357C69

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: F_parse_listO_mallocR_put_error
String ID: ..\s\ssl\t1_lib.c
API String ID: 3458554092-1643863364
Opcode ID: ac8b8fe909902e8189399d8e2bc8a2ca6a7220937294c0f31b619b802e21f1cb
Instruction ID: acdf8f2e1da4fd377a6b01b3432d54f1a718ff8d4d04230a6a3109fc5c40b738
Opcode Fuzzy Hash: ac8b8fe909902e8189399d8e2bc8a2ca6a7220937294c0f31b619b802e21f1cb
Instruction Fuzzy Hash: 3331396661EAC2A9E6609F11A4407AA7365EB48BC4F446535EE8D87B89DF3CE104C710

Function 00007FF8A8083EAE Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A80811B8: GetLastError.KERNEL32 ref: 00007FF8A82741F6
Part of subcall function 00007FF8A80811B8: TlsGetValue.KERNEL32 ref: 00007FF8A8274200
Part of subcall function 00007FF8A80811B8: SetLastError.KERNEL32 ref: 00007FF8A827420B

SwitchToFiber.KERNEL32 ref: 00007FF8A8142D61
CreateFiber.KERNEL32 ref: 00007FF8A8142E47
memmove.VCRUNTIME140 ref: 00007FF8A8142EA3
SwitchToFiber.KERNEL32 ref: 00007FF8A8142EC9

Strings

..\s\crypto\async\async.c, xrefs: 00007FF8A8142C81, 00007FF8A8142C98, 00007FF8A8142CE0, 00007FF8A8142DAB, 00007FF8A8142E75, 00007FF8A8142EE1, 00007FF8A8142F61, 00007FF8A8142FA3, 00007FF8A8142FCB, 00007FF8A8142FF7, 00007FF8A814301F, 00007FF8A8143063
*, xrefs: 00007FF8A8142C9F

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: Fiber$ErrorLastSwitch$CreateValuememmove
String ID: *$..\s\crypto\async\async.c
API String ID: 3019965278-1471988776
Opcode ID: 9a4675109f6970b122752d642c61ba6beee08fc618e2ced65f7d5429860a6a7c
Instruction ID: 0ff142bbe49acf6ca264a8799c9067798c266497a648ec6e53e203922f2bc85f
Opcode Fuzzy Hash: 9a4675109f6970b122752d642c61ba6beee08fc618e2ced65f7d5429860a6a7c
Instruction Fuzzy Hash: 81C14A76A0AB02A6EB21DF21E4006B973A0FF44BC4F444435DA4D47B95EF3CE595C768

Function 00007FF8A92F1A0A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FF8A930543A, 00007FF8A93054EF

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID:
String ID: ..\s\ssl\s3_enc.c
API String ID: 0-1839494539
Opcode ID: 53af206ab619913eb509b0717cfacfc4f5e337eab384399cab100b879777213b
Instruction ID: 7ab39b132f6634ea553f48e071857c5c2a6a5d523b89bf75672024f2578976b4
Opcode Fuzzy Hash: 53af206ab619913eb509b0717cfacfc4f5e337eab384399cab100b879777213b
Instruction Fuzzy Hash: 4A51593670AB81A6EB548F26E0803A977B0FB88BD4F545132DB8C83764DF38D1A5CB00

Function 00007FF8A92F1E6A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A92F8C67
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F8C90

Strings

..\s\ssl\packet.c, xrefs: 00007FF8A92F8C59, 00007FF8A92F8C75, 00007FF8A92F8D2E
b, xrefs: 00007FF8A92F8C7C

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_zallocR_put_error
String ID: ..\s\ssl\packet.c$b
API String ID: 2718799170-1717309047
Opcode ID: be4cdca94e7d478c4cd099306eb04f50834cffcd4a132cb96adbd5621733b7d2
Instruction ID: 05ce83ed8483cac078896fb862787eef97c855844f96e3729a0ae85305d9bb8c
Opcode Fuzzy Hash: be4cdca94e7d478c4cd099306eb04f50834cffcd4a132cb96adbd5621733b7d2
Instruction Fuzzy Hash: 48519E62B0AB85D1EF149F25D540368A3A1EB58BE8F608635CA2D8B7DCEF7CD455C340

Function 00007FF8A934FAF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1 ref: 00007FF8A934FB58
BN_ucmp.LIBCRYPTO-1_1 ref: 00007FF8A934FB87
BN_is_zero.LIBCRYPTO-1_1 ref: 00007FF8A934FB9B
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A934FBC6
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8A934FBDB

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A934FBAF, 00007FF8A934FC59

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: N_bin2bnN_is_zeroN_ucmpO_freeO_strdup
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 3996552382-348624464
Opcode ID: 2e29c1eaaeb594d962e7f54d055b3c6f0ad7c868bd6538970ac661f554f2f118
Instruction ID: eaf648077a69a7b6da88e88a2ac2e0b8b0729e339924d79d3ed45277f52aee22
Opcode Fuzzy Hash: 2e29c1eaaeb594d962e7f54d055b3c6f0ad7c868bd6538970ac661f554f2f118
Instruction Fuzzy Hash: EC419B32B0DA8291EB608F15E8507BD27A1EB84BD8F486231DE5D8BB95DF3CD5908B00

Function 00007FF7E71DB5DC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E71DB5F8
RtlCaptureContext.KERNEL32 ref: 00007FF7E71DB625
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E71DB63F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E71DB680
IsDebuggerPresent.KERNEL32 ref: 00007FF7E71DB6D4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71DB6F5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71DB700

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: fbdfe3cbec041ac85cd1f64ea4b15fcfe09a87be1aa09ac25d8a719fe1a921a3
Instruction ID: 6a170e19de84a04a5a7dd6c2fe6ecb5076a1c8cadb1c545ce46a6b5e4f70cd84
Opcode Fuzzy Hash: fbdfe3cbec041ac85cd1f64ea4b15fcfe09a87be1aa09ac25d8a719fe1a921a3
Instruction Fuzzy Hash: AF314D72608B8186EB64AF60F8803EDA364FB84744F84403ADB5E47A98DF3CD549CB21

Function 00007FF8A930CBB0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FF8A930CBD7
i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FF8A930CBE7
memcmp.VCRUNTIME140 ref: 00007FF8A930CC0C
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A930CC2A
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A930CC41

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FF8A930CC20, 00007FF8A930CC34

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeX509_i2d_$memcmp
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1487052844-349359282
Opcode ID: 0d54214541bcf23eb0ee10e4d06786228e5304979f5289189f05c1cdc1a7dc45
Instruction ID: e5daae72c9f5b247b8be0043037f896bd4c89a8539057634a2f0ffc58c95c24b
Opcode Fuzzy Hash: 0d54214541bcf23eb0ee10e4d06786228e5304979f5289189f05c1cdc1a7dc45
Instruction Fuzzy Hash: 47018866B0EFC265E6109E5AE44016D6772EF8A7C0F257031EE4EC7799DE2DD5418700

Function 00007FF8A9322C70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8A9322CA7
OPENSSL_LH_insert.LIBCRYPTO-1_1 ref: 00007FF8A9322CB3
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FF8A9322D22
OPENSSL_LH_retrieve.LIBCRYPTO-1_1 ref: 00007FF8A9322DD3
OPENSSL_LH_delete.LIBCRYPTO-1_1 ref: 00007FF8A9322DEA
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8A9322E6B

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: H_retrieve$D_unlockD_write_lockH_deleteH_insert
String ID:
API String ID: 2043303102-0
Opcode ID: 0b2c61c28c32f61e8aeebe8b85e0ea8e9d4c7705f77b15f08853708f750b9553
Instruction ID: 1d249bce8554fe068c287c9f14be2d90922daeaa843133bc9ec294f8658b8d30
Opcode Fuzzy Hash: 0b2c61c28c32f61e8aeebe8b85e0ea8e9d4c7705f77b15f08853708f750b9553
Instruction Fuzzy Hash: 4951733260EBC296EB589F219A517B97361EF58BC4F04A031DE1D8BB99DF3CE4508740

Function 00007FF7E71E9A14 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E71E9A8D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E71E9AA5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E71E9AE0
IsDebuggerPresent.KERNEL32 ref: 00007FF7E71E9B19
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71E9B23
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E71E9B2E

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e7141d2691e6fffc336151182819a094942dc067ac16da689744b042d81b35af
Instruction ID: 689917fe3688b6449a1ec3cd6be401314186454e50c72f5225b140fe20e322a4
Opcode Fuzzy Hash: e7141d2691e6fffc336151182819a094942dc067ac16da689744b042d81b35af
Instruction Fuzzy Hash: EF316D32618F8186DB20DB25E8803AAB3A4FBC9754F940136EBAD43B54DF3CD5568B11

Function 00007FF8A92F1B5E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

EVP_PKEY_get1_tls_encodedpoint.LIBCRYPTO-1_1 ref: 00007FF8A932B1E3
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932B262
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A932B2EC
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932B2FF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A932B113, 00007FF8A932B18E, 00007FF8A932B253, 00007FF8A932B2B9

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$Y_freeY_get1_tls_encodedpoint
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 4042585043-592572767
Opcode ID: 689b321e0f310887bf42d705e61584490e506d5b71d6ceb3fa676dc88cfce93c
Instruction ID: f9b087e26918928b11bde39aa3d80099d0ed14e0d6ffaf2008a04c3d1afe8392
Opcode Fuzzy Hash: 689b321e0f310887bf42d705e61584490e506d5b71d6ceb3fa676dc88cfce93c
Instruction Fuzzy Hash: 8B719E21B1EA81A6F7649F16A4403BA66B0FB96BC0F045135EE5D87B99DF3CE5118B00

Function 00007FF8A92F1CE4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A933264E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A933268C
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A93326BE

Strings

c:\a\6\s\ssl\packet_local.h, xrefs: 00007FF8A933265A, 00007FF8A93326AE
..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A933262D, 00007FF8A933272F

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$O_memdup
String ID: ..\s\ssl\statem\extensions_srvr.c$c:\a\6\s\ssl\packet_local.h
API String ID: 3545228654-2319032043
Opcode ID: a9db89fc3a4393c4603ba4af77c309c2cf3142640939f4ded94034632d9d3d29
Instruction ID: e2757958a0fca2a746b4eaead8dc41a171262c2c998803a97ca8e293624bf0d7
Opcode Fuzzy Hash: a9db89fc3a4393c4603ba4af77c309c2cf3142640939f4ded94034632d9d3d29
Instruction Fuzzy Hash: FD517072A1DBC196EA558F15F4402AAB3A0FB84BC4F44A234EAAD57A95DF3CE190C700

Function 00007FF8A931C9D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931CA16
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FF8A931CA6A
CRYPTO_realloc.LIBCRYPTO-1_1 ref: 00007FF8A931CA98
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931CAC2

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931C9FB, 00007FF8A931CA4A, 00007FF8A931CA85, 00007FF8A931CAB2

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_reallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1389097454-1080266419
Opcode ID: 57784ae341cabc3fb45b00ae7efcdcb254fa0e79a603c43839275451e7cbd8f2
Instruction ID: 778158804c083fb0d9d84a37c78c574644cb8c1a3ab894579ffbc356dc0986df
Opcode Fuzzy Hash: 57784ae341cabc3fb45b00ae7efcdcb254fa0e79a603c43839275451e7cbd8f2
Instruction Fuzzy Hash: 6A31D27260EB81A6EB11DF25E8006A977A0FB487C8F545031EE8D877A5EF3CD552D700

Function 00007FF8A933FC60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A933FD49
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A933FD83
CRYPTO_strndup.LIBCRYPTO-1_1 ref: 00007FF8A933FD9B

Strings

c:\a\6\s\ssl\packet_local.h, xrefs: 00007FF8A933FD7C, 00007FF8A933FD8E
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933FCF8, 00007FF8A933FD42, 00007FF8A933FDB9

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$O_strndup
String ID: ..\s\ssl\statem\statem_clnt.c$c:\a\6\s\ssl\packet_local.h
API String ID: 975926931-2921391549
Opcode ID: b36dd589debc4e67587cd1719dfbb70d2eaf0e0f9c496f1b72e335d3229c947a
Instruction ID: b0c38b69bf55b36418489995996e537e2e8cbc2a702d4a29a6420a239e648092
Opcode Fuzzy Hash: b36dd589debc4e67587cd1719dfbb70d2eaf0e0f9c496f1b72e335d3229c947a
Instruction Fuzzy Hash: 0C41AE32B0EE8096E7108F11E5402AEB760FB48BD4F845235EA9D57B99DF3CE1948B00

Function 00007FF8A9356AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A9356B16
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9356B3E
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9356BBF
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9356BD2

Strings

..\s\ssl\t1_lib.c, xrefs: 00007FF8A9356B00, 00007FF8A9356B23, 00007FF8A9356BAA

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$O_mallocR_put_error
String ID: ..\s\ssl\t1_lib.c
API String ID: 2563039504-1643863364
Opcode ID: d13101ef3c74707bca7f0d67daa8aa13aba7377a66ba06b38b97e7e768e7c1be
Instruction ID: 4fc2e184191fa67328e25e9c4d5634598b33940273305bee102b79c028d3234a
Opcode Fuzzy Hash: d13101ef3c74707bca7f0d67daa8aa13aba7377a66ba06b38b97e7e768e7c1be
Instruction Fuzzy Hash: B1316E22A1EEC196EA10DF13E4502A977A5EB48BC8F486831EA8C87B95DF7CE515C710

Function 00007FF8A92F1C44 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

X509_free.LIBCRYPTO-1_1 ref: 00007FF8A930B634
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A930B641
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A930B654
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A930B66D

Strings

..\s\ssl\ssl_cert.c, xrefs: 00007FF8A930B65D

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_pop_freeO_freeX509_freeY_free
String ID: ..\s\ssl\ssl_cert.c
API String ID: 1247630535-349359282
Opcode ID: acc5b18f9e981b8e750a5bec6be30764cd8970e5abda21bfc92aacc97d6dfaf3
Instruction ID: 5f3bc9c2a215e4c67f8ddb703e0b3aa98816ab87c03c5479f3d6a9926f1157e8
Opcode Fuzzy Hash: acc5b18f9e981b8e750a5bec6be30764cd8970e5abda21bfc92aacc97d6dfaf3
Instruction Fuzzy Hash: B6017936A2EF9595EB009F25E4401AC7374FB88F88F042021EA8D97A49CF3CD612C700

Function 00007FF7E71F08E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F0930
FindFirstFileExW.KERNEL32 ref: 00007FF7E71F0A3A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 15b37066209686d126a4855257e5fe5093a8358f256cf270ac53eceea75e82af
Instruction ID: bda1bf0fb724d825237d6aa0043c1f567a7420a176fceb148ac7a232d2f75ef6
Opcode Fuzzy Hash: 15b37066209686d126a4855257e5fe5093a8358f256cf270ac53eceea75e82af
Instruction Fuzzy Hash: 4AB1B226B1979241EA65AB21F4103B9E250FF84BD4F844137EF6E47A85DE3CE552C322

Function 00007FF8A930FB30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1(?,?,?,00000000,00000000,00007FF8A930F67D), ref: 00007FF8A930FB91
ERR_put_error.LIBCRYPTO-1_1(?,?,?,00000000,00000000,00007FF8A930F67D), ref: 00007FF8A930FBB9
CRYPTO_free.LIBCRYPTO-1_1(?,?,?,00000000,00000000,00007FF8A930F67D), ref: 00007FF8A930FCC8

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A930FB7C, 00007FF8A930FB9E, 00007FF8A930FCBE

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_zallocR_put_error
String ID: ..\s\ssl\ssl_ciph.c
API String ID: 3070865948-1847046956
Opcode ID: a2b290529e14009eb144844e16a311d662c57b1b1f157b07e4015953302c0efc
Instruction ID: e6d4b1697d446fcd8ec611d4fd5b5ffe845ebe5c652efd28e7657fcf1ec13134
Opcode Fuzzy Hash: a2b290529e14009eb144844e16a311d662c57b1b1f157b07e4015953302c0efc
Instruction Fuzzy Hash: F3419AB6A0AFA196EA05DF82E4506697BB4FB44BC4F45A436DE4C83390DF3DE991C700

Function 00007FF8A92F193A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A935121A
CRYPTO_memdup.LIBCRYPTO-1_1 ref: 00007FF8A935123F

Strings

c:\a\6\s\ssl\packet_local.h, xrefs: 00007FF8A9351208, 00007FF8A9351233
..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A9351281, 00007FF8A93512B7

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_memdup
String ID: ..\s\ssl\statem\statem_srvr.c$c:\a\6\s\ssl\packet_local.h
API String ID: 3962629258-1351234564
Opcode ID: bc0ceef6d9831f4752099260cd347bc6d4ee7bcb06d4bafff3d6a727154c85a9
Instruction ID: 3c1a38e2b4b50a020d533ef647e24c560404a6b9f6fbdf1845f7710b93eaf6a7
Opcode Fuzzy Hash: bc0ceef6d9831f4752099260cd347bc6d4ee7bcb06d4bafff3d6a727154c85a9
Instruction Fuzzy Hash: 2B41B132A2EFC195EB41CF55E4802A9B3A4FB88B84F446135EA8D87B59DF7CD191C700

Function 00007FF8A92F19EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A9316645
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931666D
CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A93166F6

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931663E, 00007FF8A9316652, 00007FF8A93166EC

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_mallocR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2160744234-1080266419
Opcode ID: 9637861b563e5340c438558d7345f744da8b50f30bbd51d84a37c4a80431b035
Instruction ID: 989a2c6aaade25f1db28a3f994c4ad1be655981bec40169e4e6ea26178a3f969
Opcode Fuzzy Hash: 9637861b563e5340c438558d7345f744da8b50f30bbd51d84a37c4a80431b035
Instruction Fuzzy Hash: A8316D72A0EE8192EE50CF46D4542A867B5FB44BC8FA8A431DB4D877A4EF3DE545C700

Function 00007FF8A9311BD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A9311C7C
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8A9311C91

Part of subcall function 00007FF8A92F175D: ERR_clear_error.LIBCRYPTO-1_1 ref: 00007FF8A9322843
Part of subcall function 00007FF8A92F175D: BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8A932286B
Part of subcall function 00007FF8A92F175D: BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A9322873
Part of subcall function 00007FF8A92F175D: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A932289B
Part of subcall function 00007FF8A92F175D: X509_free.LIBCRYPTO-1_1 ref: 00007FF8A9322A10
Part of subcall function 00007FF8A92F175D: BIO_free.LIBCRYPTO-1_1 ref: 00007FF8A9322A18

Strings

gfffffff, xrefs: 00007FF8A9311C4D
..\s\ssl\ssl_conf.c, xrefs: 00007FF8A9311C75, 00007FF8A9311C87

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free$O_newO_s_fileO_strdupR_clear_errorR_put_errorX509_free
String ID: ..\s\ssl\ssl_conf.c$gfffffff
API String ID: 3738848979-4123734156
Opcode ID: b8212f8930010c400659cc461d09cacaa93ca21df84dc7a567d788256480ddca
Instruction ID: 79086a57708f0c4bc8eeb27838675d228a1ddaaf4f9802b66b4bc38e696f2b9f
Opcode Fuzzy Hash: b8212f8930010c400659cc461d09cacaa93ca21df84dc7a567d788256480ddca
Instruction Fuzzy Hash: E721A166B1AB8595EE44DF67E4802A963A1EB88FC0F186035DF4DC7759EE28E5108341

Function 00007FF8A92F7E20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A92F7E62
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F7E8B

Strings

..\s\ssl\packet.c, xrefs: 00007FF8A92F7E48, 00007FF8A92F7E70
b, xrefs: 00007FF8A92F7E77

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_zallocR_put_error
String ID: ..\s\ssl\packet.c$b
API String ID: 2718799170-1717309047
Opcode ID: 2dd786a1ad79b9d2127fbe9555d9e97981593222be29afc57f25c38cfecdaedd
Instruction ID: f56f597ebfd63cc04b6876c118b87c9b418614f919e4e4a198a7ed5575642368
Opcode Fuzzy Hash: 2dd786a1ad79b9d2127fbe9555d9e97981593222be29afc57f25c38cfecdaedd
Instruction Fuzzy Hash: 2B01D63260AB8196EB00CF19F44015873B0FB48798FA44235D76C477D9EF79D965C700

Function 00007FF8A808734C Relevance: 6.4, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A82203FB
memset.VCRUNTIME140 ref: 00007FF8A8220412
memmove.VCRUNTIME140 ref: 00007FF8A8220439
memset.VCRUNTIME140 ref: 00007FF8A8220446
memmove.VCRUNTIME140 ref: 00007FF8A822047A

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: c2d83c62b047308c6ebeacc94b43f164426b5dc8fd334861661ea7d4dc674f57
Instruction ID: d494e9ce798e3481641dd6090bfc1d647228079f6e7fc49394c8b523d2bd8352
Opcode Fuzzy Hash: c2d83c62b047308c6ebeacc94b43f164426b5dc8fd334861661ea7d4dc674f57
Instruction Fuzzy Hash: 3551E032B1AB8596EB10DB16E4402AEBBA4FB49BD0F444135EE9D0779AEF3CE111C714

Function 00007FF8A808380F Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 304COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8254165
memmove.VCRUNTIME140 ref: 00007FF8A825419F

Strings

..\s\crypto\rsa\rsa_oaep.c, xrefs: 00007FF8A82540BB, 00007FF8A82540EA, 00007FF8A82541B9, 00007FF8A82541DC, 00007FF8A8254477
W, xrefs: 00007FF8A82541E3

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmovememset
String ID: ..\s\crypto\rsa\rsa_oaep.c$W
API String ID: 1288253900-622388702
Opcode ID: 2f37320f5229224b650b91542c54f3efc5ba7ea10b03566c097ec46cb342a241
Instruction ID: 47526e33ae4712e9301e2736814c1666259bb332e368e8472cc4ac0518d0c2d7
Opcode Fuzzy Hash: 2f37320f5229224b650b91542c54f3efc5ba7ea10b03566c097ec46cb342a241
Instruction Fuzzy Hash: BAC1F162A5AAC295EB14CF28E4006BAB7A0FB85BC4F505236EF8D53B49EF3CD145C714

Function 00007FF8A92F1B95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932E580
CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A932E5AC

Part of subcall function 00007FF8A9329B10: memcpy.VCRUNTIME140(..\s\ssl\statem\extensions_clnt.c,00007FF8A932E5CB), ref: 00007FF8A9329B38

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A932E569, 00007FF8A932E634

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_mallocmemcpy
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2350084802-592572767
Opcode ID: 45b4ba2e1662a190e2bc1949bd40f922b4dc0c8d39e7c335c220f934004521d8
Instruction ID: f17d60030143370c389bdcf08a52038a1bbd80f589c0ca96e4787dd1e57fc74b
Opcode Fuzzy Hash: 45b4ba2e1662a190e2bc1949bd40f922b4dc0c8d39e7c335c220f934004521d8
Instruction Fuzzy Hash: 3C31B061A1EEC191F7608F12E8007AA63A5EF94BC4F185035EE4D9BB99DE7CE5528B00

Function 00007FF8A92F6BE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A92F2400: CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A92F97C4
Part of subcall function 00007FF8A92F2400: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F97EC

Part of subcall function 00007FF8A92F16E5: CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A9307DA4

CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A92F6C2C

Part of subcall function 00007FF8A92F2261: CRYPTO_zalloc.LIBCRYPTO-1_1 ref: 00007FF8A92F906D
Part of subcall function 00007FF8A92F2261: ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F9095

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A92F6CCD

Strings

..\s\ssl\d1_lib.c, xrefs: 00007FF8A92F6C20, 00007FF8A92F6CC3

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_zalloc$R_put_error$O_freeO_malloc
String ID: ..\s\ssl\d1_lib.c
API String ID: 566506930-490761327
Opcode ID: 9ca5090f9d716170096f0ce73f5949a22c45de7a6bc220b66189022f8c3d996a
Instruction ID: d91392226d68de6d4b798e53d8b12cb2cfc7dace0aa64254e3925b077c6911ca
Opcode Fuzzy Hash: 9ca5090f9d716170096f0ce73f5949a22c45de7a6bc220b66189022f8c3d996a
Instruction Fuzzy Hash: 27213021B0E6C6A1FE489F65E5953B96290EF49BC4F441038DAAD8778EDF6DE4708700

Function 00007FF8A92F1E60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

CRYPTO_clear_free.LIBCRYPTO-1_1 ref: 00007FF8A933A3CA

Strings

4, xrefs: 00007FF8A933A37B
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933A324

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_clear_free
String ID: ..\s\ssl\statem\statem_clnt.c$4
API String ID: 2011826501-211860627
Opcode ID: 58b52a5321839af1a7ab7c6cb3a8c50541dfb00ada8d97ad2764f8d7fddd49de
Instruction ID: c7ed1973cb9ef104e3fceea06d82595a869099bd6ff190cfe973868c63a7b4c1
Opcode Fuzzy Hash: 58b52a5321839af1a7ab7c6cb3a8c50541dfb00ada8d97ad2764f8d7fddd49de
Instruction Fuzzy Hash: 57218822B0EB82A5F7609E12E5803BA77A5EB45FD4F084039DE8D8779ADF6CE1418700

Function 00007FF8A8085DB7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF8A8149CF9
WSAGetLastError.WS2_32 ref: 00007FF8A8149D08

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A8149CAE, 00007FF8A8149D1E, 00007FF8A8149D3A

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: 35390e90907e062d5cd2ce9504e4d1041d64cbb7bd1b5a00adced805f3e8df7a
Instruction ID: ce9bd7c0ef8ca4d15768180e97149315cbb6512610a9b0a1e51fb0a9e005a1a5
Opcode Fuzzy Hash: 35390e90907e062d5cd2ce9504e4d1041d64cbb7bd1b5a00adced805f3e8df7a
Instruction Fuzzy Hash: 5021D131B1A64296EB10CB25E8042AD77A0FB81BC4F000131EA4D43BD9EF7CE592CB18

Function 00007FF8A92F1CD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A92FFE94
COMP_expand_block.LIBCRYPTO-1_1 ref: 00007FF8A92FFEBD

Strings

..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A92FFE88

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_mallocP_expand_block
String ID: ..\s\ssl\record\ssl3_record.c
API String ID: 3543690440-2721125279
Opcode ID: ba959f7fdcc2f356148cfce927090e3c0448d500e6ffe04f2bc148faf0d17774
Instruction ID: 50675401fee432cd76a69ee802871e017ac15484b03edae188f9a20ae8b30c5d
Opcode Fuzzy Hash: ba959f7fdcc2f356148cfce927090e3c0448d500e6ffe04f2bc148faf0d17774
Instruction Fuzzy Hash: EC0152A6B1EB9296EB508F25F44026962A4FB4CBC8F145035DF5CCB78EEF2DD5608704

Function 00007FF8A92F1C0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932397D
CRYPTO_strdup.LIBCRYPTO-1_1 ref: 00007FF8A93239AE

Strings

..\s\ssl\ssl_sess.c, xrefs: 00007FF8A9323970, 00007FF8A93239A4

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_freeO_strdup
String ID: ..\s\ssl\ssl_sess.c
API String ID: 2148955802-2868363209
Opcode ID: f8f25a26be1ccc350fabe71cb1167f66a4b4f3b5637e67c04e42aafb41beb779
Instruction ID: 127afac3759e04e561d25addd190899cd1eacd662c0ec7923abfc01857a31908
Opcode Fuzzy Hash: f8f25a26be1ccc350fabe71cb1167f66a4b4f3b5637e67c04e42aafb41beb779
Instruction Fuzzy Hash: 71F0F962B0DE8161EB44CF16E5843A82261EF48BD4F08A031DD5C87B59EE2CD6914700

Function 00007FF8A92F8E30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A92F8E57
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F8E7F

Strings

..\s\ssl\pqueue.c, xrefs: 00007FF8A92F8E4D, 00007FF8A92F8E64

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_mallocR_put_error
String ID: ..\s\ssl\pqueue.c
API String ID: 2513334388-354262084
Opcode ID: e31f72ea1b36cf0ac14925aa0d799ea5a93a8d865535a0a2e7d1d0eae8c28d26
Instruction ID: 77cf1e77f0680b2f1c32a7b248d44f8274725fff6d6961a6bb352961ef554621
Opcode Fuzzy Hash: e31f72ea1b36cf0ac14925aa0d799ea5a93a8d865535a0a2e7d1d0eae8c28d26
Instruction Fuzzy Hash: 87014F7660EA8296EB408F15E4557A97370EB487C8F545035DB5C83759EF3CD558CB00

Function 00007FF8A92F1B4A Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_write_lock.LIBCRYPTO-1_1 ref: 00007FF8A9322F45
OPENSSL_LH_set_down_load.LIBCRYPTO-1_1 ref: 00007FF8A9322F7C
CRYPTO_THREAD_unlock.LIBCRYPTO-1_1 ref: 00007FF8A9322F88

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: D_unlockD_write_lockH_set_down_load
String ID:
API String ID: 3243170206-0
Opcode ID: f606dac38b3917855ba4827b18e1b540f37aef6f658be1799653543066500e3b
Instruction ID: 648e4037d765dc3f70fd189f2a98c0c3f2c19ef6bc319754d77d0399ca2b60de
Opcode Fuzzy Hash: f606dac38b3917855ba4827b18e1b540f37aef6f658be1799653543066500e3b
Instruction Fuzzy Hash: E3014C26A0EEC2A6DB15EF52E8410A86370FB8C794F046131FA4DC7B56DE7CE5218700

Function 00007FF8A92F19BA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-1_1 ref: 00007FF8A933C8DA

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933C8C7, 00007FF8A933C941, 00007FF8A933C968

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_malloc
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 1457121658-1507966698
Opcode ID: 3f9792a0efeb992445758e3192719c2ef08d9b5cc60118a7a673352ab647ebb5
Instruction ID: 62d700458f170b1e74166bf2e559aab4c41c90038a332a58b9cb8b0c85d53a2b
Opcode Fuzzy Hash: 3f9792a0efeb992445758e3192719c2ef08d9b5cc60118a7a673352ab647ebb5
Instruction Fuzzy Hash: 4A31B332B0EAC19AE7108F11E4402AEB7A1EB86BD4F484235DE9D97B85DF3CD261D704

Function 00007FF8A92F1AB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A932A675

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A932A5F2

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2581946324-592572767
Opcode ID: 07ccf8321cc0bcd302b93af1c40fba0edb938f896ced2fc56674020ae6875cd2
Instruction ID: 0f454a681ce5f529c2c7e75a9fcb0384f29a8e6c6d479a685efcf6f41d1511bd
Opcode Fuzzy Hash: 07ccf8321cc0bcd302b93af1c40fba0edb938f896ced2fc56674020ae6875cd2
Instruction Fuzzy Hash: 9F216D22B0DA8192F7209F26E5443AE63A0EB54BC4F540131DE5CDBBCADF7DE9518B90

Function 00007FF8A92F8B20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A92F8BE9

Strings

..\s\ssl\packet.c, xrefs: 00007FF8A92F8BD5

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\packet.c
API String ID: 2581946324-1434567093
Opcode ID: b6bc9af57779ca1e9dbc4af6b4d05fc903e4fd731e7e390f42f5b7156448b61e
Instruction ID: 4984740b090591c87765c8067392ed45bf12a9744a74a25d4e0ea01e2f193c03
Opcode Fuzzy Hash: b6bc9af57779ca1e9dbc4af6b4d05fc903e4fd731e7e390f42f5b7156448b61e
Instruction Fuzzy Hash: ED21AEB6B1AB85C2EF548F19C098A7863A4FB59BC0F518435DA2DC7348EEBAD411C300

Function 00007FF8A92F7BD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-1_1 ref: 00007FF8A92F7C00

Strings

..\s\ssl\packet.c, xrefs: 00007FF8A92F7BF3

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free
String ID: ..\s\ssl\packet.c
API String ID: 2581946324-1434567093
Opcode ID: 7c50d8f0ba1a7a3073c4a55f25a47ca7e10264c4c1015fbf867f927ae6a625a8
Instruction ID: ae4a88a753acaeaa13bb204cc8ff9aa366b933f2dcdb169d9cca888b9664d5ad
Opcode Fuzzy Hash: 7c50d8f0ba1a7a3073c4a55f25a47ca7e10264c4c1015fbf867f927ae6a625a8
Instruction Fuzzy Hash: DDE06D26B1EA8191FE549F46E4807686224EF58BC8F581135EE5C8778ADE6CD4608700

Function 00007FF8A930CB50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CRYPTO_get_ex_new_index.LIBCRYPTO-1_1 ref: 00007FF8A930CB7A

Strings

SSL for verify callback, xrefs: 00007FF8A930CB61

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_get_ex_new_index
String ID: SSL for verify callback
API String ID: 3987194240-2900698531
Opcode ID: f51499cff9a83a22f9968298af60ac8a300ed78a9b69b7e6e570d30f8decd514
Instruction ID: d3465ac4fc02c241951525331870522d4bb788786b53853f5b19338bbc927e69
Opcode Fuzzy Hash: f51499cff9a83a22f9968298af60ac8a300ed78a9b69b7e6e570d30f8decd514
Instruction Fuzzy Hash: FAE09B76E1F682DBE3019F64A8416A53274FB48340F95A439D94CC3655EF3CA115C610

Function 00007FF8A9329B90 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CRYPTO_memcmp.LIBCRYPTO-1_1 ref: 00007FF8A9329BAD

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_memcmp
String ID:
API String ID: 2788248766-0
Opcode ID: b821739bf41882c788a30fe547ac76a5c952d59757a194cc0ce35549cf9ceaef
Instruction ID: adf8dccd3cc42df6ec75726d07269a7cff237b2cdf711423be589ae4a104e475
Opcode Fuzzy Hash: b821739bf41882c788a30fe547ac76a5c952d59757a194cc0ce35549cf9ceaef
Instruction Fuzzy Hash: 65D0A716F0B48281E748B6398D8607801D0DB843C0FD46034E10DC1681CD0DD5A64600

Function 00007FF8A930A970 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CRYPTO_THREAD_run_once.LIBCRYPTO-1_1 ref: 00007FF8A930A98B

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: D_run_once
String ID:
API String ID: 1403826838-0
Opcode ID: f4b6871b7433c0faec20ec73b7d0caaeb04d9942fddb85c65eb6b7234c581e2f
Instruction ID: 1b2efaa6be2b81c0b4aa4951617460af5bd701d67e4fb621c53b2810af601b4e
Opcode Fuzzy Hash: f4b6871b7433c0faec20ec73b7d0caaeb04d9942fddb85c65eb6b7234c581e2f
Instruction Fuzzy Hash: 72E08625F0F8C7A6FA449F28D85127532B0EF40390F40A139E01DC21E9DE5CB8048700

Function 00007FF8A80863C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91be93352dc54059d33bb3b406534d6871a2dd302eaa749a2147357a45e61270
Instruction ID: 89d04d8f6a411725a247221cd42a998276fb5759e50b812b1aaea71e8b1a24fc
Opcode Fuzzy Hash: 91be93352dc54059d33bb3b406534d6871a2dd302eaa749a2147357a45e61270
Instruction Fuzzy Hash: 0FF0BE323282A105CB96CE36A408FA92DD19B91BC8F62C034E90CC3F44FA2ED602CF40

Function 00007FF8A8086500 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7484b961f24d436ea4a663d67c740c7ec9c146fb940ac0e1b2f2e6048ab68ed0
Instruction ID: 98ec782c8745c62080367ab3984405f73a2a5ce9ea827df6d8cd2586bf496b0e
Opcode Fuzzy Hash: 7484b961f24d436ea4a663d67c740c7ec9c146fb940ac0e1b2f2e6048ab68ed0
Instruction Fuzzy Hash: 2BE01A727193A445D797CE366508E696A95AB15BC5F83C034D90DC3E45FA2E9602CF40

Function 00007FF8A8083251 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdbc3210aa16de0059b573af646bfd538959d584be44528a6ba273ed2b96be26
Instruction ID: 84d25ab10be63f7d7b01210c3ea040ef6e207cfdfcec3ced57390aa2cf5224ba
Opcode Fuzzy Hash: bdbc3210aa16de0059b573af646bfd538959d584be44528a6ba273ed2b96be26
Instruction Fuzzy Hash: 8CA002F4B25555396E650261238137406435A483C6CE294B49479115445B1CA150D164

Function 00007FF7E71D3DD0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3DE6
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E25
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E4A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E6F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3E97
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3EBF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3EE7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3F0F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D3F37

Strings

Py_UTF8Mode, xrefs: 00007FF7E71D3F5D
Py_OptimizeFlag, xrefs: 00007FF7E71D3EDD
PyErr_Print, xrefs: 00007FF7E71D4165
PyList_New, xrefs: 00007FF7E71D42A5
Failed to get address for PyList_Append, xrefs: 00007FF7E71D4299
PyImport_ImportModule, xrefs: 00007FF7E71D4255
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7E71D3E37
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7E71D3F49
Failed to get address for PyMem_RawFree, xrefs: 00007FF7E71D4591
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7E71D45B9
GetProcAddress, xrefs: 00007FF7E71D3DFF
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7E71D4271
PyUnicode_AsUTF8, xrefs: 00007FF7E71D4615
Failed to get address for PyList_New, xrefs: 00007FF7E71D42C1
PyObject_GetAttrString, xrefs: 00007FF7E71D4395
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7E71D3DF8
Failed to get address for PyModule_GetDict, xrefs: 00007FF7E71D4311
Py_GetPath, xrefs: 00007FF7E71D4075
PyImport_ExecCodeModule, xrefs: 00007FF7E71D422D
PyImport_AddModule, xrefs: 00007FF7E71D4205
PySys_GetObject, xrefs: 00007FF7E71D445D
PyObject_SetAttrString, xrefs: 00007FF7E71D436D
PyDict_GetItemString, xrefs: 00007FF7E71D40ED
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7E71D3F21
Failed to get address for Py_SetPath, xrefs: 00007FF7E71D4069
Failed to get address for PySys_GetObject, xrefs: 00007FF7E71D4479
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7E71D3E65
PyLong_AsLong, xrefs: 00007FF7E71D42CD
Failed to get address for PyErr_Fetch, xrefs: 00007FF7E71D41A9
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7E71D45E1
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7E71D3E81
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7E71D4631
PySys_AddWarnOption, xrefs: 00007FF7E71D440D
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7E71D4609
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7E71D3EF9
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7E71D4519
PyObject_CallFunctionObjArgs, xrefs: 00007FF7E71D4345
Failed to get address for Py_IncRef, xrefs: 00007FF7E71D4019
Py_DecRef, xrefs: 00007FF7E71D3FAD
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7E71D4401
Py_DontWriteBytecodeFlag, xrefs: 00007FF7E71D3DDF
Failed to get address for Py_Initialize, xrefs: 00007FF7E71D4041
Failed to get address for Py_DecRef, xrefs: 00007FF7E71D3FC9
Failed to get address for PyUnicode_Join, xrefs: 00007FF7E71D4659
Py_NoSiteFlag, xrefs: 00007FF7E71D3E8D
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7E71D4249
Failed to get address for PySys_SetPath, xrefs: 00007FF7E71D44C9
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7E71D3E5C
Failed to get address for PyErr_Clear, xrefs: 00007FF7E71D4131
Failed to get address for PyObject_Str, xrefs: 00007FF7E71D43D9
PySys_SetArgvEx, xrefs: 00007FF7E71D4435
Py_VerboseFlag, xrefs: 00007FF7E71D3F05
PyEval_EvalCode, xrefs: 00007FF7E71D44D5
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7E71D4681
Py_FileSystemDefaultEncoding, xrefs: 00007FF7E71D3E1B
PyErr_Restore, xrefs: 00007FF7E71D41B5
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7E71D40E1
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7E71D4429
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7E71D4569
PySys_SetPath, xrefs: 00007FF7E71D44AD
PyUnicode_DecodeFSDefault, xrefs: 00007FF7E71D45ED
Py_Finalize, xrefs: 00007FF7E71D3FD5
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7E71D4541
Py_SetProgramName, xrefs: 00007FF7E71D409D
Py_NoUserSiteDirectory, xrefs: 00007FF7E71D3EB5
PyModule_GetDict, xrefs: 00007FF7E71D42F5
PyErr_Clear, xrefs: 00007FF7E71D4115
PyUnicode_Replace, xrefs: 00007FF7E71D4665
Failed to get address for Py_BuildValue, xrefs: 00007FF7E71D3FA1
PyUnicode_FromFormat, xrefs: 00007FF7E71D459D
PyErr_Fetch, xrefs: 00007FF7E71D418D
Failed to get address for PyImport_AddModule, xrefs: 00007FF7E71D4221
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7E71D44F1
PyUnicode_FromString, xrefs: 00007FF7E71D4525
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7E71D43B1
Failed to get address for PyErr_Print, xrefs: 00007FF7E71D4181
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7E71D4389
PyMem_RawFree, xrefs: 00007FF7E71D4575
PyErr_Occurred, xrefs: 00007FF7E71D413D
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7E71D4451
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7E71D3EA9
Failed to get address for Py_UTF8Mode, xrefs: 00007FF7E71D3F79
Py_BuildValue, xrefs: 00007FF7E71D3F85
Failed to get address for PyLong_AsLong, xrefs: 00007FF7E71D42E9
Failed to get address for Py_SetProgramName, xrefs: 00007FF7E71D40B9
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7E71D41F9
Py_Initialize, xrefs: 00007FF7E71D4025
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7E71D4339
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7E71D4109
Py_FrozenFlag, xrefs: 00007FF7E71D3E40
Py_SetPythonHome, xrefs: 00007FF7E71D40C5
Py_SetPath, xrefs: 00007FF7E71D404D
Failed to get address for PyErr_Occurred, xrefs: 00007FF7E71D4159
PyMarshal_ReadObjectFromString, xrefs: 00007FF7E71D44FD
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7E71D4361
PySys_SetObject, xrefs: 00007FF7E71D4485
Py_DecodeLocale, xrefs: 00007FF7E71D454D
PyObject_CallFunction, xrefs: 00007FF7E71D431D
PyRun_SimpleStringFlags, xrefs: 00007FF7E71D43E5
Py_UnbufferedStdioFlag, xrefs: 00007FF7E71D3F2D
PyUnicode_Decode, xrefs: 00007FF7E71D45C5
Failed to get address for Py_Finalize, xrefs: 00007FF7E71D3FF1
PyErr_NormalizeException, xrefs: 00007FF7E71D41DD
Py_IncRef, xrefs: 00007FF7E71D3FFD
PyUnicode_Join, xrefs: 00007FF7E71D463D
Failed to get address for PyErr_Restore, xrefs: 00007FF7E71D41D1
PyList_Append, xrefs: 00007FF7E71D427D
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7E71D3ED1
Failed to get address for PySys_SetObject, xrefs: 00007FF7E71D44A1
Failed to get address for Py_GetPath, xrefs: 00007FF7E71D4091
PyObject_Str, xrefs: 00007FF7E71D43BD

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
Instruction ID: df834e17569ee106f6798792afafe4d72a3a9553cfdd4f5c3a2d3814bb851c56
Opcode Fuzzy Hash: 6e6539b2492bcb566142f8ce84d8e1d9cc234e654b2aa916a41ae674904a9854
Instruction Fuzzy Hash: C142E975A0AF0391EA19FB24F890374A3B5AF85785BD45033CA2E06264EF7CF517C626

Function 00007FF7E71D55B0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D7120: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7E71D309E), ref: 00007FF7E71D7143

GetProcAddress.KERNEL32 ref: 00007FF7E71D5F47
GetProcAddress.KERNEL32 ref: 00007FF7E71D5F86
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FAB
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FD0
GetProcAddress.KERNEL32 ref: 00007FF7E71D5FF8
GetProcAddress.KERNEL32 ref: 00007FF7E71D6020
GetProcAddress.KERNEL32 ref: 00007FF7E71D6048
GetProcAddress.KERNEL32 ref: 00007FF7E71D6070
GetProcAddress.KERNEL32 ref: 00007FF7E71D6098

Strings

Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7E71D6302
Tcl_GetString, xrefs: 00007FF7E71D6246
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7E71D6172
Tcl_Init, xrefs: 00007FF7E71D5F40
Tcl_FindExecutable, xrefs: 00007FF7E71D5FA1
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7E71D605A
Tcl_MutexLock, xrefs: 00007FF7E71D60B6
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7E71D61EA
Tcl_NewByteArrayObj, xrefs: 00007FF7E71D6296
Tcl_SetVar2, xrefs: 00007FF7E71D61F6
Tcl_ConditionWait, xrefs: 00007FF7E71D6156
Tcl_CreateObjCommand, xrefs: 00007FF7E71D621E
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7E71D60FA
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7E71D614A
Tcl_CreateInterp, xrefs: 00007FF7E71D5F7C
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7E71D619A
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7E71D60D2
GetProcAddress, xrefs: 00007FF7E71D5F60
Tcl_NewStringObj, xrefs: 00007FF7E71D626E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7E71D61C2
Tcl_EvalFile, xrefs: 00007FF7E71D630E
Tcl_Finalize, xrefs: 00007FF7E71D5FEE
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7E71D62DA
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7E71D6122
Tcl_ConditionNotify, xrefs: 00007FF7E71D612E
Failed to get address for Tcl_Init, xrefs: 00007FF7E71D5F59
Failed to get address for Tk_Init, xrefs: 00007FF7E71D63F2
Tcl_FinalizeThread, xrefs: 00007FF7E71D6016
Tk_GetNumMainWindows, xrefs: 00007FF7E71D63FE
Tcl_EvalEx, xrefs: 00007FF7E71D6336
Failed to get address for Tcl_GetString, xrefs: 00007FF7E71D6262
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7E71D637A
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7E71D5FBD
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7E71D60AA
Tcl_ThreadAlert, xrefs: 00007FF7E71D61A6
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7E71D623A
Tcl_Free, xrefs: 00007FF7E71D63AE
Tcl_DoOneEvent, xrefs: 00007FF7E71D5FC6
Tcl_MutexUnlock, xrefs: 00007FF7E71D60DE
Failed to get address for Tcl_Free, xrefs: 00007FF7E71D63CA
Tcl_ConditionFinalize, xrefs: 00007FF7E71D6106
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7E71D641A
Tcl_GetVar2, xrefs: 00007FF7E71D61CE
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7E71D6082
Failed to get address for Tcl_EvalEx, xrefs: 00007FF7E71D6352
Failed to get address for Tcl_Alloc, xrefs: 00007FF7E71D63A2
Tcl_GetCurrentThread, xrefs: 00007FF7E71D608E
Tcl_CreateThread, xrefs: 00007FF7E71D6066
Tcl_ThreadQueueEvent, xrefs: 00007FF7E71D617E
Tcl_DeleteInterp, xrefs: 00007FF7E71D603E
Tcl_EvalObjv, xrefs: 00007FF7E71D635E
Tcl_Alloc, xrefs: 00007FF7E71D6386
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7E71D6032
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7E71D62B2
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7E71D5FE2
Failed to get address for Tcl_Finalize, xrefs: 00007FF7E71D600A
Tk_Init, xrefs: 00007FF7E71D63D6
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF7E71D55FA
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7E71D6212
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7E71D628A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7E71D5F98
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7E71D632A
Tcl_SetVar2Ex, xrefs: 00007FF7E71D62BE
Tcl_GetObjResult, xrefs: 00007FF7E71D62E6

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
Instruction ID: a6a6f7c2f1052388bc12e8ac0ec233fdad21ad056fb5a60da5f625dbbcc32115
Opcode Fuzzy Hash: a7ac00ce1a7fdfc215a9c78db55a5cef2ac37261bb2bde1204b0c918028e9db3
Instruction Fuzzy Hash: 16E1BB64A09B0390EA19FF14F890374E3B5BF85781BD85037D62D06258EF7CA566E732

Function 00007FF8A92F1E5B Relevance: 63.4, APIs: 19, Strings: 17, Instructions: 441COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_reset.LIBCRYPTO-1_1 ref: 00007FF8A93592E0
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A93592FF
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A93593E4
EVP_CIPHER_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A9359401

Part of subcall function 00007FF8A9358F00: EVP_MD_size.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FF8A935B05F), ref: 00007FF8A9358F71
Part of subcall function 00007FF8A9358F00: OPENSSL_cleanse.LIBCRYPTO-1_1(?,?,?,?,?,00000374,00000000,?,00007FF8A935B05F), ref: 00007FF8A9359174

memcpy.VCRUNTIME140 ref: 00007FF8A93597F6
memcpy.VCRUNTIME140 ref: 00007FF8A9359815
memcpy.VCRUNTIME140 ref: 00007FF8A93598FB
memcpy.VCRUNTIME140 ref: 00007FF8A935998C
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A9359A36

Strings

c ap traffic, xrefs: 00007FF8A93593A2, 00007FF8A935981A, 00007FF8A9359880
s hs traffic, xrefs: 00007FF8A93593A9, 00007FF8A93597FB
CLIENT_TRAFFIC_SECRET_0, xrefs: 00007FF8A9359754
finished, xrefs: 00007FF8A93599C0
res master, xrefs: 00007FF8A935983D
e exp master, xrefs: 00007FF8A9359647
..\s\ssl\tls13_enc.c, xrefs: 00007FF8A9359320, 00007FF8A935949E, 00007FF8A9359503, 00007FF8A9359541, 00007FF8A9359571, 00007FF8A935968E, 00007FF8A93596DC
CLIENT_EARLY_TRAFFIC_SECRET, xrefs: 00007FF8A935946D
EXPORTER_SECRET, xrefs: 00007FF8A935995B
SERVER_TRAFFIC_SECRET_0, xrefs: 00007FF8A9359426
exp master, xrefs: 00007FF8A9359917
s ap traffic, xrefs: 00007FF8A9359386, 00007FF8A93597DC, 00007FF8A93598DB
CLIENT_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FF8A935973B
c e traffic, xrefs: 00007FF8A935939B, 00007FF8A9359A04
c hs traffic, xrefs: 00007FF8A9359730
EARLY_EXPORTER_SECRET, xrefs: 00007FF8A93596B3
SERVER_HANDSHAKE_TRAFFIC_SECRET, xrefs: 00007FF8A93593EC

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: memcpy$D_sizeL_cleanseX_new$X_reset
String ID: ..\s\ssl\tls13_enc.c$CLIENT_EARLY_TRAFFIC_SECRET$CLIENT_HANDSHAKE_TRAFFIC_SECRET$CLIENT_TRAFFIC_SECRET_0$EARLY_EXPORTER_SECRET$EXPORTER_SECRET$SERVER_HANDSHAKE_TRAFFIC_SECRET$SERVER_TRAFFIC_SECRET_0$c ap traffic$c e traffic$c hs traffic$e exp master$exp master$finished$res master$s ap traffic$s hs traffic
API String ID: 2058625460-2823458745
Opcode ID: db609c6c8deeb89e8909843a7604ed277eb9418176f103e5ccd6e9f9fd9f1469
Instruction ID: 2af38a2eae7bcd826dd199aa892ca41fc6c3338b6512f48c4d7220a352214078
Opcode Fuzzy Hash: db609c6c8deeb89e8909843a7604ed277eb9418176f103e5ccd6e9f9fd9f1469
Instruction Fuzzy Hash: 41220931A0EFC2A9EA149F11E9402A973B4FB487C8F942135DA4E97B99DF3CE555C700

Function 00007FF8A8230500 Relevance: 49.7, APIs: 19, Strings: 14, Instructions: 220stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230551
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230568
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A823057F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82305B3
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A823061F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230656
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82306B7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82306CA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82306E1
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82306F4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A823070B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A823071E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230735
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230748
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A823075F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230772
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A8230789
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82307C2
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A8231139,?,?,?,?,?,?,?,?,00007FF8A822F16B), ref: 00007FF8A82307F2

Strings

TRUSTED CERTIFICATE, xrefs: 00007FF8A823073E, 00007FF8A8230768
PRIVATE KEY, xrefs: 00007FF8A8230575, 00007FF8A82305A5
CMS, xrefs: 00007FF8A82307F7
PKCS7, xrefs: 00007FF8A8230790
DH PARAMETERS, xrefs: 00007FF8A82306C0
X9.42 DH PARAMETERS, xrefs: 00007FF8A82306AD
PARAMETERS, xrefs: 00007FF8A8230615, 00007FF8A8230648
CERTIFICATE REQUEST, xrefs: 00007FF8A8230714
NEW CERTIFICATE REQUEST, xrefs: 00007FF8A8230701
ENCRYPTED PRIVATE KEY, xrefs: 00007FF8A823055E
ANY PRIVATE KEY, xrefs: 00007FF8A8230547
PKCS #7 SIGNED DATA, xrefs: 00007FF8A82307B8
CERTIFICATE, xrefs: 00007FF8A82306EA, 00007FF8A823072B, 00007FF8A823077F, 00007FF8A82307E8
X509 CERTIFICATE, xrefs: 00007FF8A82306D7, 00007FF8A8230755

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strcmp
String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
API String ID: 1004003707-1119032718
Opcode ID: e96e50dfe5be6d1c7c9960577af54c11fa2c3ded3e85e935ba270c856fe7af02
Instruction ID: 4c44a715ec2223e6893e66a4a08c06ac7685c3a96035a378660a145b681acb81
Opcode Fuzzy Hash: e96e50dfe5be6d1c7c9960577af54c11fa2c3ded3e85e935ba270c856fe7af02
Instruction Fuzzy Hash: 8191DE14E0FB03B5FEA1AB2995602F82391EF15BD0F881134D98E462D9EF1CF942867D

Function 00007FF8A9304C10 Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304C59
EVP_MD_CTX_new.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304C61
EVP_sha1.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304CBE
EVP_DigestInit_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304CCC
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304CE4
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D03
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D27
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D4B
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D63
EVP_md5.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D70
EVP_DigestInit_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D7E
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304D9D
EVP_DigestUpdate.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304DB8
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304DD8
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304DEF
EVP_DigestFinal_ex.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304DF9
OPENSSL_cleanse.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304E61
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304EA0
EVP_MD_CTX_free.LIBCRYPTO-1_1(?,00000000,?,?,?,00000000,00000000,00007FF8A9305591), ref: 00007FF8A9304EA8

Strings

", xrefs: 00007FF8A9304E70
..\s\ssl\s3_enc.c, xrefs: 00007FF8A9304E7E

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Digest$Update$Final_ex$Init_exX_freeX_new$L_cleanseP_md5P_sha1memcpy
String ID: "$..\s\ssl\s3_enc.c
API String ID: 3423753248-2057130634
Opcode ID: e48550a0552d9e743465992cf9c39823a33f7a444df1cab1816d86f67504a963
Instruction ID: 9b2eece45dd7db23f2fb28029a1790b31b41b54e4802100f5db48b9a021cad3b
Opcode Fuzzy Hash: e48550a0552d9e743465992cf9c39823a33f7a444df1cab1816d86f67504a963
Instruction Fuzzy Hash: 2561D462B0EAC279F6609E5AD444BBA7A60EF457C8F447035EE4D87B86EE3CD641C700

Function 00007FF8A935A9E0 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 218COMMON

Download Yara Rule

APIs

EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FF8A935AA36
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A935AA90
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A935AAB2
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A935AABA
EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A935AAC7
EVP_PKEY_derive_init.LIBCRYPTO-1_1 ref: 00007FF8A935ABC7
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A935ABF3
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A935AC1C
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A935AC46
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A935AC76

Strings

..\s\ssl\tls13_enc.c, xrefs: 00007FF8A935AA60, 00007FF8A935ACAE, 00007FF8A935AD23
W, xrefs: 00007FF8A935AD57
tls13 , xrefs: 00007FF8A935AB2E
U, xrefs: 00007FF8A935AD31

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: X_ctrl$X_free$D_sizeR_put_errorX_new_idY_derive_init
String ID: ..\s\ssl\tls13_enc.c$U$W$tls13
API String ID: 2176224248-2595563013
Opcode ID: 2434f9489be11f169cd6148f5c9ca29509038478076bcee765c6d8193f5a2183
Instruction ID: eba1b0cb2733ac2370e53fdd63a1c618282998717e8ccb78246d6b25d8ba1b52
Opcode Fuzzy Hash: 2434f9489be11f169cd6148f5c9ca29509038478076bcee765c6d8193f5a2183
Instruction Fuzzy Hash: F7918321B0DAC2A9F720AE12E4507BA66B0FB887C4F442135EE4DD7A99EF3CD545DB40

Function 00007FF8A80866CC Relevance: 30.0, APIs: 10, Strings: 7, Instructions: 205stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F77D
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F7BD
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F7E1
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F7FA
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F816
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A822F82F

Strings

DEK-Info:, xrefs: 00007FF8A822F86A
, xrefs: 00007FF8A822F825
Proc-Type:, xrefs: 00007FF8A822F776
ENCRYPTED, xrefs: 00007FF8A822F7ED
, xrefs: 00007FF8A822F80C
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A822F797, 00007FF8A822F84A, 00007FF8A822F88C, 00007FF8A822F902, 00007FF8A822F94B, 00007FF8A822F97B, 00007FF8A822FA2A
,, xrefs: 00007FF8A822F8BD

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strspn$strncmp
String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
API String ID: 1384302209-3505811795
Opcode ID: 4852fe50dedbc2f0f83d44310ad3be750c25d0effceb91a6329b7263fadab02d
Instruction ID: 3719ff62807499fcec03bd82dddbe642fffe0e1f030ec0ab8b30de411b8d9102
Opcode Fuzzy Hash: 4852fe50dedbc2f0f83d44310ad3be750c25d0effceb91a6329b7263fadab02d
Instruction Fuzzy Hash: CD91AE61E0AA53B6FB308F21A4542B93390FF40BC4F444035DA9E87699EF3CE645CB68

Function 00007FF8A8A01130 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 188COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A011BD
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A011D5
_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A03B13
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A03B3E
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A03B4A
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A03B76
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A03B82
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A03BEC

Part of subcall function 00007FF8A8A012C0: PyMem_Malloc.PYTHON38 ref: 00007FF8A8A0134A

Strings

argument 1, xrefs: 00007FF8A8A03B37
invalid normalization form, xrefs: 00007FF8A8A03C7F
str, xrefs: 00007FF8A8A03B29, 00007FF8A8A03B61
normalize, xrefs: 00007FF8A8A03B06, 00007FF8A8A03B30, 00007FF8A8A03B68
argument 2, xrefs: 00007FF8A8A03B6F

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Unicode_$Arg_Equal$ArgumentReady$CheckMallocMem_Positional
String ID: argument 1$argument 2$invalid normalization form$normalize$str
API String ID: 2997860075-4140678229
Opcode ID: 24c4984fe0b4f8d2c8c25afce668d7ebafc2bfb977d8f9d20f810dc28fbae449
Instruction ID: b9ecfbb61da92ddfe62ebb7bf1d9d59244544cf7cd0577795efab1659ba854e0
Opcode Fuzzy Hash: 24c4984fe0b4f8d2c8c25afce668d7ebafc2bfb977d8f9d20f810dc28fbae449
Instruction Fuzzy Hash: E881D221E0F682A1FB648B1594563B923B1EF4ABC8F444131DD8E87696FF2CF505C32A

Function 00007FF8A8086695 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 202registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF8A818CF54
GetFileType.KERNEL32 ref: 00007FF8A818CF65
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A818CFA1
WriteFile.KERNEL32 ref: 00007FF8A818CFC9
MultiByteToWideChar.KERNEL32 ref: 00007FF8A818D036
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A818D1B5
RegisterEventSourceW.ADVAPI32 ref: 00007FF8A818D1D4
ReportEventW.ADVAPI32 ref: 00007FF8A818D216
DeregisterEventSource.ADVAPI32 ref: 00007FF8A818D21F

Strings

OpenSSL: FATAL, xrefs: 00007FF8A818D22D
, xrefs: 00007FF8A818D050
OpenSSL, xrefs: 00007FF8A818D1CD
no stack?, xrefs: 00007FF8A818D01C

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 2603057392-2963566556
Opcode ID: 1f8a55c33d7af28058f0a3a27164936eac3bf161be498d70c40781ba5aba5352
Instruction ID: 6f1d2320747e4e0b9738fabbf151a84759b8fa40dacf452110318b861b87944d
Opcode Fuzzy Hash: 1f8a55c33d7af28058f0a3a27164936eac3bf161be498d70c40781ba5aba5352
Instruction Fuzzy Hash: 0B91F172A09B82A5EB218F24E8451A87BA0FF45BD4F444731EA5E07795EF3CE255C318

Function 00007FF8A930DA10 Relevance: 22.8, APIs: 5, Strings: 8, Instructions: 96stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A930DA4C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A930DA80
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A930DB30

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A930DB11
SUITEB128, xrefs: 00007FF8A930DAA1
SUITEB128ONLY, xrefs: 00007FF8A930DA40
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FF8A930DB50
ECDHE-ECDSA-AES256-GCM-SHA384, xrefs: 00007FF8A930DB57, 00007FF8A930DB67
SUITEB128C2, xrefs: 00007FF8A930DA73
ECDHE-ECDSA-AES128-GCM-SHA256, xrefs: 00007FF8A930DB73
SUITEB192, xrefs: 00007FF8A930DACC

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: strncmp$R_put_error
String ID: ..\s\ssl\ssl_ciph.c$ECDHE-ECDSA-AES128-GCM-SHA256$ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384$ECDHE-ECDSA-AES256-GCM-SHA384$SUITEB128$SUITEB128C2$SUITEB128ONLY$SUITEB192
API String ID: 2707563706-2661540032
Opcode ID: 9c6915c2b9a68f9921c7eb4645cef8d51079716c1d06bde45b1936850fad297e
Instruction ID: 5602b0e537dfc259f9a5945da1b414aa73340d820cf7ffb6b7ae0ea934b60f7c
Opcode Fuzzy Hash: 9c6915c2b9a68f9921c7eb4645cef8d51079716c1d06bde45b1936850fad297e
Instruction Fuzzy Hash: 32414532A0EF86A6EB248F51D45037A72F0FB44BC4F005039DA1E87A94DF2CE651CB00

Function 00007FF8A8086988 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8131653
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813177C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813178F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813192C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813193F

Part of subcall function 00007FF8A8133450: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8133533
Part of subcall function 00007FF8A8133450: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813354B
Part of subcall function 00007FF8A8133450: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8133568

Strings

content-type, xrefs: 00007FF8A8131604
application/x-pkcs7-mime, xrefs: 00007FF8A8131922
boundary, xrefs: 00007FF8A8131664
application/pkcs7-signature, xrefs: 00007FF8A8131785
type: , xrefs: 00007FF8A81317BE, 00007FF8A813196E
application/pkcs7-mime, xrefs: 00007FF8A8131935
..\s\crypto\asn1\asn_mime.c, xrefs: 00007FF8A81315CB, 00007FF8A813170D, 00007FF8A81317A5, 00007FF8A8131821, 00007FF8A81318A5, 00007FF8A81318D7, 00007FF8A8131955, 00007FF8A81319DC
multipart/signed, xrefs: 00007FF8A8131649
application/x-pkcs7-signature, xrefs: 00007FF8A8131772

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strcmp$strncmp
String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
API String ID: 1244041713-3630080479
Opcode ID: 707a128591142f49d0ee7328b1502ea5e99e31137fd224bf2b173adea33cbd71
Instruction ID: c1cf190066245bce488c8f98b5bab7824f87d7a821f2a78ed832a738d5e6f8f6
Opcode Fuzzy Hash: 707a128591142f49d0ee7328b1502ea5e99e31137fd224bf2b173adea33cbd71
Instruction Fuzzy Hash: FCC1CFA0A0E782B1FE61EB1194416B96391EF84BC0F444031EE8D4B7CAEF3CE595C728

Function 00007FF8A80842C3 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF8A82497A9
Filename=, xrefs: 00007FF8A8249773, 00007FF8A82497C7, 00007FF8A82498DD
..\s\crypto\rand\randfile.c, xrefs: 00007FF8A8249752, 00007FF8A82497B1, 00007FF8A82498BC

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rand\randfile.c$Filename=$i
API String ID: 0-1799673945
Opcode ID: 5990bdfd0c60ba8543ce2c2e7e7f5959430ed3ec35f8974e6185769095e8bfbe
Instruction ID: 60ae215ea5f42e95c0db066e0619a62f9a940ba8eaec940f3c2e7ab0cbe0dcd4
Opcode Fuzzy Hash: 5990bdfd0c60ba8543ce2c2e7e7f5959430ed3ec35f8974e6185769095e8bfbe
Instruction Fuzzy Hash: 4F51A371A0EA42A6FA20DB15D8446BA3391FF80BC0F444135D90E876E9EF3CE506CB38

Function 00007FF7E71D1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7E71D14F9
fwrite, xrefs: 00007FF7E71D15DC
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7E71D1559
malloc, xrefs: 00007FF7E71D1560
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7E71D15D5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7E71D14CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7E71D15E5
fread, xrefs: 00007FF7E71D15EC
fseek, xrefs: 00007FF7E71D1500
Failed to extract %s: failed to open target file!, xrefs: 00007FF7E71D148A
fopen, xrefs: 00007FF7E71D1491

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 74dc82bfdd566ab400160a5a18652023752b6dfb3ff5df5dbc85c3bd8cb8fac5
Instruction ID: cdaeefedfa9b761a2e21f8ca31252b219a467ab49f8fce6b2e44a0d0dd270d34
Opcode Fuzzy Hash: 74dc82bfdd566ab400160a5a18652023752b6dfb3ff5df5dbc85c3bd8cb8fac5
Instruction Fuzzy Hash: E851BC21A0874281EA14FB15F4847B9A360AF82BDAF854133DF3D07695EF7CE1479B22

Function 00007FF7E71D7810 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7E71D683A,?,00007FF7E71D672D), ref: 00007FF7E71D7850
OpenProcessToken.ADVAPI32(?,00007FF7E71D672D), ref: 00007FF7E71D7861
GetTokenInformation.ADVAPI32(?,00007FF7E71D672D(TokenIntegrityLevel)), ref: 00007FF7E71D7883
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF7E71D788D
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF7E71D78CA
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7E71D78DC
CloseHandle.KERNEL32(?,00007FF7E71D672D), ref: 00007FF7E71D78F4
LocalFree.KERNEL32(?,00007FF7E71D672D), ref: 00007FF7E71D7926
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7E71D794D
CreateDirectoryW.KERNEL32(?,00007FF7E71D672D), ref: 00007FF7E71D795E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7E71D7909
S-1-3-4, xrefs: 00007FF7E71D78FF

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 3a311ca896c23303b083235c6b21b739ade8233c859481b729e43c8a7aab684c
Instruction ID: b5d095b00c771bbee19d2cdf917c9846ece1ec2a9ab33eb35bf610effbae209a
Opcode Fuzzy Hash: 3a311ca896c23303b083235c6b21b739ade8233c859481b729e43c8a7aab684c
Instruction Fuzzy Hash: F641303161878282EB50EF20F4847AAB361FFC5755F844232EB6E46695DF3CE44ACB11

Function 00007FF8A8A024B0 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON38 ref: 00007FF8A8A024D0
PyModule_AddStringConstant.PYTHON38 ref: 00007FF8A8A024F3
PyModule_AddObject.PYTHON38 ref: 00007FF8A8A02511

Part of subcall function 00007FF8A8A02570: _PyObject_New.PYTHON38(?,?,?,?,00007FF8A8A0251C), ref: 00007FF8A8A0257B

PyModule_AddObject.PYTHON38 ref: 00007FF8A8A0252E
PyCapsule_New.PYTHON38 ref: 00007FF8A8A02545
PyModule_AddObject.PYTHON38 ref: 00007FF8A8A0255D

Strings

ucnhash_CAPI, xrefs: 00007FF8A8A02553
unicodedata.ucnhash_CAPI, xrefs: 00007FF8A8A02537
12.1.0, xrefs: 00007FF8A8A024E2
ucd_3_2_0, xrefs: 00007FF8A8A02524
unidata_version, xrefs: 00007FF8A8A024EC
UCD, xrefs: 00007FF8A8A02507

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Module_$Object$Capsule_ConstantCreate2Object_String
String ID: 12.1.0$UCD$ucd_3_2_0$ucnhash_CAPI$unicodedata.ucnhash_CAPI$unidata_version
API String ID: 3760240918-3763105981
Opcode ID: 61620058af58bf177e15d3f380688a7fe387386ac2f0fda64fc1cbd15126a5f6
Instruction ID: e96289dc28e2c2b44e790f347cd9f982d92f6aa9dbf60c279a207642c3be170c
Opcode Fuzzy Hash: 61620058af58bf177e15d3f380688a7fe387386ac2f0fda64fc1cbd15126a5f6
Instruction Fuzzy Hash: 7B11B374A0BB07B1EE159B55E8561B52370EF09BCAF446032D90E17361FF2CB54AC3AA

Function 00007FF8A8A026B4 Relevance: 19.7, APIs: 13, Instructions: 231COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A8A026DC
__scrt_initialize_crt.LIBCMT ref: 00007FF8A8A02721
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A8A0272E
_RTC_Initialize.LIBCMT ref: 00007FF8A8A0275C
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A8A02782
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A8A027AD
__scrt_fastfail.LIBCMT ref: 00007FF8A8A02813
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A8A02848
_RTC_Initialize.LIBCMT ref: 00007FF8A8A02866
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A8A02874
__scrt_fastfail.LIBCMT ref: 00007FF8A8A02898

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt
String ID:
API String ID: 1751999630-0
Opcode ID: fed84a600c416b2b7a110d36d11904195530507fca46777a172af4e5b36ff657
Instruction ID: 4ffaa58dbe6e145748bff41bafc814c25eee9a59bf6b228e6cbd9e895d363d8d
Opcode Fuzzy Hash: fed84a600c416b2b7a110d36d11904195530507fca46777a172af4e5b36ff657
Instruction Fuzzy Hash: 3F81CF20E0F743A6FA569B66984327962B0EF897C4F544035DA0E43396FF3CF945872A

Function 00007FF8A92F1C12 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 132stringCOMMON

Download Yara Rule

APIs

OPENSSL_sk_new_null.LIBCRYPTO-1_1 ref: 00007FF8A92F76E9
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F7711
strchr.VCRUNTIME140 ref: 00007FF8A92F7748
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A92F77BC
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A92F77F3
OPENSSL_sk_free.LIBCRYPTO-1_1 ref: 00007FF8A92F77FB

Strings

..\s\ssl\d1_srtp.c, xrefs: 00007FF8A92F7703, 00007FF8A92F77DE
H, xrefs: 00007FF8A92F76FB

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error$L_sk_freeL_sk_new_nullstrchrstrncmp
String ID: ..\s\ssl\d1_srtp.c$H
API String ID: 767303460-1001428523
Opcode ID: 7a9524f77792694c28cd335e826729c382c3fbe05dab90ab04144662d4f536d4
Instruction ID: 027920bd01480579f4ff9a8271e6183c29cfcacfee5f0ba3b8e3cc7334cb8d64
Opcode Fuzzy Hash: 7a9524f77792694c28cd335e826729c382c3fbe05dab90ab04144662d4f536d4
Instruction Fuzzy Hash: 6441E021B1FAC2E6FA119F26A80037A62E5EF48BD4F544435D91DC778DDEBEE5128700

Function 00007FF8A92F1C3A Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A935A288
EVP_PKEY_new_raw_private_key.LIBCRYPTO-1_1 ref: 00007FF8A935A358
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A935A36A
EVP_PKEY_new_raw_private_key.LIBCRYPTO-1_1 ref: 00007FF8A935A384
EVP_DigestSignInit.LIBCRYPTO-1_1 ref: 00007FF8A935A3A6
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8A935A3BF
EVP_DigestSignFinal.LIBCRYPTO-1_1 ref: 00007FF8A935A3D3
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A935A411
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A935A419

Strings

..\s\ssl\tls13_enc.c, xrefs: 00007FF8A935A3F0
finished, xrefs: 00007FF8A935A31A

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Digest$SignY_new_raw_private_key$FinalInitL_cleanseUpdateX_freeX_newY_free
String ID: ..\s\ssl\tls13_enc.c$finished
API String ID: 2202177965-3224497825
Opcode ID: cd956a7dbb3421d460fa6aaf2083d69fe2c8da3115ffe5855734321a87095e11
Instruction ID: a1131a360eec7bfd9b17c6679d0ca84767364a012ec2db892f17fd6dcfa47588
Opcode Fuzzy Hash: cd956a7dbb3421d460fa6aaf2083d69fe2c8da3115ffe5855734321a87095e11
Instruction Fuzzy Hash: DE51412260EAC2A9E664DF52A5412EAA3B0FB897C4F446032EE4DC7B5ADF7CD5119700

Function 00007FF8A92F1929 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

BIO_method_type.LIBCRYPTO-1_1 ref: 00007FF8A931B259
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A931B272
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FF8A931B27E
BIO_s_socket.LIBCRYPTO-1_1 ref: 00007FF8A931B293
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A931B29B
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931B2C3
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A931B2E7
BIO_pop.LIBCRYPTO-1_1 ref: 00007FF8A931B2F7
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8A931B304
BIO_push.LIBCRYPTO-1_1 ref: 00007FF8A931B319

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931B2A8

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrlO_free_allO_int_ctrlO_method_typeO_newO_popO_pushO_s_socketO_up_refR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2857342199-1080266419
Opcode ID: 9ded2fa25bdbb6a7b5398f2a78bbec5db11178893a865624105f9c314b2a1acc
Instruction ID: d583e612f5f5ad08e5063095ee1d98e80f6ed4811c6f110d85f15f7f3ee9cac5
Opcode Fuzzy Hash: 9ded2fa25bdbb6a7b5398f2a78bbec5db11178893a865624105f9c314b2a1acc
Instruction Fuzzy Hash: 5A21B422A0EE8155EB14EF25E55177D63B0EF48BC8F102531DA4CC7B9ADE2CE8518781

Function 00007FF8A8083391 Relevance: 18.1, APIs: 5, Strings: 7, Instructions: 127stringCOMMON

Download Yara Rule

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8275B0C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8275B21
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8275B33

Strings

'#, xrefs: 00007FF8A8275B9F
p, xrefs: 00007FF8A8275BC4
secs, xrefs: 00007FF8A8275ADD
accuracy, xrefs: 00007FF8A8275A43, 00007FF8A8275A93, 00007FF8A8275BE4
..\s\crypto\ts\ts_conf.c, xrefs: 00007FF8A8275A80, 00007FF8A8275BCC
microsecs, xrefs: 00007FF8A8275B3E
millisecs, xrefs: 00007FF8A8275B17

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: atoi$strcmp
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs$'#
API String ID: 4175852868-1340856472
Opcode ID: d45c266a281aaa2b712da77a134e97040c46b01aa9aa2af58a86bfe472d47813
Instruction ID: 7bd00b100db509de59d894b0f6bebf4fc5562a45f53b59a1dabdba194f2b7549
Opcode Fuzzy Hash: d45c266a281aaa2b712da77a134e97040c46b01aa9aa2af58a86bfe472d47813
Instruction Fuzzy Hash: 9551CC61A0BA47BAEA14AF22A5402B873E1FF44BC4F441035EE4E43799EF3CE455C728

Function 00007FF7E71D2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7E71D205B
SelectObject.GDI32 ref: 00007FF7E71D20A2
DrawTextW.USER32 ref: 00007FF7E71D20C5
SelectObject.GDI32 ref: 00007FF7E71D20DB
ReleaseDC.USER32 ref: 00007FF7E71D20EB
MoveWindow.USER32 ref: 00007FF7E71D213B
MoveWindow.USER32 ref: 00007FF7E71D217B
MoveWindow.USER32 ref: 00007FF7E71D21CE
MoveWindow.USER32 ref: 00007FF7E71D2216

Strings

P%, xrefs: 00007FF7E71D20AF

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: f5a3bd79b12c7c571d23b6b5ebdfb181c7e65479c9c05912b09222cce72f5b00
Instruction ID: 6d9390407a4113db7ae316737b7813eef607f3b35c3ebf1f5d29cdc32ef4c1df
Opcode Fuzzy Hash: f5a3bd79b12c7c571d23b6b5ebdfb181c7e65479c9c05912b09222cce72f5b00
Instruction Fuzzy Hash: 7D5108266047A186D628AF26F4582BAF7A1FB98B61F044122EBDF43684DF3CD046DB10

Function 00007FF8A92F1CEE Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

BIO_puts.LIBCRYPTO-1_1 ref: 00007FF8A9326B7C
BIO_puts.LIBCRYPTO-1_1 ref: 00007FF8A9326B93
BIO_printf.LIBCRYPTO-1_1 ref: 00007FF8A9326BC3
BIO_puts.LIBCRYPTO-1_1 ref: 00007FF8A9326BE2
BIO_printf.LIBCRYPTO-1_1 ref: 00007FF8A9326C10
BIO_puts.LIBCRYPTO-1_1 ref: 00007FF8A9326C2C

Strings

Session-ID:, xrefs: 00007FF8A9326B89
RSA , xrefs: 00007FF8A9326B75
%02X, xrefs: 00007FF8A9326BB9, 00007FF8A9326C06
Master-Key:, xrefs: 00007FF8A9326BD8

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_puts$O_printf
String ID: Master-Key:$%02X$RSA $Session-ID:
API String ID: 4098839300-1878088908
Opcode ID: 587772a8e1746c0a663de917f53692193e5ee764bc46ea7ed2a5362907c8c510
Instruction ID: 1eab0da1f31cf00898a5c5ca270213ca3df1f0c8559268d2d5bad9470020a7a7
Opcode Fuzzy Hash: 587772a8e1746c0a663de917f53692193e5ee764bc46ea7ed2a5362907c8c510
Instruction Fuzzy Hash: 31314F25A0EED6A9EB54AF16D5403B867B0FF687C8F587032DE0DC6295DF6DE4A08300

Function 00007FF8A8086EF6 Relevance: 16.7, APIs: 4, Strings: 7, Instructions: 159stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A82297A8
strchr.VCRUNTIME140 ref: 00007FF8A8229852
strchr.VCRUNTIME140 ref: 00007FF8A82298B2
strchr.VCRUNTIME140 ref: 00007FF8A82298CA

Strings

443, xrefs: 00007FF8A8229817
/, xrefs: 00007FF8A8229837
..\s\crypto\ocsp\ocsp_lib.c, xrefs: 00007FF8A822977F, 00007FF8A8229857, 00007FF8A82298E1, 00007FF8A82298FF, 00007FF8A822991C, 00007FF8A8229954, 00007FF8A8229969, 00007FF8A822997B, 00007FF8A8229990, 00007FF8A82299AA
http, xrefs: 00007FF8A82297BC
[, xrefs: 00007FF8A822989F
/, xrefs: 00007FF8A822982D
https, xrefs: 00007FF8A82297F2

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strchr
String ID: ..\s\crypto\ocsp\ocsp_lib.c$/$/$443$[$http$https
API String ID: 2830005266-535551730
Opcode ID: 87896204be33adb92dece841a78ab3dca4226c3fbd3d15aeb8ba59b4d003f6b5
Instruction ID: 71ac3eb1131ca0f9d92084de03b8db509ad94e03216e82647247ef4498480b1a
Opcode Fuzzy Hash: 87896204be33adb92dece841a78ab3dca4226c3fbd3d15aeb8ba59b4d003f6b5
Instruction Fuzzy Hash: 16618B22A0FB52A4FB11EB15E4106B927A4FF45BD0F484035DA9D0738AEF3CE195C329

Function 00007FF8A92F1A46 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A9330CC6, 00007FF8A9330D2F

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\extensions_srvr.c
API String ID: 0-1853348325
Opcode ID: 47c9c872dffd780b69c0af3cb6bfa1871c855b50e58a1c0fe4567ba2cddac658
Instruction ID: df752e34adee395e245c2ff52c4b9db10cabf97d488a7897d1b763873f459c06
Opcode Fuzzy Hash: 47c9c872dffd780b69c0af3cb6bfa1871c855b50e58a1c0fe4567ba2cddac658
Instruction Fuzzy Hash: C8C18F61B4EAC3A5FB649E22D5403BA22A1EF45BC8F046035DE0DDBB8ADF7CE5558700

Function 00007FF8A934EAE0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

EVP_PKEY_free.LIBCRYPTO-1_1(?,?,?,00007FF8A9350D52), ref: 00007FF8A934ECD1

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A934EC53, 00007FF8A934ECB4

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Y_free
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 1282063954-348624464
Opcode ID: 520c429b816cefcc52706057fd5ad0ed0e7bd6bb9e86aa4b3d40283605c1ec58
Instruction ID: 407f5b04a7d89bf3ec1d51571b1e043357b7b09591c87c168d87288b5615ee6a
Opcode Fuzzy Hash: 520c429b816cefcc52706057fd5ad0ed0e7bd6bb9e86aa4b3d40283605c1ec58
Instruction Fuzzy Hash: 17519E76A0EB8299EA348F12A48076A77A0EF85BD4F446130EE5D87B95CF3CE5418B04

Function 00007FF8A8A05160 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A0518D
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A051C7
PyUnicode_Compare.PYTHON38 ref: 00007FF8A8A05228
_Py_Dealloc.PYTHON38 ref: 00007FF8A8A05239
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A0524D
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A0526D
_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A05285
PyErr_SetString.PYTHON38 ref: 00007FF8A8A052AA

Strings

invalid normalization form, xrefs: 00007FF8A8A052A0

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
String ID: invalid normalization form
API String ID: 3010910608-2281882113
Opcode ID: fe4e629e476384fa92795967704cf4031fbde27a4ff287eefba88b821df140c1
Instruction ID: 490132dd10d40130e65d8098b8d9952ad5ff8aa75362f0f643abc738db2b101f
Opcode Fuzzy Hash: fe4e629e476384fa92795967704cf4031fbde27a4ff287eefba88b821df140c1
Instruction Fuzzy Hash: DC415B31A0BB02A5EB548B52A84123923B0FF48BC9F444535DD0E973A1EF6CF445836A

Function 00007FF8A8081073 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A818CD78
GetProcAddress.KERNEL32 ref: 00007FF8A818CD8D
GetProcessWindowStation.USER32 ref: 00007FF8A818CDB7
GetUserObjectInformationW.USER32 ref: 00007FF8A818CDDF
GetLastError.KERNEL32 ref: 00007FF8A818CDED
GetUserObjectInformationW.USER32 ref: 00007FF8A818CE58
wcsstr.VCRUNTIME140 ref: 00007FF8A818CE80

Strings

_OPENSSL_isservice, xrefs: 00007FF8A818CD83
Service-0x, xrefs: 00007FF8A818CE79

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 459917433-1672312481
Opcode ID: 907ea08856b7351fcfdb362072efdc6f3654c38b792a184621e31cfee440b119
Instruction ID: 19e69dca4883a0e66722ff4a337cef2417dba700c9aeec6265b7c81017bbbd6d
Opcode Fuzzy Hash: 907ea08856b7351fcfdb362072efdc6f3654c38b792a184621e31cfee440b119
Instruction Fuzzy Hash: 8A417F22A06A826AEBA19F24D8456B93790EF447F4F484734E97D067D4EF3CE145C728

Function 00007FF8A92F1951 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8A9320640
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A9320648
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A9320675
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A932070A
X509_free.LIBCRYPTO-1_1 ref: 00007FF8A9320712
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8A932071A

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A93206F9

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_errorX509_free
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 785824201-2723262194
Opcode ID: 6e5ec6f0fc918b289abcd7061eab92a11a6b5c3848b5e7eea1737d4a85b53af5
Instruction ID: 5a672f0abcbfeb4df8a3103d7da5759692dc265d0d43d486a9740574980fbb2d
Opcode Fuzzy Hash: 6e5ec6f0fc918b289abcd7061eab92a11a6b5c3848b5e7eea1737d4a85b53af5
Instruction Fuzzy Hash: 2D31CA21F0EED2AAFB209E5295007B96271EF98BC8F046431ED4D9BB86EE7CE5054740

Function 00007FF8A8A05074 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A050A0
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A050D5
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A050E5
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A05124
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A05134

Strings

argument 1, xrefs: 00007FF8A8A050CE
str, xrefs: 00007FF8A8A050C0, 00007FF8A8A0510F
is_normalized, xrefs: 00007FF8A8A05093, 00007FF8A8A050C7, 00007FF8A8A05116
argument 2, xrefs: 00007FF8A8A0511D

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: 0f7dd4732f9e0e597afdbfb83b755aee614f37aff07805b1f5a6976535164885
Instruction ID: 31f57feb7f93aba25c502374bdc5e8bec5057fe81e3afad675e3e4361f963d80
Opcode Fuzzy Hash: 0f7dd4732f9e0e597afdbfb83b755aee614f37aff07805b1f5a6976535164885
Instruction Fuzzy Hash: 3C21B420A0BF46A5E7108B11E8452796370EF18BD8F544231D91E276E4EF2CF446C729

Function 00007FF7E71D7420 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7447
FormatMessageW.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7476
WideCharToMultiByte.KERNEL32 ref: 00007FF7E71D74CC

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D74D6
FormatMessageW, xrefs: 00007FF7E71D7487
PyInstaller: FormatMessageW failed., xrefs: 00007FF7E71D7493
WideCharToMultiByte, xrefs: 00007FF7E71D74DD
No error messages generated., xrefs: 00007FF7E71D7480
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7E71D74E9

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 1ca30c699dbe1e4654e7c4d5696967e2b1b1a4f4c1085b5d0a2cfb7980eebcbf
Instruction ID: 50e6ff9aacf314b3e3bb16fee1a54029d1b3e6f875f7840070163eba1aeb2ac1
Opcode Fuzzy Hash: 1ca30c699dbe1e4654e7c4d5696967e2b1b1a4f4c1085b5d0a2cfb7980eebcbf
Instruction Fuzzy Hash: 3F21623160CB4281E664EF14F89436AE665BFC8345FC40037D76D826A5EF3CD1168B22

Function 00007FF8A818BCA0 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 238stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A818BD3B

Strings

..\s\crypto\conf\conf_mod.c, xrefs: 00007FF8A818BE03, 00007FF8A818BE48, 00007FF8A818BE9E, 00007FF8A818BEC8, 00007FF8A818BEE1, 00007FF8A818BF52, 00007FF8A818BF81, 00007FF8A818BF97, 00007FF8A818BFAF, 00007FF8A818BFD6
%-8d, xrefs: 00007FF8A818BFEC
, path=, xrefs: 00007FF8A818BE15
OPENSSL_finish, xrefs: 00007FF8A818BDC2
module=, xrefs: 00007FF8A818BE24, 00007FF8A818BE5E, 00007FF8A818C027
, value=, xrefs: 00007FF8A818C00F
path, xrefs: 00007FF8A818BD65
OPENSSL_init, xrefs: 00007FF8A818BDA5
, retcode=, xrefs: 00007FF8A818C016

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strncmp
String ID: %-8d$, path=$, retcode=$, value=$..\s\crypto\conf\conf_mod.c$OPENSSL_finish$OPENSSL_init$module=$path
API String ID: 1114863663-3652895664
Opcode ID: 3ffd7b22a6c4a1b1c4d689ca8bc2bc64f888bd03435fec539f22409fa520b9b1
Instruction ID: a1bf3eaeb2c4433e917998bbfc04bcdbbda3d2af5c3ce90badb7860ca44a8255
Opcode Fuzzy Hash: 3ffd7b22a6c4a1b1c4d689ca8bc2bc64f888bd03435fec539f22409fa520b9b1
Instruction Fuzzy Hash: AFA19F21A0AB46A6FF619F22A8516B93390EF44BC4F440135ED4E47BE5EF3CE585C728

Function 00007FF7E71E0158 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E0198
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E0560
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E07FF

Strings

p, xrefs: 00007FF7E71E02A2
f, xrefs: 00007FF7E71E03E5
f, xrefs: 00007FF7E71E029A
f, xrefs: 00007FF7E71E0230
p, xrefs: 00007FF7E71E023D

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 96c756b5a3e0b0bef854b95385ee20e4488c726cb2be084469cde4e9576dd0bf
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 53126571E0C24387FB24BA14F1547B9E6A1EBC0754FE4403BD6E9866C4DB7CE5828B62

Function 00007FF8A808365C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8A8149E6E
WSAGetLastError.WS2_32 ref: 00007FF8A8149E78

Strings

o, xrefs: 00007FF8A8149F9F
..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A8149DFE, 00007FF8A8149E8E, 00007FF8A8149EAA, 00007FF8A8149F13, 00007FF8A8149F2F, 00007FF8A8149F8B, 00007FF8A8149FA7

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 8d166042045d94caf43c0dc6d533097cdb4f363d452d1997037747fa8223900a
Instruction ID: 110d00bea2969463a2d0b00a0c80a177b1490074176d90bebbbf7a9c2fa0f6cf
Opcode Fuzzy Hash: 8d166042045d94caf43c0dc6d533097cdb4f363d452d1997037747fa8223900a
Instruction Fuzzy Hash: B8510071B09646AAE720CF21E8047BD77A0FB81784F044230EA8947BD9DF7DE555CB68

Function 00007FF8A92F1B7C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

EVP_MD_CTX_new.LIBCRYPTO-1_1 ref: 00007FF8A9359DBB
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FF8A9359DE7
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8A9359E0D
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FF8A9359E2A
EVP_DigestInit_ex.LIBCRYPTO-1_1 ref: 00007FF8A9359E40
EVP_DigestFinal_ex.LIBCRYPTO-1_1 ref: 00007FF8A9359E5A
EVP_MD_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A9359F0E

Strings

exporter, xrefs: 00007FF8A9359EBE

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Digest$Final_exInit_ex$UpdateX_freeX_new
String ID: exporter
API String ID: 3991325671-111224270
Opcode ID: b2ede6607afb386a75a5a5a28c238858f36694c2d788a5fd6f1b8d0741a327c2
Instruction ID: 4ebf7992e162067072df2e6b5a863352a2e9ae321e303e050d14201b0647c252
Opcode Fuzzy Hash: b2ede6607afb386a75a5a5a28c238858f36694c2d788a5fd6f1b8d0741a327c2
Instruction Fuzzy Hash: 5941553260DFC299EA209F16E8407EAB3A8EB897C4F442031ED8E87759DE7CD1418B00

Function 00007FF8A808341D Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A808126C: __stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A82BCD8C

GetModuleHandleA.KERNEL32 ref: 00007FF8A82BCB9B
GetModuleHandleA.KERNEL32 ref: 00007FF8A82BCBAD
GetModuleHandleW.KERNEL32 ref: 00007FF8A82BCBBA
GetProcAddress.KERNEL32 ref: 00007FF8A82BCC22

Strings

_ssl_d.pyd, xrefs: 00007FF8A82BCBA6
OPENSSL_Applink, xrefs: 00007FF8A82BCC1B
OPENSSL_Uplink(%p,%02X): , xrefs: 00007FF8A82BCB32
_ssl.pyd, xrefs: 00007FF8A82BCB94

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: HandleModule$AddressProc__stdio_common_vswprintf
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
API String ID: 572638636-1130596517
Opcode ID: 3a214ecd083972a397b754c6d42c233fe9ad2c1f8d223ee7389fdf3967f63d7b
Instruction ID: 6f4b3d6e0f740a1232c6dcc6fc9d3364bbe290ab671e926b86100d96d17f4242
Opcode Fuzzy Hash: 3a214ecd083972a397b754c6d42c233fe9ad2c1f8d223ee7389fdf3967f63d7b
Instruction Fuzzy Hash: 7C511821D1FF82A5F7118F29E80417833A0FF98BE4F095735D96D122A9EF3CA5908328

Function 00007FF8A80869A1 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8129D41
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A8129D5C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8129E06

Strings

MASK:, xrefs: 00007FF8A8129D3A
pkix, xrefs: 00007FF8A8129DBF
nombstr, xrefs: 00007FF8A8129D7F
utf8only, xrefs: 00007FF8A8129DFC
default, xrefs: 00007FF8A8129E2A

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strcmpstrncmpstrtoul
String ID: MASK:$default$nombstr$pkix$utf8only
API String ID: 1175158921-3483942737
Opcode ID: 2bd5ef09541ca9ae9162a991637ebcb4c3d5f3a1db9288c4a1ff0209dae57ec5
Instruction ID: f7330f6f52e60be891736efeca7b4f095a465b7b5d8b0d6233f1900bee834fdb
Opcode Fuzzy Hash: 2bd5ef09541ca9ae9162a991637ebcb4c3d5f3a1db9288c4a1ff0209dae57ec5
Instruction Fuzzy Hash: 98313B62B1E985A6EB428B2CE4507B83760FF457C0F845232EB5E43695FF1CE5A1C728

Function 00007FF7E71D6F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7E71D3A10), ref: 00007FF7E71D6F9F
GetStartupInfoW.KERNEL32 ref: 00007FF7E71D6FBE

Part of subcall function 00007FF7E71E90B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E90C8

Part of subcall function 00007FF7E71E6E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E6E8F

GetCommandLineW.KERNEL32 ref: 00007FF7E71D7046
CreateProcessW.KERNEL32 ref: 00007FF7E71D7088
WaitForSingleObject.KERNEL32 ref: 00007FF7E71D709C
GetExitCodeProcess.KERNEL32 ref: 00007FF7E71D70AC

Strings

Error creating child process!, xrefs: 00007FF7E71D70B8
CreateProcessW, xrefs: 00007FF7E71D70BF

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 5f16b07142fd6e9cf00bc922e8cc9db10b45bb18e926ceaba9689dfbd1de94f9
Instruction ID: ce3afdf37619e254afc703cfd383904a7f29e46ed2b5127edc6b0632e26ad5d2
Opcode Fuzzy Hash: 5f16b07142fd6e9cf00bc922e8cc9db10b45bb18e926ceaba9689dfbd1de94f9
Instruction Fuzzy Hash: B8413132A08B8282EA14EB64F4553AEF3A4FFD5350F900136E6AD43795DF7CD0568B51

Function 00007FF7E71DDB70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7E71DDBCD

Part of subcall function 00007FF7E71DEAD0: __GetUnwindTryBlock.LIBCMT ref: 00007FF7E71DEB13
Part of subcall function 00007FF7E71DEAD0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7E71DEB38

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7E71DDCA5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7E71DDEFA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E71DE006

Strings

csm, xrefs: 00007FF7E71DDCC8
csm, xrefs: 00007FF7E71DDBE7
csm, xrefs: 00007FF7E71DDC4E

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 905927d9e3da027d40e91907a7f1dd58b6d09944997845db9437df3d999e9f33
Instruction ID: 713e6248c0ecfd966b2f92868e7acb6914b167638dd30f27ebe2a9a3f232615d
Opcode Fuzzy Hash: 905927d9e3da027d40e91907a7f1dd58b6d09944997845db9437df3d999e9f33
Instruction Fuzzy Hash: 51E18572A087428AEB20AF65E4803ADB7A0FB85799F400537DF9D57B55CF38E442CB52

Function 00007FF7E71EDCE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF7E71EE082,?,?,000001D6CBDD8C48,00007FF7E71EA153,?,?,?,00007FF7E71EA04A,?,?,?,00007FF7E71E53A2), ref: 00007FF7E71EDE64
GetProcAddress.KERNEL32(?,00000000,?,00007FF7E71EE082,?,?,000001D6CBDD8C48,00007FF7E71EA153,?,?,?,00007FF7E71EA04A,?,?,?,00007FF7E71E53A2), ref: 00007FF7E71EDE70

Strings

ext-ms-, xrefs: 00007FF7E71EDDC1
api-ms-, xrefs: 00007FF7E71EDDAE

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 3f9ea5ddd66982662272f3b60427da02763780b89cc10366f1f57cf1354b879c
Instruction ID: 100252fd72319c2d09cb58a25e04e957f7e378fbed65c7fdda360ac2aefbe4c2
Opcode Fuzzy Hash: 3f9ea5ddd66982662272f3b60427da02763780b89cc10366f1f57cf1354b879c
Instruction Fuzzy Hash: 66411561B19B0242FA19EB16F804775A395FF85B90F886136DD6D97784DE3CE4078322

Function 00007FF7E71D7570 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D760F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D765F

Strings

Out of memory., xrefs: 00007FF7E71D7691
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D7688
Failed to get UTF-8 buffer size., xrefs: 00007FF7E71D76A1
WideCharToMultiByte, xrefs: 00007FF7E71D76A8
win32_utils_to_utf8, xrefs: 00007FF7E71D7698

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 4bbd7603499378b50442979c546d1f664acf9c627e90c3cd8d10ddb09143890f
Instruction ID: 4aab514cde0e967852d60a72bdd8a14dc72df504e4199cf27e6a52de262b073a
Opcode Fuzzy Hash: 4bbd7603499378b50442979c546d1f664acf9c627e90c3cd8d10ddb09143890f
Instruction Fuzzy Hash: 5641A232A08B8282E624EF55F48026AE764FBC4790F984136DBAD47B94EF3CD063D711

Function 00007FF8A8A052E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A0531D
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A05333
PyErr_Occurred.PYTHON38 ref: 00007FF8A8A053CD
PyLong_FromLong.PYTHON38 ref: 00007FF8A8A053DE

Strings

a unicode character, xrefs: 00007FF8A8A05308
argument, xrefs: 00007FF8A8A0530F
mirrored, xrefs: 00007FF8A8A05316

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: c810eed8f82086262c6e78a18d9078051395a987c3793f0f044087c6af80baa0
Instruction ID: 7cd0fa684805dac97851b903d1e61ce24e4a289fbfcae02a3ea41d27a7450a2f
Opcode Fuzzy Hash: c810eed8f82086262c6e78a18d9078051395a987c3793f0f044087c6af80baa0
Instruction Fuzzy Hash: 37318B60F0BB06A2FB644B2594A237922B1EF44BD4F444535CA0EA62D0FF6CF845D26B

Function 00007FF8A8A04838 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A04871
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A04887
PyErr_Occurred.PYTHON38 ref: 00007FF8A8A04921
PyLong_FromLong.PYTHON38 ref: 00007FF8A8A04932

Strings

a unicode character, xrefs: 00007FF8A8A0485C
combining, xrefs: 00007FF8A8A0486A
argument, xrefs: 00007FF8A8A04863

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: 4abcde2cecbecc878ffecb5aa1b55e6f84b2c377b6dad8750ff0b1d513e6454f
Instruction ID: d5035c7b7f44c37c1cb64b2f9bec24a4e1392305b060d02e88daf1a06d808372
Opcode Fuzzy Hash: 4abcde2cecbecc878ffecb5aa1b55e6f84b2c377b6dad8750ff0b1d513e6454f
Instruction Fuzzy Hash: BF31AD21F0BA46A2FB644B61946237912B1FF44BD8F044935CA0E562D4EF2CF849A22A

Function 00007FF7E71D7AB0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D7AF1

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

WideCharToMultiByte.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D7B65

Strings

Out of memory., xrefs: 00007FF7E71D7B2B
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7E71D7B6F
Failed to get UTF-8 buffer size., xrefs: 00007FF7E71D7AFE
WideCharToMultiByte, xrefs: 00007FF7E71D7B05, 00007FF7E71D7B76
win32_utils_to_utf8, xrefs: 00007FF7E71D7B32

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 92b52a23bf177b804bd471eb00781d9ecb554dad94de0916a037b448ee798d7d
Instruction ID: d81bcbf32050d9b801744e2b7cb9527cadd10143e343d2308dea5af5a4d8786a
Opcode Fuzzy Hash: 92b52a23bf177b804bd471eb00781d9ecb554dad94de0916a037b448ee798d7d
Instruction Fuzzy Hash: 43219C21A08B4285EA14EF22F880279FB61AFD4B90B884136CB2D43795EF7CE5169712

Function 00007FF8A9306C80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9306CA0
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A930728E

Strings

..\s\ssl\s3_lib.c, xrefs: 00007FF8A9306C92, 00007FF8A9306CF3, 00007FF8A9307280

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\s3_lib.c
API String ID: 1767461275-4238427508
Opcode ID: e21c1b1e74aa922af955503db0d9853d4ab358be7fcf9926e7e141aa0bf6a1b1
Instruction ID: b90392e914fb0279033ee36a3e7006532288473db7acbb2fee4f5dff1435a1b9
Opcode Fuzzy Hash: e21c1b1e74aa922af955503db0d9853d4ab358be7fcf9926e7e141aa0bf6a1b1
Instruction Fuzzy Hash: 9D21B061B0E9829AEB10DF22E5406BE73B0FB84BC8F441435DA4D83B9ADF3CE5418B00

Function 00007FF8A827D140 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 190stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00000000,00007FF8A827C0C2), ref: 00007FF8A827D184
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A827D2E9

Strings

unspecified, xrefs: 00007FF8A827D3E5
..\s\crypto\ts\ts_rsp_verify.c, xrefs: 00007FF8A827D22D, 00007FF8A827D247, 00007FF8A827D3C5, 00007FF8A827D422
unknown code, xrefs: 00007FF8A827D1AD
, failure codes: , xrefs: 00007FF8A827D3EC
status code: , xrefs: 00007FF8A827D410
, status text: , xrefs: 00007FF8A827D3FC

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memsetstrncpy
String ID: , failure codes: $, status text: $..\s\crypto\ts\ts_rsp_verify.c$status code: $unknown code$unspecified
API String ID: 388311670-2553778726
Opcode ID: 5c52ad6f925e1ec42b9a6af6a72652748dd451416fa45a3f3ad2c19ea7319b3e
Instruction ID: e5e28872b94cb9c39392acea50eb8124c63d671af972509acba926ee5080d589
Opcode Fuzzy Hash: 5c52ad6f925e1ec42b9a6af6a72652748dd451416fa45a3f3ad2c19ea7319b3e
Instruction Fuzzy Hash: 07818131A0AA82A6FB60EB1294413B97791FF85BC4F840035DA4D8779AEF3CE545C728

Function 00007FF8A92F3AE0 Relevance: 12.1, APIs: 8, Instructions: 111COMMON

Download Yara Rule

APIs

BIO_get_data.LIBCRYPTO-1_1 ref: 00007FF8A92F3B2D
BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A92F3B40
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A92F3B85
BIO_set_retry_reason.LIBCRYPTO-1_1 ref: 00007FF8A92F3C20

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_clear_flagsO_get_dataO_set_flagsO_set_retry_reason
String ID:
API String ID: 3836630899-0
Opcode ID: 48e16ec5a77cd8e9c9fc854e1f7a8cfccd99df8e26513e75bc304c3ab69e74f2
Instruction ID: 09cac4e5efa72e9474eb5f08fe293a15be36bfa5541a83185617e578759fe259
Opcode Fuzzy Hash: 48e16ec5a77cd8e9c9fc854e1f7a8cfccd99df8e26513e75bc304c3ab69e74f2
Instruction Fuzzy Hash: 4D31E822E0E682D6F728AF62955127D6291EF44BD4F005431ED2DC778ECF7CE8A29740

Function 00007FF7E71E9194 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E91D7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E95C4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E9860

Strings

p, xrefs: 00007FF7E71E9301
f, xrefs: 00007FF7E71E92F9
p, xrefs: 00007FF7E71E9289

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: d667d1d2ee45fe2bab7a4adfb1054cdcdffa8b75a8591027b87a6e9f1006e6e3
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 7B127161E0C34347FB24BA15F0547B9B6A2EBC0754FD44137E6AA866C4DB3CE5868B23

Function 00007FF8A933FE60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8A933D5B0), ref: 00007FF8A933FFD5
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8A933D5B0), ref: 00007FF8A933FFF3
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8A933D5B0), ref: 00007FF8A934000D
BN_bin2bn.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8A933D5B0), ref: 00007FF8A9340026
X509_get0_pubkey.LIBCRYPTO-1_1(?,?,00000000,00000000,?,00007FF8A933D5B0), ref: 00007FF8A9340065

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A9340099

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: N_bin2bn$X509_get0_pubkey
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 3650846462-1507966698
Opcode ID: 3dcda63de29eb65d750073e99d8738b17b35b018f3991ce888ec550fa2f47bde
Instruction ID: 9a09deefd1ffe89b7b15bad4492e4f0275bc41e3305389effcc3f62869bf1b14
Opcode Fuzzy Hash: 3dcda63de29eb65d750073e99d8738b17b35b018f3991ce888ec550fa2f47bde
Instruction Fuzzy Hash: E061E222B09FD194EB508F2498442AD77B4FB857D8F18A630DEAC66B99DF38D291C340

Function 00007FF8A930DC00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A930DC48
memcpy.VCRUNTIME140 ref: 00007FF8A930DC67
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A930DCA9
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A930DCD7

Strings

..\s\ssl\ssl_ciph.c, xrefs: 00007FF8A930DC29, 00007FF8A930DC92, 00007FF8A930DCE8, 00007FF8A930DD63
P, xrefs: 00007FF8A930DC6C

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error$L_sk_pushmemcpy
String ID: ..\s\ssl\ssl_ciph.c$P
API String ID: 96246294-2953004322
Opcode ID: 8d38bac2a8dcdcf5f068ddabef41b603b8a3f89ad49701e50fce4e72cd0622a8
Instruction ID: 004165299e70721712295476912101cd19fb17ca3aefe44c50b98bffd2658070
Opcode Fuzzy Hash: 8d38bac2a8dcdcf5f068ddabef41b603b8a3f89ad49701e50fce4e72cd0622a8
Instruction Fuzzy Hash: 78218865B1EAC1A6F760DF51E4553BA72A0EF487C4F406035DA4DC679ADF6CE1448B00

Function 00007FF8A8082301 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 121stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A8280B69
strchr.VCRUNTIME140 ref: 00007FF8A8280B7A

Strings

..\s\crypto\ui\ui_lib.c, xrefs: 00007FF8A8280C03, 00007FF8A8280C7C
characters, xrefs: 00007FF8A8280C17
You must type in , xrefs: 00007FF8A8280C3E
to , xrefs: 00007FF8A8280C28

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strchr
String ID: characters$ to $..\s\crypto\ui\ui_lib.c$You must type in
API String ID: 2830005266-3422546668
Opcode ID: bd9b23c53823ea533117beb14583a142546b9b8a34662f0ea3acb6cbd8b53595
Instruction ID: 185f1e603e988520f32dc2bcb58feb45b13f709ed576555c3664196ef1f1b531
Opcode Fuzzy Hash: bd9b23c53823ea533117beb14583a142546b9b8a34662f0ea3acb6cbd8b53595
Instruction Fuzzy Hash: E251BF72E0AA42AAEF209F24C4512B937A0EB45BD8F040232DA4D47799DF3CE551CB68

Function 00007FF8A8A01750 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON38 ref: 00007FF8A8A01879
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A03E36
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A03E47

Strings

a unicode character, xrefs: 00007FF8A8A03E21
category, xrefs: 00007FF8A8A03E2F
argument, xrefs: 00007FF8A8A03E28

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyString
String ID: a unicode character$argument$category
API String ID: 3000140846-2068800536
Opcode ID: 11b5af09c6e96202cd833029fba62b7afc398d5caaf83a6a0a49b5ae9faf58ca
Instruction ID: 8bba4caed0c1d1bf81de122e3161506d32beeba0e94c299ee2e148944bd434d3
Opcode Fuzzy Hash: 11b5af09c6e96202cd833029fba62b7afc398d5caaf83a6a0a49b5ae9faf58ca
Instruction Fuzzy Hash: 9751D361B0B642A2EB588706D4523B822F2FB44BC4F444135DA8E47790FF3CFA55D369

Function 00007FF8A808240A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A8273189
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A82731A4
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A82731BD

Strings

T, xrefs: 00007FF8A827323D
..\s\crypto\store\store_lib.c, xrefs: 00007FF8A827321E, 00007FF8A8273236
file, xrefs: 00007FF8A8273151, 00007FF8A8273196

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: _stricmpstrchrstrncmp
String ID: ..\s\crypto\store\store_lib.c$T$file
API String ID: 3017659097-909561481
Opcode ID: 8d9a0ca79b86ce2ebfc7c63195201edfc06bd3520c166aa7ad287b7b0d13c6b7
Instruction ID: 57c2705378f0a65bd5979714cd96ac5152641582a0a65cebf0b82e549b8de205
Opcode Fuzzy Hash: 8d9a0ca79b86ce2ebfc7c63195201edfc06bd3520c166aa7ad287b7b0d13c6b7
Instruction Fuzzy Hash: E941E33260AA52A5EA21DF12E8442B973A1FF88BC4F844135DE4D07798EF3CE945C728

Function 00007FF8A8A01000 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON38 ref: 00007FF8A8A010DE
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A03AAC
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A03ABC

Strings

a unicode character, xrefs: 00007FF8A8A03A97
bidirectional, xrefs: 00007FF8A8A03AA5
argument, xrefs: 00007FF8A8A03A9E

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyString
String ID: a unicode character$argument$bidirectional
API String ID: 3000140846-2110215792
Opcode ID: 2951cb651f92f80c2450ab6db5bafeba69142dea97d1071b270051d478aa9691
Instruction ID: bbd517a1a38e7b5303f8f82f22484ac4165470274948a62d06acb443f093f8b5
Opcode Fuzzy Hash: 2951cb651f92f80c2450ab6db5bafeba69142dea97d1071b270051d478aa9691
Instruction Fuzzy Hash: 3C41B121B0F642A2EB588B15D8523B962B1FB48BC4F644539DA8E432D0FF2DF945C329

Function 00007FF7E71D7BA0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7C35
MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7C77

Strings

Out of memory., xrefs: 00007FF7E71D7CA6
win32_utils_from_utf8, xrefs: 00007FF7E71D7CAD
Failed to get wchar_t buffer size., xrefs: 00007FF7E71D7CB6
MultiByteToWideChar, xrefs: 00007FF7E71D7CBD
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7E71D7C9D

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: aa298a002c453f6745e6396b8798e2734c1602e68a69c20a805e124d22ac7461
Instruction ID: a326c3631a424c61c4f2bb30ed4db7270bdb43f4ad8eda935f0b7159c388c215
Opcode Fuzzy Hash: aa298a002c453f6745e6396b8798e2734c1602e68a69c20a805e124d22ac7461
Instruction Fuzzy Hash: BD419132A18B4386EA24EF15F480369A6A5FB84790F940136DF6D47B94DF3CD053DB11

Function 00007FF8A8A05608 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON38 ref: 00007FF8A8A0563C

Strings

invalid normalization form, xrefs: 00007FF8A8A05757

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: EqualUnicode_
String ID: invalid normalization form
API String ID: 3822945493-2281882113
Opcode ID: 52adbe2ba8cfd1881f36d22b7474a004ba8ed60ba2cdfc74fbb69c043373234b
Instruction ID: 2ca90dec4658f245f4bd2be267631fb8bd7664378cc4251253e061ac19b37ada
Opcode Fuzzy Hash: 52adbe2ba8cfd1881f36d22b7474a004ba8ed60ba2cdfc74fbb69c043373234b
Instruction Fuzzy Hash: 86318020F0F682A1FB6087229916B791271FF49FC8F484030DD4D56A96EF6DF105972A

Function 00007FF8A92F1AE1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A93432AB
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A93432B9
i2d_X509_NAME.LIBCRYPTO-1_1 ref: 00007FF8A93432FD
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A934330B

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A9343268, 00007FF8A934332D
", xrefs: 00007FF8A934334F

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_num$L_sk_valueX509_i2d_
String ID: "$..\s\ssl\statem\statem_lib.c
API String ID: 3754435392-3756396100
Opcode ID: aab37bef012f5e6d6af6fee865d7238023c49f8be50ff4b58f3f88c045243ca4
Instruction ID: a01a7a183f8a5118434441a8586cb6ea11949b6517bcd9a4c47b210cd1a591c5
Opcode Fuzzy Hash: aab37bef012f5e6d6af6fee865d7238023c49f8be50ff4b58f3f88c045243ca4
Instruction Fuzzy Hash: E231C221B1EAC365FA10DF62A5402BE62A0EF84BD4F442430ED4CC7B9AEF7CE5418B00

Function 00007FF8A8A04984 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A049BF
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A049F4
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A04A08

Strings

argument 1, xrefs: 00007FF8A8A049ED
a unicode character, xrefs: 00007FF8A8A049DF
decimal, xrefs: 00007FF8A8A049B8, 00007FF8A8A049E6

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: 1edd0f872e078ae46c3bd96f96f546a30f723c592c5451fb704a8da1bced2abb
Instruction ID: 4490981f6b53e055e7fd78b677b537e3429d2bcdb133e9020bdaf7150df76bed
Opcode Fuzzy Hash: 1edd0f872e078ae46c3bd96f96f546a30f723c592c5451fb704a8da1bced2abb
Instruction Fuzzy Hash: 35318B21B0FA46A6EB608B45D4523792271FB84BC8F988031DA0D57B95EF3DF856C32D

Function 00007FF8A8A0577C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A057B7
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A057EC
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A05800

Strings

argument 1, xrefs: 00007FF8A8A057E5
a unicode character, xrefs: 00007FF8A8A057D7
numeric, xrefs: 00007FF8A8A057B0, 00007FF8A8A057DE

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: 6ba9616c76c1b2578bf5061fe10e7fea3253e3269814aac9abed4bdef8af4287
Instruction ID: 210a08b82ccdcb01f4cc98ea12bf3c9640cd3746c6711f4f31a043afcb620176
Opcode Fuzzy Hash: 6ba9616c76c1b2578bf5061fe10e7fea3253e3269814aac9abed4bdef8af4287
Instruction Fuzzy Hash: CA31BF21B0BB46A2EB508B16D4423792371EB84BC4F588431CE1D67795EF3DF846E72A

Function 00007FF8A8A0543C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A05477
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A054AC
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A054C0

Strings

argument 1, xrefs: 00007FF8A8A054A5
a unicode character, xrefs: 00007FF8A8A05497
name, xrefs: 00007FF8A8A05470, 00007FF8A8A0549E

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: 024395b689c67a05806c68adcf79414aab75b3a78e0a20c892317bdea327388a
Instruction ID: 42f4241a37485901d40e59a7230811202539c9a76c5c407d85308373b6ae84e8
Opcode Fuzzy Hash: 024395b689c67a05806c68adcf79414aab75b3a78e0a20c892317bdea327388a
Instruction Fuzzy Hash: A231A021B0BE46A2EB508B05D44227D2372EB84BD4F549031CA4D6B794EF3EF842C329

Function 00007FF8A92F1BD6 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 90COMMON

Download Yara Rule

APIs

OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A9352746

Strings

extended master secret, xrefs: 00007FF8A935271D
, xrefs: 00007FF8A93527BA
master secret, xrefs: 00007FF8A93527D2
, xrefs: 00007FF8A93527D9
0, xrefs: 00007FF8A9352786

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_cleanse
String ID: $ $0$extended master secret$master secret
API String ID: 1040887069-741269486
Opcode ID: 60efae92cf271af2bd7e87180dea88d22f8e1213ffb1e06b9429debec4d2a6da
Instruction ID: 22e16ae4678d086e3de3cc508a035d71ccb5014604131ded2a33b655da5bbc46
Opcode Fuzzy Hash: 60efae92cf271af2bd7e87180dea88d22f8e1213ffb1e06b9429debec4d2a6da
Instruction Fuzzy Hash: F841267260DB8195E760CF11F88039AB6A4FB887C4F54A135EA8C87A6AEF7DD155CB00

Function 00007FF7E71DCE28 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEAD
GetLastError.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEBB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCEE5
FreeLibrary.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCF2B
GetProcAddress.KERNEL32(?,?,?,00007FF7E71DD0DA,?,?,?,00007FF7E71DCDCC,?,?,00000001,00007FF7E71DC9E9), ref: 00007FF7E71DCF37

Strings

api-ms-, xrefs: 00007FF7E71DCECD

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5875a968ec1c8163f4728790c5c34772c02e6e55674a02490018482c9d800bcd
Instruction ID: 7122505794d3db4ce6846e81bd5e274dafe3da37f6e8322764a8bacdae13f511
Opcode Fuzzy Hash: 5875a968ec1c8163f4728790c5c34772c02e6e55674a02490018482c9d800bcd
Instruction Fuzzy Hash: E531C721A1A74295EE15EF02F8507B5A294BF89BA1F994936DF3D46340DF3CE0428B21

Function 00007FF7E71D6460 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7E71D67AF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF7E71D64BF

Part of subcall function 00007FF7E71D2770: MessageBoxW.USER32 ref: 00007FF7E71D2841

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7E71D651A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7E71D6496
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7E71D64D3

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 9eb99ae586d031700f80d960bb93105f64990418315754ce9dca1f45177a6931
Instruction ID: 471986698c023c7814121b0a59bd2f0f3d2c1a25d4ca826ee8db91370bf53ed6
Opcode Fuzzy Hash: 9eb99ae586d031700f80d960bb93105f64990418315754ce9dca1f45177a6931
Instruction Fuzzy Hash: EF316611B1874241FA24F725F9953BAD251AFD87C1FC44433DB6E4279AEE3CE5068B22

Function 00007FF8A8A04DA0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON38 ref: 00007FF8A8A04DD3
_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A04E08
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A04E1C

Strings

argument 1, xrefs: 00007FF8A8A04E01
a unicode character, xrefs: 00007FF8A8A04DF3
digit, xrefs: 00007FF8A8A04DCC, 00007FF8A8A04DFA

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$digit
API String ID: 3545102714-197099943
Opcode ID: bd974eef077122dec893b469d7545075ff2cae19a9a2d289780263393b15a563
Instruction ID: ee2430a475bdb51262c5ccea5f5124ff5c6e48a29ba937d5b387fec1f70253da
Opcode Fuzzy Hash: bd974eef077122dec893b469d7545075ff2cae19a9a2d289780263393b15a563
Instruction Fuzzy Hash: AF314C21B0B656A2EB608B15D5422B92271FB84BC8F948431DA0D47794FF3DF896C369

Function 00007FF8A8A04C38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON38 ref: 00007FF8A8A04C7D
memcpy.VCRUNTIME140 ref: 00007FF8A8A04D01
PyOS_snprintf.PYTHON38 ref: 00007FF8A8A04D43
PyUnicode_FromStringAndSize.PYTHON38 ref: 00007FF8A8A04D70

Strings

, xrefs: 00007FF8A8A04D19
%04X, xrefs: 00007FF8A8A04D2E

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: FromStringUnicode_$S_snprintfSizememcpy
String ID: $%04X
API String ID: 3253253298-4013080060
Opcode ID: 8783773e75f91aa2f04b476c70ee7b81768cdf1f8208fe2319de8069345006e0
Instruction ID: c85682f9e7d3022138151ec4e8e466c8f56975dc5ba514e2e9a8506e2ed61f0b
Opcode Fuzzy Hash: 8783773e75f91aa2f04b476c70ee7b81768cdf1f8208fe2319de8069345006e0
Instruction Fuzzy Hash: 4C31D272A0BA81A1EB218B14E4553B963B0FB48BD8F450235CA6E037D5EF3CE445C315

Function 00007FF8A92F1B27 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

BIO_s_file.LIBCRYPTO-1_1 ref: 00007FF8A93213AF
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A93213B7
BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A93213E4
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A932147D
BIO_free.LIBCRYPTO-1_1 ref: 00007FF8A9321485

Strings

..\s\ssl\ssl_rsa.c, xrefs: 00007FF8A932146C

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrlO_freeO_newO_s_fileR_put_error
String ID: ..\s\ssl\ssl_rsa.c
API String ID: 2618924202-2723262194
Opcode ID: 8d58ee7b11d0c0ec938e92c6c3949c0826d999b61468d251a78d44bec04e1ef1
Instruction ID: 4ac6bcd3506c5e290cc56d7fdf68629d45fa5e14efbc5d6e5e2fff437a2249c2
Opcode Fuzzy Hash: 8d58ee7b11d0c0ec938e92c6c3949c0826d999b61468d251a78d44bec04e1ef1
Instruction Fuzzy Hash: B731A721A0EAC296F7209F5295406BE7271EB59BC8F546034EF4D8BB86CF3DE5014744

Function 00007FF8A8083E45 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A82499D9
_chmod.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A8249A9D
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A8249AB6
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A8249AC2

Strings

Filename=, xrefs: 00007FF8A8249A12, 00007FF8A8249A81
..\s\crypto\rand\randfile.c, xrefs: 00007FF8A82499FC, 00007FF8A8249A60

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: _chmod_stat64i32fclosefwrite
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 4260490851-2201148535
Opcode ID: 9583951cb24bb92d91a3483a246215b3780206df37694dce07967a41c698ced9
Instruction ID: 111aeac12a8ab641fa305b9d1b298dfc7e9f6f4c343b76f4714ad9abdef7b5b7
Opcode Fuzzy Hash: 9583951cb24bb92d91a3483a246215b3780206df37694dce07967a41c698ced9
Instruction Fuzzy Hash: B4319EB1A0EA46A6EA20DB11E4013B973A1FF947C4F444035DA4E477E9EF3CE544CB28

Function 00007FF7E71D79A0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D7A60

Strings

Out of memory., xrefs: 00007FF7E71D7A22
win32_utils_from_utf8, xrefs: 00007FF7E71D7A29
Failed to get wchar_t buffer size., xrefs: 00007FF7E71D79E7
MultiByteToWideChar, xrefs: 00007FF7E71D79EE, 00007FF7E71D7A71
Failed to decode wchar_t from UTF-8, xrefs: 00007FF7E71D7A6A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: ee2ee3c888b621b3c3f4dc33b354bcabab4fe5f972038a38ac2187e11a85846b
Instruction ID: 6fc51b0188ca401f5155f5789f42d0d9afe3a7026cf13a31c9b9a137a37c7bf3
Opcode Fuzzy Hash: ee2ee3c888b621b3c3f4dc33b354bcabab4fe5f972038a38ac2187e11a85846b
Instruction Fuzzy Hash: CD219322B08B4241EB14EB19F440265E761EFC57C4F984132DB6C93BA9EE3CD5529B11

Function 00007FF7E71EA550 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA55F
FlsGetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA574
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA595
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5C2
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5D3
FlsSetValue.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5E4
SetLastError.KERNEL32(?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F,?,?,?,00007FF7E71E9243), ref: 00007FF7E71EA5FF

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 679a8f5ed95f4c44c4bc9ccb242736963b1e2f2654bfe38b80143c9ca5edf043
Instruction ID: 2cdc1f76e22c140503dc4f6202bb88e74fb60d1487d4eb87ba5a3e31dbe94fe6
Opcode Fuzzy Hash: 679a8f5ed95f4c44c4bc9ccb242736963b1e2f2654bfe38b80143c9ca5edf043
Instruction Fuzzy Hash: FF215E20B0D34283FA58B321F645379E2669FC47B4F940636D93E866C6DE3CE4478223

Function 00007FF7E71F6F9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7E71F6FCD
GetLastError.KERNEL32 ref: 00007FF7E71F6FD9
CloseHandle.KERNEL32 ref: 00007FF7E71F6FF1
CreateFileW.KERNEL32 ref: 00007FF7E71F701C
WriteConsoleW.KERNEL32 ref: 00007FF7E71F703B

Strings

CONOUT$, xrefs: 00007FF7E71F6FFD

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5d0318ae55f50b6dcee6d616b573d53fae0e0d17b0b79c1b3a6779b9b80778ff
Instruction ID: 455925103bbc5498292e1f086ab2c81de9bc46348fe3237b168950e5ef8dba74
Opcode Fuzzy Hash: 5d0318ae55f50b6dcee6d616b573d53fae0e0d17b0b79c1b3a6779b9b80778ff
Instruction Fuzzy Hash: AD11D021B18B4186E750AB02F854329F2A4FFC9FE4F840236EA2D83794DF3CD8168761

Function 00007FF8A92F1B4F Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A93540EE
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A9354132
OPENSSL_sk_value.LIBCRYPTO-1_1 ref: 00007FF8A935415A
X509_get_extension_flags.LIBCRYPTO-1_1 ref: 00007FF8A9354186
X509_get_signature_info.LIBCRYPTO-1_1 ref: 00007FF8A93541AB
OPENSSL_sk_num.LIBCRYPTO-1_1 ref: 00007FF8A9354204

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_numL_sk_value$X509_get_extension_flagsX509_get_signature_info
String ID:
API String ID: 420811412-0
Opcode ID: fdd1a17d0625aa889ce440010294d5dcaf350f69fc02d7329818360b4c3a8a86
Instruction ID: 4cff43afa7a5103fa021e982632f8ef265decee099cef1f10cb71a852fd6638a
Opcode Fuzzy Hash: fdd1a17d0625aa889ce440010294d5dcaf350f69fc02d7329818360b4c3a8a86
Instruction Fuzzy Hash: CB31E822B0EAC17AF6649E1A644167A62A1FF897C4F507030ED4DC3B96DF3CD5018B00

Function 00007FF8A82B37F0 Relevance: 9.1, APIs: 7, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000000,?,00007FF8A82B375B,?,?,00000000,00007FF8A82B2C97), ref: 00007FF8A82B390A
strchr.VCRUNTIME140(?,00000000,?,00007FF8A82B375B,?,?,00000000,00007FF8A82B2C97), ref: 00007FF8A82B3938
strchr.VCRUNTIME140(?,00000000,?,00007FF8A82B375B,?,?,00000000,00007FF8A82B2C97), ref: 00007FF8A82B394C
strchr.VCRUNTIME140(?,00000000,?,00007FF8A82B375B,?,?,00000000,00007FF8A82B2C97), ref: 00007FF8A82B3B24
strchr.VCRUNTIME140(?,00000000,?,00007FF8A82B375B,?,?,00000000,00007FF8A82B2C97), ref: 00007FF8A82B3B34

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strchr
String ID:
API String ID: 2830005266-0
Opcode ID: 41294343419ae3a9a5b1b52002eed454be2f73b69e5a402d77914a4dc71a9ea8
Instruction ID: dc7b1283f174d95fbe5794e519be76516dd143301147026467d2f2bec0bb9a21
Opcode Fuzzy Hash: 41294343419ae3a9a5b1b52002eed454be2f73b69e5a402d77914a4dc71a9ea8
Instruction Fuzzy Hash: D1B1E562B0B68269FB758A2AD48C278A7D1EB45BE0F584131DF5C437C9DF3DE8868314

Function 00007FF8A9308B20 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

EVP_PKEY_new.LIBCRYPTO-1_1 ref: 00007FF8A9308B55
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A9308B7E
EVP_PKEY_CTX_new_id.LIBCRYPTO-1_1 ref: 00007FF8A9308B97
EVP_PKEY_CTX_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A9308BD3
EVP_PKEY_free.LIBCRYPTO-1_1 ref: 00007FF8A9308BF2
EVP_PKEY_CTX_free.LIBCRYPTO-1_1 ref: 00007FF8A9308C03

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Y_free$X_ctrlX_freeX_new_idY_new
String ID:
API String ID: 1769623012-0
Opcode ID: cd7a102d04317168cf9d8552561b9f1fefeb11ec2ac8f7538451c88604b89844
Instruction ID: ae94feabd3f61d2567b8d02cc4a78cfbc24d0ee2c4f07f722d8fcac843aea8d0
Opcode Fuzzy Hash: cd7a102d04317168cf9d8552561b9f1fefeb11ec2ac8f7538451c88604b89844
Instruction Fuzzy Hash: A0218325A0FF8259EA50DF59A55137AA2B0DF897C4F142034EA4D8BBAADE3DD4514A00

Function 00007FF7E71EA6C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA6D7
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA70D
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA73A
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA74B
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA75C
SetLastError.KERNEL32(?,?,?,00007FF7E71E437D,?,?,?,?,00007FF7E71EDCD7,?,?,00000000,00007FF7E71EA7E6,?,?,?), ref: 00007FF7E71EA777

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 06987274cb3614921fd840648349c1e43a66a502bcd42809fc0a8605467304b5
Instruction ID: 573673b260cbd9232b9956ed372057351566bb338d231c068c2d9f32bc78cba5
Opcode Fuzzy Hash: 06987274cb3614921fd840648349c1e43a66a502bcd42809fc0a8605467304b5
Instruction Fuzzy Hash: 5F113824E0D34243FA58F331E645279E2A69FC47B0F840236E93E866D6DE3DA4478222

Function 00007FF8A92F19B5 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A933B62E, 00007FF8A933B9D1

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem_clnt.c
API String ID: 0-1507966698
Opcode ID: 51b3f5bf31d046f1e5e4412d3923fa1a346ecaa14b379591e19cad8dfdf720f2
Instruction ID: ef3b14ed7257479e7bf5824db88d488cac093d6dc5390c458fab9f7c5819f819
Opcode Fuzzy Hash: 51b3f5bf31d046f1e5e4412d3923fa1a346ecaa14b379591e19cad8dfdf720f2
Instruction Fuzzy Hash: 4BB19F61A4EAC2A5FB609E12D5503BB22B5EF85BC8F085039DE4DC7BDADF6CE5418700

Function 00007FF7E71DE3A4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E71DE3CC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7E71DE4B4
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7E71DE600

Strings

csm, xrefs: 00007FF7E71DE506
csm, xrefs: 00007FF7E71DE3EE

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 9800ab22ff9ec3031df11c68b1b6988b1d6dca39287b35c2ac61cac3dceebb2d
Instruction ID: f9d572aae82b4524633bbc8b1dc4c96f076c1c135c5ddcd665fdf515b58185dd
Opcode Fuzzy Hash: 9800ab22ff9ec3031df11c68b1b6988b1d6dca39287b35c2ac61cac3dceebb2d
Instruction Fuzzy Hash: 1B61B33290C74286EB24AF25E484368B7A0EB94B96F844133DBAD47795DF3CE456CF12

Function 00007FF7E71DC7E8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7E71DC813
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7E71DC8A8
RtlUnwindEx.KERNEL32 ref: 00007FF7E71DC8F7

Strings

csm, xrefs: 00007FF7E71DC88E
f, xrefs: 00007FF7E71DC826

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2ca7bf8577ec542d0e69192cc971812b89960c92109ccbd26765ab8ebdf2d4b6
Instruction ID: 8ab03f1e5c5987b3be264e862fcf2da6be140608e34c9f9cc8f31f93b4334bd9
Opcode Fuzzy Hash: 2ca7bf8577ec542d0e69192cc971812b89960c92109ccbd26765ab8ebdf2d4b6
Instruction Fuzzy Hash: 2E51DA31A097018EEB18EF15F480B29B756FB80789F908536DB6E47744EF38E842CB15

Function 00007FF7E71D2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7E71D242F), ref: 00007FF7E71D2278
DialogBoxIndirectParamW.USER32 ref: 00007FF7E71D233C
DeleteObject.GDI32 ref: 00007FF7E71D236F
DestroyIcon.USER32 ref: 00007FF7E71D2381

Strings

Unhandled exception in script, xrefs: 00007FF7E71D22A8

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 7d82fb9080f08f38887541d796cd93f6b84f8101b6940601e1502b8de02da7d5
Instruction ID: cb5b9fe37d844b8ddb4b340d25d16d1e1dec8a841a9e313814fce1d7be4a8038
Opcode Fuzzy Hash: 7d82fb9080f08f38887541d796cd93f6b84f8101b6940601e1502b8de02da7d5
Instruction Fuzzy Hash: 29314032609B8289EB24EF61F8552E9B360FF89784F840136EA5E4BB55DF3CD146C712

Function 00007FF8A92F1C4E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9316E68
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A9316EA3

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A9316E49, 00007FF8A9316E84, 00007FF8A9316EEA

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 2d803513d437006b8e8b5f04fd52412c3bd121a1b0b53b706d91ec809aaa0684
Instruction ID: d17f45f99a3509375035331166c480ab36bed060542cd16a43f4e258df38e38f
Opcode Fuzzy Hash: 2d803513d437006b8e8b5f04fd52412c3bd121a1b0b53b706d91ec809aaa0684
Instruction Fuzzy Hash: FF31AF62A0DEC196FB609F56E4403A922A1EB487DCF645234EB5C8B7E5EF3DC5458B00

Function 00007FF8A8A04F28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A04F61
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A04F77

Strings

east_asian_width, xrefs: 00007FF8A8A04F5A
a unicode character, xrefs: 00007FF8A8A04F4C
argument, xrefs: 00007FF8A8A04F53

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: f36d5312feb184fd59674f58b54733997b8d53dc8f7909c662cb7da225fa12d9
Instruction ID: 94a51ccab9b0728d3b3358194ba27bf66d5640d192b97baabf0371632a30cfbb
Opcode Fuzzy Hash: f36d5312feb184fd59674f58b54733997b8d53dc8f7909c662cb7da225fa12d9
Instruction Fuzzy Hash: 59216D61B0BA06A2FB648B15D46337912B1FF84BD8F544035DA0E97384EF2DF84593AA

Function 00007FF8A8A04B48 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON38 ref: 00007FF8A8A04B81
_PyUnicode_Ready.PYTHON38 ref: 00007FF8A8A04B97

Strings

a unicode character, xrefs: 00007FF8A8A04B6C
decomposition, xrefs: 00007FF8A8A04B7A
argument, xrefs: 00007FF8A8A04B73

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: 922cd02f3d145214e9771c3c3ea48c5a6488ab2919ba49599783f695ada8680e
Instruction ID: 2ec81a3af079b9187c730ec946238f0c2030031dfe569d729028c51540dacb2d
Opcode Fuzzy Hash: 922cd02f3d145214e9771c3c3ea48c5a6488ab2919ba49599783f695ada8680e
Instruction Fuzzy Hash: B2219A61B0B606A2FB648B15D56337922B1FF85BD8F444435CF0E862D4EF2CF856836A

Function 00007FF7E71D2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654

Part of subcall function 00007FF7E71D7420: GetLastError.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7447
Part of subcall function 00007FF7E71D7420: FormatMessageW.KERNEL32(00000000,00007FF7E71D26A0), ref: 00007FF7E71D7476

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D272C
MessageBoxA.USER32 ref: 00007FF7E71D2748

Strings

%s%s: %s, xrefs: 00007FF7E71D26AD
Fatal error detected, xrefs: 00007FF7E71D2700, 00007FF7E71D273A

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 69e3767f8cdd6c35a8cd2c47750a455f0093d4d97caca0efebb433e2d8ab7874
Instruction ID: 8cd49527202bd84aa7e6a306efb4d982036f231539c084f11b1ba1fc7675df7c
Opcode Fuzzy Hash: 69e3767f8cdd6c35a8cd2c47750a455f0093d4d97caca0efebb433e2d8ab7874
Instruction Fuzzy Hash: 4B315E72628B8291EA24EB10F4917EAA364FFC4785FC44037EB9D06699DF3CD206CB51

Function 00007FF8A8A01FB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON38(?,?,?,?,?,00007FF8A8A01F9C), ref: 00007FF8A8A040CF

Part of subcall function 00007FF8A8A02030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8A02072
Part of subcall function 00007FF8A8A02030: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8A02090

PyErr_Format.PYTHON38 ref: 00007FF8A8A02017
PyUnicode_FromKindAndData.PYTHON38 ref: 00007FF8A8A040FE

Strings

name too long, xrefs: 00007FF8A8A040C5
undefined character name '%s', xrefs: 00007FF8A8A0200A

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: Err_strncmp$DataFormatFromKindStringUnicode_
String ID: name too long$undefined character name '%s'
API String ID: 2291325159-4056717002
Opcode ID: 95aba1876839f9fd3170b2e5971c610c07243d632732ed76b3765bdfebe0e3c4
Instruction ID: f51b05865b1a7f084d80198d4bf7741a8269b59317a7155631ef5189846c2028
Opcode Fuzzy Hash: 95aba1876839f9fd3170b2e5971c610c07243d632732ed76b3765bdfebe0e3c4
Instruction Fuzzy Hash: 55111C71E0BB47A5FB008B54D8862B86374FB48799F500032CA1E47261EFBDF14AC76A

Function 00007FF7E71E8810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E71E8835
GetProcAddress.KERNEL32 ref: 00007FF7E71E884B
FreeLibrary.KERNEL32 ref: 00007FF7E71E8872

Strings

CorExitProcess, xrefs: 00007FF7E71E8844
mscoree.dll, xrefs: 00007FF7E71E882C

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b22ba27cf5ec64e3c37270bb25822a4f1a3ee3e342d89922054c394a8bf0263d
Instruction ID: c011b0edebd2ce68d606edbfcfa141f3ee425825320ecfe4ea0731393e438a4a
Opcode Fuzzy Hash: b22ba27cf5ec64e3c37270bb25822a4f1a3ee3e342d89922054c394a8bf0263d
Instruction Fuzzy Hash: 91F0A461A09B0241EB14AB24F8453399330EFC5755FC81236DA7D451E4CF3CD006C321

Function 00007FF8A808324C Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 268stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A828AE05

Part of subcall function 00007FF8A80823BA: memset.VCRUNTIME140 ref: 00007FF8A8174A6B

memmove.VCRUNTIME140 ref: 00007FF8A828AFE2

Strings

..\s\crypto\x509\x509_obj.c, xrefs: 00007FF8A828ADE6, 00007FF8A828B08F, 00007FF8A828B104
NO X509_NAME, xrefs: 00007FF8A828ADF8
0123456789ABCDEF, xrefs: 00007FF8A828B001

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmovememsetstrncpy
String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
API String ID: 899670095-3422593365
Opcode ID: 331bd5d58ffab7b5022c9aa9d8f25c0b60d8728804f5abbc57f68da67e06c8cf
Instruction ID: 83b65de568a3a097bb7987a8bb9040dd0cdf9f0a1c11d72cea49d5e16798effc
Opcode Fuzzy Hash: 331bd5d58ffab7b5022c9aa9d8f25c0b60d8728804f5abbc57f68da67e06c8cf
Instruction Fuzzy Hash: AEB10262A0EA86A6EF109B25D40037AB7E0FB55BC4F088135DE9E477C9DF3DE4418725

Function 00007FF8A8085371 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A822F451

Strings

;, xrefs: 00007FF8A822F492
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A822F49A, 00007FF8A822F503, 00007FF8A822F5EC
Enter PEM pass phrase:, xrefs: 00007FF8A822F467

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
API String ID: 2162964266-3733131234
Opcode ID: 8fe84b7b5941e432665025a114fcc150736b15ceb5b1fa18c4e66cb3bc413d90
Instruction ID: 946ee23b84830290c595d6637386dd914fa93f210a0bb062855e429893af7b3b
Opcode Fuzzy Hash: 8fe84b7b5941e432665025a114fcc150736b15ceb5b1fa18c4e66cb3bc413d90
Instruction Fuzzy Hash: C371A262A0A682A6EB30DF21E4407BA7390FB947D4F400135EB5D47AC9EF7CE551CB28

Function 00007FF7E71F86D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7E71F86FC
_set_statfp.LIBCMT ref: 00007FF7E71F8717
_set_statfp.LIBCMT ref: 00007FF7E71F8733
_set_statfp.LIBCMT ref: 00007FF7E71F876F

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 84eff07cf34d7ef4d1c68c6f3ca1ac7bb33ca5062f75dc06944f343170a53951
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: D9118F66E5CB4305F75C3164F45237994406FD53A4F940B36EB7E1A2E6CE3CA8A34132

Function 00007FF7E71EA790 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7AF
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7CE
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA7F6
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA807
FlsSetValue.KERNEL32(?,?,?,00007FF7E71E99A3,?,?,00000000,00007FF7E71E9C3E,?,?,?,?,?,00007FF7E71E211C), ref: 00007FF7E71EA818

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 9e804fd289b4b3ef91baa5930f6d3ebb166ce1e0dbc6b955ff6578ee9fb93aad
Instruction ID: d5eeabedc25729b4e0f8c0f6eed0f2754fa6855549d79e58a5f6690bfc32d516
Opcode Fuzzy Hash: 9e804fd289b4b3ef91baa5930f6d3ebb166ce1e0dbc6b955ff6578ee9fb93aad
Instruction Fuzzy Hash: 4B114D20F0D70243FA58B325F645779D2569F847B0F885236D93D866D6DE3CA4478222

Function 00007FF7E71EA624 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA635
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA654
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA67C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA68D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7E71F2363,?,?,?,00007FF7E71ECABC,?,?,00000000,00007FF7E71E398F), ref: 00007FF7E71EA69E

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: abd555598871f52e6c51055266dbbfd9f3064b5a0b37023567c52a13d64941c3
Instruction ID: 856011661a76659a8d524d540cf2a579bb0b887f4891215d89f394e2167bbaf1
Opcode Fuzzy Hash: abd555598871f52e6c51055266dbbfd9f3064b5a0b37023567c52a13d64941c3
Instruction Fuzzy Hash: 2611C520E0930343FA58B631E5553B992569FCA374E991636D93E8A2D6DD3CB8478233

Function 00007FF7E71EF0C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EF3A7

Part of subcall function 00007FF7E71F53A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F53C1

Strings

UTF-8, xrefs: 00007FF7E71EF326
ccs, xrefs: 00007FF7E71EF2E2
UTF-16LEUNICODE, xrefs: 00007FF7E71EF345

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0a85a650483ad60012865602343b5a273e15b3a1a81ddf8674274c6c15df3bc7
Instruction ID: 3d3c0ff671adf808035cb89a4006415650950afda0442d3fb5a85e081d6be77c
Opcode Fuzzy Hash: 0a85a650483ad60012865602343b5a273e15b3a1a81ddf8674274c6c15df3bc7
Instruction Fuzzy Hash: FA817376D283C387F6E46E25E100378A698EB95784FD54036DE29D7285DB3DE5039323

Function 00007FF8A8228F10 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 164COMMON

Download Yara Rule

Strings

..\s\crypto\ocsp\ocsp_ht.c, xrefs: 00007FF8A8228F62, 00007FF8A8228FEE, 00007FF8A82290EB
Code=, xrefs: 00007FF8A8229101
,Reason=, xrefs: 00007FF8A8229129

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID: ,Reason=$..\s\crypto\ocsp\ocsp_ht.c$Code=
API String ID: 0-3537114172
Opcode ID: 7672857414660bc8a8195c2c59cdcbe769d35fde41cd35e93c0dcfabc3770a3e
Instruction ID: 4bf54a4ec72fdff0a8de2d83a8e2ca5291a3fd8251da7d2a070e85c9c9c3ac95
Opcode Fuzzy Hash: 7672857414660bc8a8195c2c59cdcbe769d35fde41cd35e93c0dcfabc3770a3e
Instruction Fuzzy Hash: 3661F462A0E99296FB109B21941037977D0FF513C4F584031EB9D47ACAEF3EE5A5CB28

Function 00007FF7E71DE048 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7E71DE094
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7E71DE0E3

Strings

MOC, xrefs: 00007FF7E71DE0A8
RCC, xrefs: 00007FF7E71DE0B1

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: b915d9317e93b4a578d272aa80a630b017422358f6ab493f0d79254b27da14c1
Instruction ID: a9a77a9b453d8a5502f18ddc12444421bc0db40da9cca548e5723c79b417445b
Opcode Fuzzy Hash: b915d9317e93b4a578d272aa80a630b017422358f6ab493f0d79254b27da14c1
Instruction Fuzzy Hash: 1F618033A08B468AE710DF65E4803ADB7A0F784B89F444226EF5D17B94DF38E146CB11

Function 00007FF8A808164F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

bio callback - unknown type (%d), xrefs: 00007FF8A814C5B6
BIO[%p]: , xrefs: 00007FF8A814C3C2

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID: BIO[%p]: $bio callback - unknown type (%d)
API String ID: 0-3830480438
Opcode ID: 2b7efa2d7f133983195eaa96ed7ade69ce15e9783328cbf5c8911cc1fb04b7fd
Instruction ID: b7027c8ac435577f48d21978d4f1b29902820726d113c5adfa33945e0a7eab1b
Opcode Fuzzy Hash: 2b7efa2d7f133983195eaa96ed7ade69ce15e9783328cbf5c8911cc1fb04b7fd
Instruction Fuzzy Hash: AC31E162B0AA81A6FB118B65E8807B97690FB897C4F404031EE4E87795EF3CD486CB14

Function 00007FF8A8087351 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

host=, xrefs: 00007FF8A81496EE
..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A81495FA, 00007FF8A814967D
J, xrefs: 00007FF8A8149675

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: f7b754c11304da003edd5ed262f6ae4f6132df29b36aa80617260aab0202085c
Instruction ID: 88c5052f07dfce688d45f2069752652ce35d4fb13d166276cf97a32e4a1e4455
Opcode Fuzzy Hash: f7b754c11304da003edd5ed262f6ae4f6132df29b36aa80617260aab0202085c
Instruction Fuzzy Hash: 7D31CF72B0964196EB10DB56F44126EB3A0FB857C0F500035EB8C87BAAEF7DE591CB18

Function 00007FF8A931E920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931E96D

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931E950, 00007FF8A931EA1D

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: R_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 1767461275-1080266419
Opcode ID: 847d751282164a50081f5bb4138e8659233ca6d58bd6895a601d2cdda6b8fafc
Instruction ID: 585392b987e7908a11ac054c50ff0f77274ee69f84b58115fd2ae69727cc0d42
Opcode Fuzzy Hash: 847d751282164a50081f5bb4138e8659233ca6d58bd6895a601d2cdda6b8fafc
Instruction Fuzzy Hash: 3E317C32A0EAC196EB60DF15E4443A97670FB88BC8F641535EE8A877A9DF3DD451CB00

Function 00007FF7E71D24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D25D7
MessageBoxA.USER32 ref: 00007FF7E71D25F3

Strings

%s%s: %s, xrefs: 00007FF7E71D2558
Fatal error detected, xrefs: 00007FF7E71D25AB, 00007FF7E71D25E5

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 87d498f1f2eba1085113bd965dcd85bf0b0aec07eea02affa6468b175f4c1a2f
Instruction ID: 65cf70271a4ebc3dcbe2358d7cd2b2d53040f320e6b37d7d9817d12062056351
Opcode Fuzzy Hash: 87d498f1f2eba1085113bd965dcd85bf0b0aec07eea02affa6468b175f4c1a2f
Instruction Fuzzy Hash: 62314E72628B8291EA24FB10F4517EAA365FFC4784FC44036EB9D46699DE3CD306CB61

Function 00007FF8A80811B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 00007FF8A8149BAC
WSAGetLastError.WS2_32 ref: 00007FF8A8149BC5
closesocket.WS2_32 ref: 00007FF8A8149C27

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A8149BDB, 00007FF8A8149BF7

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ErrorLastacceptclosesocket
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 3541127826-3200932406
Opcode ID: 5d140a51ca35b2a0dc11cd9821e34d4a8ce9bccb314edc7a519d8550e7cb716c
Instruction ID: 08d098633ed0f1675e78fba7d6511c061a36243d2b570a323279f40e25a60dbe
Opcode Fuzzy Hash: 5d140a51ca35b2a0dc11cd9821e34d4a8ce9bccb314edc7a519d8550e7cb716c
Instruction Fuzzy Hash: 1C21F8B1B0AA46A6FB209B21E8452B97390FF447E4F404231E95E477D5EF3CE454CB68

Function 00007FF8A9343A15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

OPENSSL_sk_new.LIBCRYPTO-1_1 ref: 00007FF8A9343A4C
OPENSSL_sk_push.LIBCRYPTO-1_1 ref: 00007FF8A9343B4E
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A9343B71
OPENSSL_sk_pop_free.LIBCRYPTO-1_1 ref: 00007FF8A9343C21
X509_NAME_free.LIBCRYPTO-1_1 ref: 00007FF8A9343C29

Strings

..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A9343A63

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: L_sk_pop_free$E_freeL_sk_newL_sk_pushX509_
String ID: ..\s\ssl\statem\statem_lib.c
API String ID: 3595667005-2839845709
Opcode ID: aa40c92260d1995d4b12df5aa186b132f4b3732805d06ea82ad43145b965e024
Instruction ID: b86f7fec7ef4a2ec5426a619d04ea2698558a3c0d6357ec61770b5c93e2457ec
Opcode Fuzzy Hash: aa40c92260d1995d4b12df5aa186b132f4b3732805d06ea82ad43145b965e024
Instruction Fuzzy Hash: 9801F922A1EA81A9F600DF16F8006A936B0FB487C4F546135EE4C83B55DF3CD441CB00

Function 00007FF8A931AB2B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_s_socket.LIBCRYPTO-1_1 ref: 00007FF8A931AB5D
BIO_new.LIBCRYPTO-1_1 ref: 00007FF8A931AB65
ERR_put_error.LIBCRYPTO-1_1 ref: 00007FF8A931AB8D
BIO_int_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A931ABB1
BIO_next.LIBCRYPTO-1_1 ref: 00007FF8A931ABC5
BIO_up_ref.LIBCRYPTO-1_1 ref: 00007FF8A931ABDC
BIO_pop.LIBCRYPTO-1_1 ref: 00007FF8A931ABF4
BIO_free_all.LIBCRYPTO-1_1 ref: 00007FF8A931AC01
BIO_push.LIBCRYPTO-1_1 ref: 00007FF8A931AC16

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8A931AB72

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_free_allO_int_ctrlO_newO_nextO_popO_pushO_s_socketO_up_refR_put_error
String ID: ..\s\ssl\ssl_lib.c
API String ID: 2360723678-1080266419
Opcode ID: 7c74b7675c76777314ee06e766cb82ef415fcbd4f0bc4c051b5e5d8ca2f0561e
Instruction ID: 5a2bdf5dea74277f24801f8e6ff33f5de3e6e00b69363ca7e291e572acb58969
Opcode Fuzzy Hash: 7c74b7675c76777314ee06e766cb82ef415fcbd4f0bc4c051b5e5d8ca2f0561e
Instruction Fuzzy Hash: 79F09022A0EAC296FA00DF16F40169A67B0EB887C8F545430EA4C87B5AEF3CD541CB00

Function 00007FF8A8A058C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_PyUnicode_ToNumeric.PYTHON38 ref: 00007FF8A8A05903
PyErr_SetString.PYTHON38 ref: 00007FF8A8A0592B
PyFloat_FromDouble.PYTHON38 ref: 00007FF8A8A0593D

Strings

not a numeric character, xrefs: 00007FF8A8A05921

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringUnicode_
String ID: not a numeric character
API String ID: 727557307-2058156748
Opcode ID: 90b7b1040abb4b97ffc32021ebaf555ce9bddc1eccaedf9bf0701c92034c5d27
Instruction ID: d2d97991fa8e97c22a1fd6c106cbd57de0c906493e005e09d943ee4947478917
Opcode Fuzzy Hash: 90b7b1040abb4b97ffc32021ebaf555ce9bddc1eccaedf9bf0701c92034c5d27
Instruction Fuzzy Hash: 5F11E921D0FE46B5FB1487A1D45213813B0EF487E4F548430C54E632A0FF2CF885C22A

Function 00007FF8A8A04AC8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_PyUnicode_ToDecimalDigit.PYTHON38 ref: 00007FF8A8A04B01
PyErr_SetString.PYTHON38 ref: 00007FF8A8A04B21
PyLong_FromLong.PYTHON38 ref: 00007FF8A8A04B35

Strings

not a decimal, xrefs: 00007FF8A8A04B17

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringUnicode_
String ID: not a decimal
API String ID: 2585962759-3590249192
Opcode ID: 042ddd67f878e7f9465f185b59bd50f2d649d6a68f76da27a05ce4f0d5cb4412
Instruction ID: daac5c059413606b0c0fb330735894ba0e47a505a98bc5f946681554a72d3a4c
Opcode Fuzzy Hash: 042ddd67f878e7f9465f185b59bd50f2d649d6a68f76da27a05ce4f0d5cb4412
Instruction Fuzzy Hash: 36015221E0FA42A1EF048B25D49523826B1FF95BCDF588030CA0E86291FF2CF845C329

Function 00007FF7E71D3B80 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7E71D3679), ref: 00007FF7E71D3BB1

Part of subcall function 00007FF7E71D2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7E71D76B4,?,?,?,?,?,?,?,?,?,?,?,00007FF7E71D101D), ref: 00007FF7E71D2654
Part of subcall function 00007FF7E71D2620: MessageBoxW.USER32 ref: 00007FF7E71D272C

Strings

GetModuleFileNameW, xrefs: 00007FF7E71D3BC2
Failed to convert executable path to UTF-8., xrefs: 00007FF7E71D3BEA
Failed to get executable path., xrefs: 00007FF7E71D3BBB

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: ecd9224541c82b8805659ffed1dacaf8541a9c5a4d14f69c88a104199cf53391
Instruction ID: 523180b79b99d85201dc5fe24b8380c5988acbd7e05506e52c36f2574e962741
Opcode Fuzzy Hash: ecd9224541c82b8805659ffed1dacaf8541a9c5a4d14f69c88a104199cf53391
Instruction Fuzzy Hash: 16018D21B1C74281FA54F714F4863B59355AFD87C5FC41033DA6E86252DE7DE2078B22

Function 00007FF8A82A26F0 Relevance: 6.5, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,00000000,?,00007FF8A82A2DB4), ref: 00007FF8A82A2886
memcmp.VCRUNTIME140(?,?,00000000,?,00007FF8A82A2DB4), ref: 00007FF8A82A289E
memcmp.VCRUNTIME140(?,?,00000000,?,00007FF8A82A2DB4), ref: 00007FF8A82A28B6
memcmp.VCRUNTIME140(?,?,00000000,?,00007FF8A82A2DB4), ref: 00007FF8A82A28F1
memcmp.VCRUNTIME140(?,?,00000000,?,00007FF8A82A2DB4), ref: 00007FF8A82A29CD

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 6eede35ed34df6884cfaebe39a9868ddde1e4d6f7a31935b052b1a33c3694b1b
Instruction ID: 1c8b9938465525ec7324c3c59dbce05b8e6ecf9a338856e55add21d8c888219b
Opcode Fuzzy Hash: 6eede35ed34df6884cfaebe39a9868ddde1e4d6f7a31935b052b1a33c3694b1b
Instruction Fuzzy Hash: 1481B421F0A653A9FF209A62D9501BDA3A2FF54BC8F505032DE4D5BA8DEF38E445C324

Function 00007FF8A8082E50 Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8262A92
memset.VCRUNTIME140 ref: 00007FF8A8262AF4

Strings

@, xrefs: 00007FF8A8262DE0
..\s\crypto\sm2\sm2_crypt.c, xrefs: 00007FF8A8262ACB, 00007FF8A8262AFF, 00007FF8A8262B13, 00007FF8A8262B2B, 00007FF8A8262B90, 00007FF8A8262BCF, 00007FF8A8262C14, 00007FF8A8262C38, 00007FF8A8262C4A, 00007FF8A8262C6A, 00007FF8A8262CCB, 00007FF8A8262F92, 00007FF8A8262FD0

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memset
String ID: ..\s\crypto\sm2\sm2_crypt.c$@
API String ID: 2221118986-485510600
Opcode ID: 46ba152a4ee3f2e4d8dbeda11da41e2cccc771da06ded5d3876a2d78f4a9ce4d
Instruction ID: d0d3075b0385d68cf9af8e49bada5d2d16d886e391a28b3f11638135a5297beb
Opcode Fuzzy Hash: 46ba152a4ee3f2e4d8dbeda11da41e2cccc771da06ded5d3876a2d78f4a9ce4d
Instruction Fuzzy Hash: 9CF1B132A0AB82A6EB20DF15E4006BAB7A0FB85BC4F404135EE8D07799DF7CE555C718

Function 00007FF7E71EB9A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7E71EBA1F
WriteFile.KERNEL32 ref: 00007FF7E71EBCE7
WriteFile.KERNEL32 ref: 00007FF7E71EBD2D
GetLastError.KERNEL32 ref: 00007FF7E71EBDE3

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3b6644ee017022d719a3afab9fc978a5fba374dbb9fb0623c46dfb0064678277
Instruction ID: 88e532a4fdf59903b4ca8d8e429bf82b801224b392058e119db59032fe288263
Opcode Fuzzy Hash: 3b6644ee017022d719a3afab9fc978a5fba374dbb9fb0623c46dfb0064678277
Instruction Fuzzy Hash: 2CD10632B18B418AE721DF65E4806AC77B1FB84798B844137DE6E97B99DE38E017C311

Function 00007FF8A80846D8 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

), xrefs: 00007FF8A8207D5B
..\s\crypto\evp\p5_crpt.c, xrefs: 00007FF8A8207A6C, 00007FF8A8207B16, 00007FF8A8207D05, 00007FF8A8207D34, 00007FF8A8207D63

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID:
String ID: )$..\s\crypto\evp\p5_crpt.c
API String ID: 0-3563398421
Opcode ID: b935aa7f4b79a91aef52fcef466cdce5ad720e332aed8398555c8c4331f7a9a1
Instruction ID: 073e67ffe5a0b3ed63e9bb47346ea18b407357c8af09d8d8c85508cd9d2d8752
Opcode Fuzzy Hash: b935aa7f4b79a91aef52fcef466cdce5ad720e332aed8398555c8c4331f7a9a1
Instruction Fuzzy Hash: BA91A66260E647AAFA60DB21D4016BA73A0FF857C0F444031ED4D47ADADF3DE991CB28

Function 00007FF7E71EC360 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E71EC34B), ref: 00007FF7E71EC47C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7E71EC34B), ref: 00007FF7E71EC507

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: d1123a7759acd2de89f70fbc91131bac1b02d2ce66ed859b546e10adeb5b6b1d
Instruction ID: 68c114b65b4ee6bc7ccd891c4980870f6b2a71a687c7335b76591960bca0899a
Opcode Fuzzy Hash: d1123a7759acd2de89f70fbc91131bac1b02d2ce66ed859b546e10adeb5b6b1d
Instruction Fuzzy Hash: 2091B672B1875146F750AF25E84037DABA0FF84B88F945137DE2E92784DE38E4438722

Function 00007FF8A8A02030 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 196stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8A02072
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8A02090

Strings

HANGUL SYLLABLE , xrefs: 00007FF8A8A0205F
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A8A02086

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 14f9320c906fb511941c899fd50664b3a183386e9497cb69d43e80ccf855167b
Instruction ID: a1dce32aed0291867d062ffc8922206c900f14ccfc2556efcad04eee5c9c7b6c
Opcode Fuzzy Hash: 14f9320c906fb511941c899fd50664b3a183386e9497cb69d43e80ccf855167b
Instruction Fuzzy Hash: AA712132B0B64266E762CB25A8016BA72B1FF94BC5F540231EA5E476C5FF3CF8058719

Function 00007FF8A8133450 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 164stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8133533
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A813354B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8133568

Strings

content-type, xrefs: 00007FF8A813345A

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strncmp
String ID: content-type
API String ID: 1114863663-3266185539
Opcode ID: 4ea6b44201048aa57569960e6cbecb330c5f63587b6b0d17f4634f1b4d239308
Instruction ID: f7104ad56192c070683d01f14698dcb15689ccf79097a7414e52864399e9b781
Opcode Fuzzy Hash: 4ea6b44201048aa57569960e6cbecb330c5f63587b6b0d17f4634f1b4d239308
Instruction Fuzzy Hash: E2510661B0EA4266FAA28725B55037A6290FF41BE8F042230DE5E477C5DF3CD242C72C

Function 00007FF8A808112C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A818EC35
memmove.VCRUNTIME140 ref: 00007FF8A818ECE6
memmove.VCRUNTIME140 ref: 00007FF8A818ED6F

Strings

..\s\crypto\ct\ct_oct.c, xrefs: 00007FF8A818EB65, 00007FF8A818EC5D, 00007FF8A818EC7E, 00007FF8A818ECF9, 00007FF8A818ED15, 00007FF8A818ED3F, 00007FF8A818ED57

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\ct\ct_oct.c
API String ID: 2162964266-1972679481
Opcode ID: e74995c80c70969753bc7f82451ce2d68cce3f788a97597acd1f67b5f1883d60
Instruction ID: a05f15cb632bc547032e4130267f2a4557d8e1c442cb0f2f2e8ed08c2b248be2
Opcode Fuzzy Hash: e74995c80c70969753bc7f82451ce2d68cce3f788a97597acd1f67b5f1883d60
Instruction Fuzzy Hash: 3A719362A0E691AAE726DF25801157C3BB1FB55BC4F044176DE4C4738AEF3CE694CB28

Function 00007FF8A80851A5 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 118stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A8273DBA

Strings

scheme=, xrefs: 00007FF8A8273E5C
+-., xrefs: 00007FF8A8273DB3
..\s\crypto\store\store_register.c, xrefs: 00007FF8A8273E46, 00007FF8A8273F0C

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strchr
String ID: +-.$..\s\crypto\store\store_register.c$scheme=
API String ID: 2830005266-2643984209
Opcode ID: c4ad2adc88f7af0c1d80e554f3a7ebc0ff2efccd77e362ce6c836e8764d26730
Instruction ID: 32019ce80313a297fff7d1104bbd3d2c2d00a306281d542e18140eeb795f2348
Opcode Fuzzy Hash: c4ad2adc88f7af0c1d80e554f3a7ebc0ff2efccd77e362ce6c836e8764d26730
Instruction Fuzzy Hash: FE517E21A0BA53A6FF609B12D4542B973A1EF40BC4F880035DA4C97699DF3CE9958728

Function 00007FF8A80823BA Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8174A6B
memset.VCRUNTIME140 ref: 00007FF8A8174B4D

Strings

..\s\crypto\buffer\buffer.c, xrefs: 00007FF8A8174A97, 00007FF8A8174AEE, 00007FF8A8174B08
c, xrefs: 00007FF8A8174B0F

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memset
String ID: ..\s\crypto\buffer\buffer.c$c
API String ID: 2221118986-1501028754
Opcode ID: 5b87d586cf4dc39aea692cc76c673ced3dbe4c204831252cf59d6b6975b04c65
Instruction ID: b1838f5d576ae15cd93ea033d396914824ff90d55dd0925cff299855ecc079a5
Opcode Fuzzy Hash: 5b87d586cf4dc39aea692cc76c673ced3dbe4c204831252cf59d6b6975b04c65
Instruction Fuzzy Hash: 4E31D232B0A68196EB11CB15F4402B963A0FB48BC8F444535DF4D47B99DF3CE5A6CB18

Function 00007FF8A82ACB10 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A82ACB6B

Strings

ASN1:, xrefs: 00007FF8A82ACB94
DER:, xrefs: 00007FF8A82ACB5E

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strncmp
String ID: ASN1:$DER:
API String ID: 1114863663-1445514312
Opcode ID: 5e28ab8016f658f7ac30c45286e0504713d1acc923e26fef341e740adc3428fd
Instruction ID: 5db61052bcc175a088736218d06d03ad561e5e4f870472fe67dfd65ab3ab87cd
Opcode Fuzzy Hash: 5e28ab8016f658f7ac30c45286e0504713d1acc923e26fef341e740adc3428fd
Instruction Fuzzy Hash: C3212861B0DA81A5FB508B21A94037AB7A0FF84BD4F481530DA9E437C8DF3EE610C714

Function 00007FF8A92F18FC Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

RAND_priv_bytes.LIBCRYPTO-1_1 ref: 00007FF8A935BE1B
BN_bin2bn.LIBCRYPTO-1_1 ref: 00007FF8A935BE30
OPENSSL_cleanse.LIBCRYPTO-1_1 ref: 00007FF8A935BE46
SRP_Calc_B.LIBCRYPTO-1_1 ref: 00007FF8A935BE67

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: Calc_D_priv_bytesL_cleanseN_bin2bn
String ID:
API String ID: 4178199679-0
Opcode ID: 13717ff360d6b02c216483c690ed7dd06748524545c45099944b83d41051d5ff
Instruction ID: 89f70d5bd4f13b606aa35dba29e600d4d81b1c764fc569fc5eb49e70ecb37dd5
Opcode Fuzzy Hash: 13717ff360d6b02c216483c690ed7dd06748524545c45099944b83d41051d5ff
Instruction Fuzzy Hash: 68212122A1EEC195FB919F15E4503A962F0FF48BC8F486036DA4C8A799DF7CE5418B80

Function 00007FF8A80822CF Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A82326EA

Strings

..\s\crypto\pem\pem_pkey.c, xrefs: 00007FF8A8232714, 00007FF8A8232739, 00007FF8A8232750
DH PARAMETERS, xrefs: 00007FF8A823269B
X9.42 DH PARAMETERS, xrefs: 00007FF8A82326D9

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: strcmp
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 1004003707-3633731555
Opcode ID: 839ae0263380899899197dd2457bd8dbfe3de3b111a238dbcc90d4e2215c9260
Instruction ID: 7935ce92f6ab1497f9e2c2a07b4f69e2646485d6ffcb58038318fe578c42ef22
Opcode Fuzzy Hash: 839ae0263380899899197dd2457bd8dbfe3de3b111a238dbcc90d4e2215c9260
Instruction Fuzzy Hash: 89217421A0EF46A2EB20DB55E4101B9B3A0FF947D0F444036EA8C47799EF7CD595CB28

Function 00007FF7E71D1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7E71D1FA4
SetWindowLongPtrW.USER32 ref: 00007FF7E71D1FC6
GetWindowLongPtrW.USER32 ref: 00007FF7E71D1FF0
InvalidateRect.USER32 ref: 00007FF7E71D2010

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 7ae150d53b8b86cb67fa86c5e81452d3956d568a63a99bc336b13b90577f37e1
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 8C110021E1834241F654A759F5843FA9292EFC9BC1FC94032EB6907B8DCE3CD4D75612

Function 00007FF8A92F19C9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

BIO_find_type.LIBCRYPTO-1_1 ref: 00007FF8A92F4A80
BIO_find_type.LIBCRYPTO-1_1 ref: 00007FF8A92F4A90
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FF8A92F4AA5
BIO_get_data.LIBCRYPTO-1_1 ref: 00007FF8A92F4AB0

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_find_typeO_get_data
String ID:
API String ID: 280995463-0
Opcode ID: 55bb9ab577713c48f03e10ed0a358675e4ccdc34a6c9781f0ae84dd772a97ccb
Instruction ID: 56bd16208148288e022ca2ac1dbf86d4ecb703ba99ad352bae810ded1ed0aba9
Opcode Fuzzy Hash: 55bb9ab577713c48f03e10ed0a358675e4ccdc34a6c9781f0ae84dd772a97ccb
Instruction Fuzzy Hash: EA019211F0FAC2A1FA449E57A05427A6290DF88FC4F489030ED6D8BB8EDE9CE8518704

Function 00007FF8A80869C9 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A8253D5B
memmove.VCRUNTIME140 ref: 00007FF8A8253D6F

Strings

$, xrefs: 00007FF8A8253D34
..\s\crypto\rsa\rsa_none.c, xrefs: 00007FF8A8253D2D

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmovememset
String ID: $$..\s\crypto\rsa\rsa_none.c
API String ID: 1288253900-779172340
Opcode ID: fff434aa3adaa680fae11fcc69398c2d27884fa0413e783327ef66dbb4cd5250
Instruction ID: f500aba9d8b56623ecd5977b6cc1affd92567eb100fe86741bdfb647fecbd30f
Opcode Fuzzy Hash: fff434aa3adaa680fae11fcc69398c2d27884fa0413e783327ef66dbb4cd5250
Instruction Fuzzy Hash: 2C01D831B0A64256E620DF16A9441B9B761FF857D0F148130FB4C47B9DDF3CD5518B14

Function 00007FF8A9341980 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8A9341A57

Part of subcall function 00007FF8A92F1032: EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8A93406F6
Part of subcall function 00007FF8A92F1032: EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8A93406FE
Part of subcall function 00007FF8A92F1032: EVP_MD_CTX_md.LIBCRYPTO-1_1 ref: 00007FF8A9340710
Part of subcall function 00007FF8A92F1032: EVP_MD_size.LIBCRYPTO-1_1 ref: 00007FF8A9340718
Part of subcall function 00007FF8A92F1032: EVP_CIPHER_CTX_cipher.LIBCRYPTO-1_1 ref: 00007FF8A9340731
Part of subcall function 00007FF8A92F1032: EVP_CIPHER_flags.LIBCRYPTO-1_1 ref: 00007FF8A9340739
Part of subcall function 00007FF8A92F1032: EVP_CIPHER_CTX_block_size.LIBCRYPTO-1_1 ref: 00007FF8A934074F
Part of subcall function 00007FF8A92F1032: BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A93407C3

BIO_ctrl.LIBCRYPTO-1_1 ref: 00007FF8A9341B87

Strings

..\s\ssl\statem\statem_dtls.c, xrefs: 00007FF8A9341BE0

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_ctrlR_flagsX_cipher$D_sizeX_block_sizeX_mdmemcpy
String ID: ..\s\ssl\statem\statem_dtls.c
API String ID: 1483294773-3140652063
Opcode ID: 65bc36109f87ded58f1468487f4347a594c1ba6b7d43bbdfc4a547d652be14ea
Instruction ID: 44a0f05a308bed3cda279f39ec51e2f236ff6838c74ff3c939b42a90f76ec69c
Opcode Fuzzy Hash: 65bc36109f87ded58f1468487f4347a594c1ba6b7d43bbdfc4a547d652be14ea
Instruction Fuzzy Hash: 4C617A32209BC4A2E784DF16E5847AA77A8FB88B80F514136EF9C83756DF38D464C700

Function 00007FF7E71F4C6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71F07D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71F0803

_get_daylight.LIBCMT ref: 00007FF7E71F4D84
_get_daylight.LIBCMT ref: 00007FF7E71F4D95

Strings

?, xrefs: 00007FF7E71F4D15

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 814948e3221e39c8f46cf349b38774dda4ab7a8497a902a8fbf1b82dff6223ab
Instruction ID: dc742c933d4e5f9f3e476a8444e1fed128d1e19b09272340315672a4defe11e4
Opcode Fuzzy Hash: 814948e3221e39c8f46cf349b38774dda4ab7a8497a902a8fbf1b82dff6223ab
Instruction Fuzzy Hash: BD41B312A1878246FB78AB25F401379E6A0EFD07A4F944237EF6C46AD9DE3CD4538711

Function 00007FF8A8081DD9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF8A8146269
getaddrinfo.WS2_32 ref: 00007FF8A81462A4

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FF8A81462D1, 00007FF8A8146318, 00007FF8A8146344

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: 771589308279e72556af8e05230908b6e5bd466e7e0002c3b317445296434c65
Instruction ID: 6f14a7f701ca78209258b32a8b2105db2a03bba2e6efebf9516621757774e383
Opcode Fuzzy Hash: 771589308279e72556af8e05230908b6e5bd466e7e0002c3b317445296434c65
Instruction Fuzzy Hash: B741D5B2A19682D7F761CF12A444AAE73A0FB847C4F504135EA8E83B85DF3CD885CB54

Function 00007FF7E71E7D9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71E7DCE

Part of subcall function 00007FF7E71E9D48: HeapFree.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D5E
Part of subcall function 00007FF7E71E9D48: GetLastError.KERNEL32(?,?,?,00007FF7E71F1D72,?,?,?,00007FF7E71F1DAF,?,?,00000000,00007FF7E71F2275,?,?,?,00007FF7E71F21A7), ref: 00007FF7E71E9D68

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7E71DADA5), ref: 00007FF7E71E7DEC

Strings

C:\Users\user\Desktop\wsx.exe, xrefs: 00007FF7E71E7DDA

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\wsx.exe
API String ID: 3580290477-2252155340
Opcode ID: 78bb50e8dbf74795731634f2bf23dc57cb2593a68118be5c005d29b839edbd54
Instruction ID: fe6651bf93def5140c5bd12bbebf4bdb83f707dac9fad70197528b0497c54f1c
Opcode Fuzzy Hash: 78bb50e8dbf74795731634f2bf23dc57cb2593a68118be5c005d29b839edbd54
Instruction Fuzzy Hash: 07414136A0871286F715EF25E8402F9B7A4FF84794B944036E96E87745DF3CE4928362

Function 00007FF7E71EC038 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7E71EC14F
GetLastError.KERNEL32 ref: 00007FF7E71EC171

Strings

U, xrefs: 00007FF7E71EC0FB

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 25d3c82af5dee18dec41a6839be42a4efbc899a14913ea0c1072e724c64aea02
Instruction ID: 64e6eb64b230df994e44bf9ac783c5bdef570d073f992b6904f266874684ede3
Opcode Fuzzy Hash: 25d3c82af5dee18dec41a6839be42a4efbc899a14913ea0c1072e724c64aea02
Instruction Fuzzy Hash: 6D41B432718B4186DB20EF25F8443AAA761FB88794F944032EE5D87798DF3CE442C751

Function 00007FF7E71EE438 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E71EE478
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7E71EE4CA

Strings

:, xrefs: 00007FF7E71EE48E

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4e53f776409002b20d4ddb835971d11a9637ed93fbd7b6ab35eb1d8227726c82
Instruction ID: 0e7b3ad9aa68a1b4ae70c4cad15029da38746bf6741badb2a76affc70e5b4bf7
Opcode Fuzzy Hash: 4e53f776409002b20d4ddb835971d11a9637ed93fbd7b6ab35eb1d8227726c82
Instruction Fuzzy Hash: 85218472A0874282FB24EB25E44836DA3B1FBC4B44F854036D65D87284DF7CE946C762

Function 00007FF8A92F1E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A934A98E
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A934A99B

Strings

..\s\ssl\statem\statem_srvr.c, xrefs: 00007FF8A934A9BF

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: ..\s\ssl\statem\statem_srvr.c
API String ID: 3946675294-348624464
Opcode ID: f72d8c808f0ddc2858006bf43311b3eaee8c549827a86fdfb0cacc211c15fd48
Instruction ID: 89df4cb4d60420e11a1ba00ccee298e11ee19d0dff79a22c38c0f12ddc3b3674
Opcode Fuzzy Hash: f72d8c808f0ddc2858006bf43311b3eaee8c549827a86fdfb0cacc211c15fd48
Instruction Fuzzy Hash: 3E21B232B0EA8296FB50DF11D4947B827A1EBC9784F925131DA4DC778ACE7CD581C702

Function 00007FF8A80850B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF8A8149867
WSAGetLastError.WS2_32 ref: 00007FF8A8149872

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A8149826, 00007FF8A8149888, 00007FF8A81498A4, 00007FF8A81498D7

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 566540725-540685895
Opcode ID: 230d538b329935829540f5cac83dfc4c1f0c1c81990223f20d16048a10e733e9
Instruction ID: 60774b67ade681fa30e143dd99301bfbb1ce5e297dda89a579adbf02e958acf8
Opcode Fuzzy Hash: 230d538b329935829540f5cac83dfc4c1f0c1c81990223f20d16048a10e733e9
Instruction Fuzzy Hash: A521B0B1A19507A6EB20DF20D8056ED73A0EF80394F504531E68C866E4DF7CE6D5CF68

Function 00007FF7E71D2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D2951
MessageBoxA.USER32 ref: 00007FF7E71D296D

Strings

Error detected, xrefs: 00007FF7E71D2925, 00007FF7E71D295F

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 06108ee8a0dfea952a12a3b0306062f889501f0bb9d520917d4d6b2389df326d
Instruction ID: 094f0d00a12819bf5f8a6c9c30803a48a007b073309cc76c9c2b49e011c6878f
Opcode Fuzzy Hash: 06108ee8a0dfea952a12a3b0306062f889501f0bb9d520917d4d6b2389df326d
Instruction Fuzzy Hash: DA21517262878291EA24E710F4917EAA365FFC4788FC04136EB9D47699DF3CD206CB61

Function 00007FF7E71D2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E71D79A0: MultiByteToWideChar.KERNEL32 ref: 00007FF7E71D79DA

MessageBoxW.USER32 ref: 00007FF7E71D2841
MessageBoxA.USER32 ref: 00007FF7E71D285D

Strings

Fatal error detected, xrefs: 00007FF7E71D2815, 00007FF7E71D284F

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: d8350b2dd45537fcb102945a95e56e5fec4cbfd54fbf68520de5e8d25681b826
Instruction ID: 468673be7787a2b0a75197d78600a4527fcd4a99ff5bfd34723f3cd4a0fe18c5
Opcode Fuzzy Hash: d8350b2dd45537fcb102945a95e56e5fec4cbfd54fbf68520de5e8d25681b826
Instruction Fuzzy Hash: 7421817262878281EA24E710F4917EAA365FFC4788FC04036EB9D47699DF3CD206CB61

Function 00007FF8A9338C6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF8A9338C8B

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 25b4da5a108e94248877386f4b2b643301c4784b1a47f71dc3b236138af4cec3
Instruction ID: de6659e870e20d289227d78a11bba49184b11ec6203f19c86e0b3771923c3fd3
Opcode Fuzzy Hash: 25b4da5a108e94248877386f4b2b643301c4784b1a47f71dc3b236138af4cec3
Instruction Fuzzy Hash: A4115166B4D58196FB808F19E08436D63B1EB85BD8F581435CB0C8B38ADEBDD4958B00

Function 00007FF8A9304AA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

BIO_write.LIBCRYPTO-1_1 ref: 00007FF8A9304B16
EVP_DigestUpdate.LIBCRYPTO-1_1 ref: 00007FF8A9304B33

Strings

..\s\ssl\s3_enc.c, xrefs: 00007FF8A9304AE3

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: DigestO_writeUpdate
String ID: ..\s\ssl\s3_enc.c
API String ID: 1267058251-1839494539
Opcode ID: 40d8540dba0296ad297b07d301ad47ced383123b8127a21799eda856f61cbd65
Instruction ID: 08d7952854e17c245b75916a6ffc9f9c6522a4d207537e3a3e576eb7dcd3aa24
Opcode Fuzzy Hash: 40d8540dba0296ad297b07d301ad47ced383123b8127a21799eda856f61cbd65
Instruction Fuzzy Hash: 1811A332B0E981A5FB608F55E58437A66F0EB887C8F585031EE5CC7799EE6CD6418700

Function 00007FF7E71DEEE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7E71DEF24
RaiseException.KERNEL32 ref: 00007FF7E71DEF6A

Strings

csm, xrefs: 00007FF7E71DEF57

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 858846fea34555fb8d2c4f12b26bdb04a58b0d9f624c4d397e9619eb30fde2ff
Instruction ID: 51e7e37a19076e4a38b42c99c9743db245e0ba8b02f0341c161e5c65c3fa885a
Opcode Fuzzy Hash: 858846fea34555fb8d2c4f12b26bdb04a58b0d9f624c4d397e9619eb30fde2ff
Instruction Fuzzy Hash: 6B113A32618B8582EB259F15F4403A9B7A5FB88B95F9C4232EF9C07768DF3CD5568B00

Function 00007FF8A92F1C85 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

EVP_MD_CTX_copy_ex.LIBCRYPTO-1_1 ref: 00007FF8A934572C

Strings

s, xrefs: 00007FF8A934573A
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8A93456FB, 00007FF8A9345742

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: X_copy_ex
String ID: ..\s\ssl\statem\statem_lib.c$s
API String ID: 774438373-646802909
Opcode ID: 92b2b1e9c41b6c7b2f40a0e2efc27d619d4c9c9030f31677c5efcaa54b7ea7ae
Instruction ID: f098257b4cba11cd98f68c6865ba32001dfc091952cdc26a99e86f6c7ed4620e
Opcode Fuzzy Hash: 92b2b1e9c41b6c7b2f40a0e2efc27d619d4c9c9030f31677c5efcaa54b7ea7ae
Instruction Fuzzy Hash: EE01D276B0F98196F7108B11E4443AA26A0EF84B94F944130D94C9B7A5DF2DD292CB00

Function 00007FF7E71EEF3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E71EEF6C
GetDriveTypeW.KERNEL32 ref: 00007FF7E71EEFAC

Strings

:, xrefs: 00007FF7E71EEF95

Memory Dump Source

Source File: 00000002.00000002.4722010126.00007FF7E71D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E71D0000, based on PE: true

Associated: 00000002.00000002.4721984887.00007FF7E71D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722042007.00007FF7E71FA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E720D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E7210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722071537.00007FF7E721C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.4722145998.00007FF7E721E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7e71d0000_wsx.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 4110ab54a1292af6c610fc14bebcfde478b3b42ba13f09fd81a5f0b3dffa68e3
Instruction ID: 407fd904f0be0d672ba40c8579cc8de132fd051b5582f0ab71f645abf26379fc
Opcode Fuzzy Hash: 4110ab54a1292af6c610fc14bebcfde478b3b42ba13f09fd81a5f0b3dffa68e3
Instruction Fuzzy Hash: 24015E6191C30387FB20BB60F45137EA3A0EF84744FC40137D66DC2691DE3CE54A8A26

Function 00007FF8A8083440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A818FB84

Strings

!, xrefs: 00007FF8A818FB61
..\s\crypto\ct\ct_policy.c, xrefs: 00007FF8A818FB43, 00007FF8A818FB5A

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: _time64
String ID: !$..\s\crypto\ct\ct_policy.c
API String ID: 1670930206-3401457818
Opcode ID: 10e2f6a2a299e7da60c3821852911bb3cc71192dbbe3a4b80bb4ef720c4b3404
Instruction ID: 4e32f21ffa8a82e2323a73c7daaa43f07c1e236c3cf2ce1f2abed87d835eafb7
Opcode Fuzzy Hash: 10e2f6a2a299e7da60c3821852911bb3cc71192dbbe3a4b80bb4ef720c4b3404
Instruction Fuzzy Hash: 4BF0CD31A17A02AAEB118B20D4163BC7390FF90384F440034DA0D023D1EF3CE6A6CB68

Function 00007FF8A8A05580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON38 ref: 00007FF8A8A055D0
PyUnicode_FromString.PYTHON38 ref: 00007FF8A8A055E7

Strings

no such name, xrefs: 00007FF8A8A055C6

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: e523bd7dcbf9f9ea1903de6f7f8a11bf4a8d7d1066bd22e94e8c20c760f4f1c9
Instruction ID: 5cfab3effe140b18863e0d046874dfe43487cc630471d3882ffa3accbc38bc27
Opcode Fuzzy Hash: e523bd7dcbf9f9ea1903de6f7f8a11bf4a8d7d1066bd22e94e8c20c760f4f1c9
Instruction Fuzzy Hash: DB014B31A1BE42A1FA218B21E8223B52370EF9CB89F501031CE4E56251FF2CF0458626

Function 00007FF8A9338C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A9338D5B
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A9338D68

Strings

', xrefs: 00007FF8A9338C39

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: '
API String ID: 3946675294-1997036262
Opcode ID: b3c6ea87836551e68182ae0c3ee2d858efeb1840fb1257a68ec061d57f9d5784
Instruction ID: 3b9c92e568a1a6f92cbd8b3885d9ff45ea4eb6a5d4d3b6dc90352d7cb80a71cc
Opcode Fuzzy Hash: b3c6ea87836551e68182ae0c3ee2d858efeb1840fb1257a68ec061d57f9d5784
Instruction Fuzzy Hash: 81F06262B0D68196EB409F26E04437D23A1EB89BD8F585038CA4C8B7CADEBCC4858700

Function 00007FF8A9338BE2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

BIO_clear_flags.LIBCRYPTO-1_1 ref: 00007FF8A9338D5B
BIO_set_flags.LIBCRYPTO-1_1 ref: 00007FF8A9338D68

Strings

&, xrefs: 00007FF8A9338BEB

Memory Dump Source

Source File: 00000002.00000002.4723733276.00007FF8A92F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF8A92F0000, based on PE: true

Associated: 00000002.00000002.4723706386.00007FF8A92F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723733276.00007FF8A9362000.00000020.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723807412.00007FF8A9364000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723835100.00007FF8A9387000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A938C000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9392000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000002.00000002.4723863739.00007FF8A9399000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a92f0000_wsx.jbxd

Similarity

API ID: O_clear_flagsO_set_flags
String ID: &
API String ID: 3946675294-1010288
Opcode ID: 2cbf94f39a3d20bcb47c59b9fa8e42cb6a5de0a8db5b2cef822bba8d52f711fc
Instruction ID: 39529441940d4fa674d51c882ca906db2b6c572b7f2c04a358a3db6146fe0ec2
Opcode Fuzzy Hash: 2cbf94f39a3d20bcb47c59b9fa8e42cb6a5de0a8db5b2cef822bba8d52f711fc
Instruction Fuzzy Hash: 0BF09662B0D58186FB40DF16E44437D23A1EB89BD8F585034CA4C8B7CADFBDC4858700

Function 00007FF8A8A04ED4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_PyUnicode_ToDigit.PYTHON38 ref: 00007FF8A8A04EDF
PyErr_SetString.PYTHON38 ref: 00007FF8A8A04EFF

Strings

not a digit, xrefs: 00007FF8A8A04EF5

Memory Dump Source

Source File: 00000002.00000002.4722885346.00007FF8A8A01000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FF8A8A00000, based on PE: true

Associated: 00000002.00000002.4722869539.00007FF8A8A00000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A06000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8A5C000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AA7000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AAB000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8AB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4722907835.00007FF8A8B05000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723115131.00007FF8A8B09000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.4723139253.00007FF8A8B0B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8a00000_wsx.jbxd

Similarity

API ID: DigitErr_StringUnicode_
String ID: not a digit
API String ID: 1987352478-3016634541
Opcode ID: 97182ee07ba3ede72632394d0b49dffa3f738fe4c3db1f6da409a670c2574500
Instruction ID: c4f47b29f268529d41f853bda3419257c781fb01e76a91bfb91a6796e57f91b1
Opcode Fuzzy Hash: 97182ee07ba3ede72632394d0b49dffa3f738fe4c3db1f6da409a670c2574500
Instruction Fuzzy Hash: 74F0AC61F0BA06A1FB145B66985213512B1FF98FCDF541431CA1E86361FF6CB495832A

Function 00007FF8A808526D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A8149A22
WSAGetLastError.WS2_32 ref: 00007FF8A8149A2E

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A8149A44

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: 5740e7aa341a39e2a17b5874affd40281456fb5e085b1d01af788d5d0b0a0384
Instruction ID: f925050eed6b959fbab38f87840d5b9543fa51fe9e18ba1256eb958521ded0ef
Opcode Fuzzy Hash: 5740e7aa341a39e2a17b5874affd40281456fb5e085b1d01af788d5d0b0a0384
Instruction Fuzzy Hash: 11E092A0B1A503A6F7119B60D8057752350EF04385F100530D94EC2291EF7DA164CA28

Function 00007FF8A80851C8 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A8178DF0
memmove.VCRUNTIME140 ref: 00007FF8A8178E00
memmove.VCRUNTIME140 ref: 00007FF8A8178E10
memmove.VCRUNTIME140 ref: 00007FF8A8178E20

Memory Dump Source

Source File: 00000002.00000002.4722207742.00007FF8A8081000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8A8080000, based on PE: true

Associated: 00000002.00000002.4722179964.00007FF8A8080000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A808D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80E5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A80F9000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A810A000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A8110000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A811D000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722207742.00007FF8A82C5000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82C7000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A82F2000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8323000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A8349000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722585633.00007FF8A836E000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722742186.00007FF8A8395000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722762091.00007FF8A839B000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A839D000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83B9000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4722788037.00007FF8A83BD000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8a8080000_wsx.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: bd87426aa5976e2e44b02db415de2f1a8c7fc3c09a2b410ca9d7a361decc8cb4
Instruction ID: f28cabbfc2f2557132004b33c79c52af234c026d4fc873e6490eec135bf4fee7
Opcode Fuzzy Hash: bd87426aa5976e2e44b02db415de2f1a8c7fc3c09a2b410ca9d7a361decc8cb4
Instruction Fuzzy Hash: 58110876605641A2E710EB2AE1401ED7360FF447D0F448531EB5D47BE6EF28E5A0C714

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wsx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI18922\VCRUNTIME140_1.dll

C:\Users\user\AppData\Local\Temp\_MEI18922\_asyncio.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_cffi_backend.cp38-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_overlapped.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI18922\api-ms-win-core-errorhandling-l1-1-0.dll

Windows Analysis Report
wsx.exe