Edit tour

Windows Analysis Report
uOsIQqfgiT.exe

Overview

General Information

Sample name:	uOsIQqfgiT.exe renamed because original name is a hash value
Original sample name:	a12133b2aadd267558975a8952daac3e.exe
Analysis ID:	1567371
MD5:	a12133b2aadd267558975a8952daac3e
SHA1:	4f770593e992d7423aafdc6a2593d18d46d5f21b
SHA256:	bbdd058ce8a5e7ebfcd229b2a6edd562497b4c58f3c7efb30b2cf73be35302a4
Tags:	exeuser-abuse_ch
Infos:

Detection

Charity, TrojanRansom

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Charity Ransomware

Yara detected TrojanRansom

AI detected suspicious sample

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Deletes shadow drive data (may be related to ransomware)

Found pyInstaller with non standard icon

Performs a network lookup / discovery via net view

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May use bcdedit to modify the Windows boot settings

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uOsIQqfgiT.exe (PID: 3468 cmdline: "C:\Users\user\Desktop\uOsIQqfgiT.exe" MD5: A12133B2AADD267558975A8952DAAC3E)

uOsIQqfgiT.exe (PID: 352 cmdline: "C:\Users\user\Desktop\uOsIQqfgiT.exe" MD5: A12133B2AADD267558975A8952DAAC3E)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7888 cmdline: net view \\192.168.1.1 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 5544 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.2" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7184 cmdline: net view \\192.168.1.2 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 7248 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.3" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7268 cmdline: net view \\192.168.1.3 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 7324 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.4" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7336 cmdline: net view \\192.168.1.4 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 7588 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.5" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7656 cmdline: net view \\192.168.1.5 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 7716 cmdline: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.6" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net.exe (PID: 7784 cmdline: net view \\192.168.1.6 MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: uOsIQqfgiT.exe PID: 352	JoeSecurity_Charity	Yara detected Charity Ransomware	Joe Security
Process Memory Space: uOsIQqfgiT.exe PID: 352	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security

Sigma Signatures

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net view \\192.168.1.1, CommandLine: net view \\192.168.1.1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: net view \\192.168.1.1, ProcessId: 7888, ProcessName: net.exe

Sigma detected: Share And Session Enumeration Using Net.EXE

Source: Process started

Author: Endgame, JHasenbusch (ported for oscd.community): Data: Command: net view \\192.168.1.1, CommandLine: net view \\192.168.1.1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: net view \\192.168.1.1, ProcessId: 7888, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.1.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.82:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.1.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.1.82:445	Jump to behavior

Source: uOsIQqfgiT.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\Ransom\Charity-master\Charity-master\Charity\obj\x86\Release\Reader_en_install.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983892174.00007FFE1323C000.00000002.00000001.01000000.00000009.sdmp, _lzma.pyd.0.dr
Source:	Binary string: .db.dbf.mdb.pdb.sql.dwg.dxf.asp source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983892174.00007FFE1323C000.00000002.00000001.01000000.00000009.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1721791015.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: uOsIQqfgiT.exe, 00000000.00000003.1721791015.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\Ransom\Charity-master\Charity-master\Charity-Decrypt\obj\x64\Debug\Decrypt.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmp, _socket.pyd.0.dr
Source:	Binary string: .db.dbf.mdb.pdb.sql source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2982548664.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr

Spreading

Performs a network lookup / discovery via net view

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.4
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.5
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.6
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.4	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.6	Jump to behavior

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019885A0 FindFirstFileExW,FindClose,	0_2_00007FF6019885A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019879B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6019879B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6019A0B84
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019885A0 FindFirstFileExW,FindClose,	1_2_00007FF6019885A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019879B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6019879B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6019A0B84

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 1_2_00007FFE132057F8 recv,

1_2_00007FFE132057F8

Source: uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000002.2980413583.00000206433AD000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000002.2980413583.00000206433AD000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000002.2980413583.00000206433AD000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000002.2980413583.00000206433AD000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000002.2980413583.00000206433AD000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 341vtfaf.exe.1.dr	String found in binary or memory: http://tempuri.org/
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	String found in binary or memory: http://tempuri.org/AddInfectionT
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	String found in binary or memory: http://tempuri.org/HelloWorldT
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	String found in binary or memory: http://tempuri.org/T
Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1725183603.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1723618048.00000206433AB000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1724431817.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.dr, _ctypes.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	String found in binary or memory: http://www.google.com/
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	String found in binary or memory: http://www.google.com/Cnetsh
Source: uOsIQqfgiT.exe, 00000001.00000003.1730499077.00000234DCF73000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: uOsIQqfgiT.exe, 00000001.00000002.2980556430.00000234DC918000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728638342.00000234DAFBA000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: uOsIQqfgiT.exe, 00000001.00000002.2981023076.00000234DCE30000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://peps.python.org/pep-0205/
Source: uOsIQqfgiT.exe, 00000001.00000002.2982548664.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H
Source: uOsIQqfgiT.exe, 00000001.00000002.2980556430.00000234DC890000.00000004.00001000.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1729812463.00000234DCDA4000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1729852937.00000234DCD8B000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: uOsIQqfgiT.exe, 00000001.00000002.2982740122.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.dr	String found in binary or memory: https://www.python.org/psf/license/

Spam, unwanted Advertisements and Ransom Demands

Yara detected Charity Ransomware

Source: Yara match

File source: Process Memory Space: uOsIQqfgiT.exe PID: 352, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: uOsIQqfgiT.exe PID: 352, type: MEMORYSTR

Deletes shadow drive data (may be related to ransomware)

Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: M/C vssadmin Delete Shadows /All /Quiet
Source: 341vtfaf.exe.1.dr	Binary or memory string: M/C vssadmin Delete Shadows /All /Quiet

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A5C74	0_2_00007FF6019A5C74
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601981000	0_2_00007FF601981000
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601988B20	0_2_00007FF601988B20
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601990A60	0_2_00007FF601990A60
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A8A38	0_2_00007FF6019A8A38
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601997AAC	0_2_00007FF601997AAC
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601991280	0_2_00007FF601991280
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60199D200	0_2_00007FF60199D200
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019991B0	0_2_00007FF6019991B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A518C	0_2_00007FF6019A518C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601992CC4	0_2_00007FF601992CC4
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601990C64	0_2_00007FF601990C64
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601991484	0_2_00007FF601991484
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60199FBD8	0_2_00007FF60199FBD8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019973F4	0_2_00007FF6019973F4
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A33BC	0_2_00007FF6019A33BC
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A0B84	0_2_00007FF6019A0B84
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A2F20	0_2_00007FF6019A2F20
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601991F30	0_2_00007FF601991F30
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60199FBD8	0_2_00007FF60199FBD8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A5728	0_2_00007FF6019A5728
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A4F10	0_2_00007FF6019A4F10
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601990E70	0_2_00007FF601990E70
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019895FB	0_2_00007FF6019895FB
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60199CD6C	0_2_00007FF60199CD6C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019928C0	0_2_00007FF6019928C0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601991074	0_2_00007FF601991074
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601995040	0_2_00007FF601995040
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60199D880	0_2_00007FF60199D880
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601989FCD	0_2_00007FF601989FCD
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60198979B	0_2_00007FF60198979B
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A5C74	1_2_00007FF6019A5C74
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019895FB	1_2_00007FF6019895FB
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601981000	1_2_00007FF601981000
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601988B20	1_2_00007FF601988B20
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601990A60	1_2_00007FF601990A60
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A8A38	1_2_00007FF6019A8A38
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601997AAC	1_2_00007FF601997AAC
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601991280	1_2_00007FF601991280
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60199D200	1_2_00007FF60199D200
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019991B0	1_2_00007FF6019991B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A518C	1_2_00007FF6019A518C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601992CC4	1_2_00007FF601992CC4
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601990C64	1_2_00007FF601990C64
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601991484	1_2_00007FF601991484
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60199FBD8	1_2_00007FF60199FBD8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019973F4	1_2_00007FF6019973F4
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A33BC	1_2_00007FF6019A33BC
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A0B84	1_2_00007FF6019A0B84
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A2F20	1_2_00007FF6019A2F20
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601991F30	1_2_00007FF601991F30
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60199FBD8	1_2_00007FF60199FBD8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A5728	1_2_00007FF6019A5728
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A4F10	1_2_00007FF6019A4F10
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601990E70	1_2_00007FF601990E70
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60199CD6C	1_2_00007FF60199CD6C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019928C0	1_2_00007FF6019928C0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601991074	1_2_00007FF601991074
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601995040	1_2_00007FF601995040
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60199D880	1_2_00007FF60199D880
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601989FCD	1_2_00007FF601989FCD
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60198979B	1_2_00007FF60198979B
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13201060	1_2_00007FFE13201060
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13221BB0	1_2_00007FFE13221BB0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132253A0	1_2_00007FFE132253A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13222FF0	1_2_00007FFE13222FF0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1322F81C	1_2_00007FFE1322F81C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132212B0	1_2_00007FFE132212B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13226EAC	1_2_00007FFE13226EAC
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13228D40	1_2_00007FFE13228D40
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13225CE0	1_2_00007FFE13225CE0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13222530	1_2_00007FFE13222530
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13253E60	1_2_00007FFE13253E60
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13252EB0	1_2_00007FFE13252EB0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13253BD0	1_2_00007FFE13253BD0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1325C7D8	1_2_00007FFE1325C7D8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132560C0	1_2_00007FFE132560C0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13251000	1_2_00007FFE13251000
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13273F50	1_2_00007FFE13273F50
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13271F50	1_2_00007FFE13271F50
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132727A0	1_2_00007FFE132727A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132739F0	1_2_00007FFE132739F0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132732E0	1_2_00007FFE132732E0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13272ED0	1_2_00007FFE13272ED0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13303200	1_2_00007FFE13303200
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1A457778	1_2_00007FFE1A457778
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1A459620	1_2_00007FFE1A459620

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: String function: 00007FF6019825F0 appears 100 times
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: String function: 00007FF601982760 appears 36 times

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 341vtfaf.exe.1.dr

Static PE information: No import functions for PE file found

Source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1722009410.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1721791015.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe	Binary or memory string: OriginalFilename vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2983949029.00007FFE13245000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDecrypt.exe" vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReader_en_install.exe: vs uOsIQqfgiT.exe
Source: uOsIQqfgiT.exe, 00000001.00000002.2983641825.00007FFDFBAB7000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython311.dll. vs uOsIQqfgiT.exe

Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	Binary or memory string: .csproj
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	Binary or memory string: .sh.sln
Source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	Binary or memory string: .csproj.dll

Source: classification engine

Classification label: mal80.rans.spre.expl.winEXE@33/14@0/100

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF6019829E0 GetLastError,FormatMessageW,MessageBoxW,

0_2_00007FF6019829E0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3584:120:WilError_03

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI34682

Jump to behavior

Source: uOsIQqfgiT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

File read: C:\Users\user\Desktop\uOsIQqfgiT.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\uOsIQqfgiT.exe "C:\Users\user\Desktop\uOsIQqfgiT.exe"
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Users\user\Desktop\uOsIQqfgiT.exe "C:\Users\user\Desktop\uOsIQqfgiT.exe"
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.1
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.2"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.2
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.3"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.3
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.4"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.4
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.5"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.5
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.6"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.6
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Users\user\Desktop\uOsIQqfgiT.exe "C:\Users\user\Desktop\uOsIQqfgiT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.2"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.3"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.4"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.5"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.6"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.4	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.6	Jump to behavior

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior

Source: uOsIQqfgiT.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: uOsIQqfgiT.exe

Static file information: File size 6746220 > 1048576

Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: uOsIQqfgiT.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: uOsIQqfgiT.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: uOsIQqfgiT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1727351824.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmp, select.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1727533857.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmp, _ctypes.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722297507.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
Source:	Binary string: D:\Ransom\Charity-master\Charity-master\Charity\obj\x86\Release\Reader_en_install.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983892174.00007FFE1323C000.00000002.00000001.01000000.00000009.sdmp, _lzma.pyd.0.dr
Source:	Binary string: .db.dbf.mdb.pdb.sql.dwg.dxf.asp source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1u 30 May 2023built on: Wed May 31 23:27:41 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983892174.00007FFE1323C000.00000002.00000001.01000000.00000009.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1721907780.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmp, _bz2.pyd.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1721791015.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: uOsIQqfgiT.exe, 00000000.00000003.1721791015.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\Ransom\Charity-master\Charity-master\Charity-Decrypt\obj\x64\Debug\Decrypt.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: uOsIQqfgiT.exe, 00000000.00000003.1722768631.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmp, _socket.pyd.0.dr
Source:	Binary string: .db.dbf.mdb.pdb.sql source: uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python311.pdb source: uOsIQqfgiT.exe, 00000001.00000002.2982548664.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr

Source: uOsIQqfgiT.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: uOsIQqfgiT.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: uOsIQqfgiT.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: uOsIQqfgiT.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: uOsIQqfgiT.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: python311.dll.0.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1322D390 push rsi; iretd		1_2_00007FFE1322D3A5
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1322D418 push rsi; retf		1_2_00007FFE1322D419

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Process created: "C:\Users\user\Desktop\uOsIQqfgiT.exe"

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\341vtfaf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI34682\libffi-8.dll	Jump to dropped file

Source: 341vtfaf.exe.1.dr

Binary or memory string: bcdedit.exe

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF601986EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF601986EA0

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\341vtfaf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17321

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

API coverage: 2.2 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019885A0 FindFirstFileExW,FindClose,	0_2_00007FF6019885A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019879B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6019879B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF6019A0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6019A0B84
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019885A0 FindFirstFileExW,FindClose,	1_2_00007FF6019885A0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019879B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF6019879B0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF6019A0B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6019A0B84

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 1_2_00007FFE13272E00 Sleep,GetSystemInfo,abort,

1_2_00007FFE13272E00

Source: uOsIQqfgiT.exe, 00000001.00000003.1736976290.00000234DCFD6000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1731005502.00000234DD032000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1739539209.00000234DD029000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2981353035.00000234DD032000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1737437404.00000234DD034000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;P
Source: uOsIQqfgiT.exe, 00000001.00000003.1736976290.00000234DCFD6000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1731005502.00000234DD032000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1736976290.00000234DCF5C000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1740209785.00000234DCF60000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1739539209.00000234DD029000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2981353035.00000234DD032000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1737437404.00000234DD034000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2981192249.00000234DCF62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF60198C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF60198C44C

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF6019A2790 GetProcessHeap,

0_2_00007FF6019A2790

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60198C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF60198C44C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60198BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF60198BBC0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF60198C62C SetUnhandledExceptionFilter,	0_2_00007FF60198C62C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 0_2_00007FF601999924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF601999924
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60198C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF60198C44C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60198BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF60198BBC0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF60198C62C SetUnhandledExceptionFilter,	1_2_00007FF60198C62C
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FF601999924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF601999924
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE130C1B00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE130C1B00
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE130C1530 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE130C1530
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13202BC0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13202BC0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13202600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13202600
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13233BB0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13233BB0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132335E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE132335E0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1325A090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE1325A090
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1325AAD8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE1325AAD8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132752F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE132752F0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13274D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13274D20
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13306254 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FFE13306254
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13305CB0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE13305CB0
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE1A460468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE1A460468

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Users\user\Desktop\uOsIQqfgiT.exe "C:\Users\user\Desktop\uOsIQqfgiT.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.2"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.3"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.4"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.5"	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "net view \\192.168.1.6"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.4	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.5	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net view \\192.168.1.6	Jump to behavior

Source: uOsIQqfgiT.exe, 00000001.00000003.1731005502.00000234DD032000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1731042680.00000234DD08B000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730964013.00000234DD0EB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DOF_PROGMAN

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF6019A8880 cpuid

0_2_00007FF6019A8880

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\libffi-8.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\Desktop\uOsIQqfgiT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\341vtfaf.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF60198C330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF60198C330

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe

Code function: 0_2_00007FF6019A518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6019A518C

Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE132045E8 PySys_Audit,PyEval_SaveThread,bind,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE132045E8
Source: C:\Users\user\Desktop\uOsIQqfgiT.exe	Code function: 1_2_00007FFE13205610 _PyArg_ParseTuple_SizeT,PyEval_SaveThread,listen,PyEval_RestoreThread,_Py_NoneStruct,		1_2_00007FFE13205610

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Bootkit	12 Process Injection	12 Process Injection	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Bootkit	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd	0%	ReversingLabs

Name	Source	Malicious	Reputation
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	uOsIQqfgiT.exe, 00000001.00000003.1730499077.00000234DCF73000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	uOsIQqfgiT.exe, 00000001.00000002.2980556430.00000234DC918000.00000004.00001000.00020000.00000000.sdmp	false	high
http://cacerts.digicert.co	uOsIQqfgiT.exe, 00000000.00000003.1722145945.00000206433A0000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000000.00000003.1722392187.00000206433A0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.python.org/download/releases/2.3/mro/.	uOsIQqfgiT.exe, 00000001.00000002.2980556430.00000234DC890000.00000004.00001000.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1729812463.00000234DCDA4000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1729852937.00000234DCD8B000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728638342.00000234DAFBA000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://tempuri.org/AddInfectionT	uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	false	high
https://www.openssl.org/H	libcrypto-1_1.dll.0.dr	false	high
http://tempuri.org/HelloWorldT	uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	false	high
http://tempuri.org/T	uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	false	high
http://www.google.com/Cnetsh	uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	false	high
http://tempuri.org/	341vtfaf.exe.1.dr	false	high
https://peps.python.org/pep-0205/	uOsIQqfgiT.exe, 00000001.00000002.2981023076.00000234DCE30000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.0.dr	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	uOsIQqfgiT.exe, 00000001.00000003.1729964462.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1728624628.00000234DAFB1000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000002.2980275068.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp, uOsIQqfgiT.exe, 00000001.00000003.1730126741.00000234DAFB5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0263/	uOsIQqfgiT.exe, 00000001.00000002.2982548664.00007FFDFB87B000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr	false	high
http://www.google.com/	uOsIQqfgiT.exe, 00000001.00000002.2981148210.00000234DCF30000.00000004.00000020.00020000.00000000.sdmp, 341vtfaf.exe.1.dr	false	high
https://www.python.org/psf/license/	uOsIQqfgiT.exe, 00000001.00000002.2982740122.00007FFDFB918000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.1.217
192.168.1.218
192.168.1.219
192.168.1.213
192.168.1.214
192.168.1.215
192.168.1.216
192.168.1.210
192.168.1.211
192.168.1.212
192.168.1.206
192.168.1.207
192.168.1.208
192.168.1.209
192.168.1.202
192.168.1.203
192.168.1.204
192.168.1.205
192.168.1.200
192.168.1.201
192.168.1.1
192.168.1.118
192.168.1.239
192.168.1.119
192.168.1.3
192.168.1.2
192.168.1.114
192.168.1.235
192.168.1.115
192.168.1.236
192.168.1.116
192.168.1.237
192.168.1.117
192.168.1.238
192.168.1.9
192.168.1.110
192.168.1.231
192.168.1.8
192.168.1.111
192.168.1.232
192.168.1.112
192.168.1.233
192.168.1.113
192.168.1.234
192.168.1.5
192.168.1.4
192.168.1.7
192.168.1.6
192.168.1.230
192.168.1.107
192.168.1.228
192.168.1.108
192.168.1.229
192.168.1.109
192.168.1.103
192.168.1.224
192.168.1.104
192.168.1.225
192.168.1.105
192.168.1.226
192.168.1.106
192.168.1.227
192.168.1.220
192.168.1.100
192.168.1.221
192.168.1.101
192.168.1.222
192.168.1.102
192.168.1.223
192.168.1.27
192.168.1.26
192.168.1.29
192.168.1.28
192.168.1.30
192.168.1.32
192.168.1.31
192.168.1.34
192.168.1.33
192.168.1.36
192.168.1.35
192.168.1.16
192.168.1.15
192.168.1.18
192.168.1.17
192.168.1.19
192.168.1.21
192.168.1.20
192.168.1.23
192.168.1.22
192.168.1.25
192.168.1.24
192.168.1.10
192.168.1.12
192.168.1.11
192.168.1.14
192.168.1.13
192.168.1.176
192.168.1.177
192.168.1.178
192.168.1.179

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567371
Start date and time:	2024-12-03 13:56:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uOsIQqfgiT.exe renamed because original name is a hash value
Original Sample Name:	a12133b2aadd267558975a8952daac3e.exe
Detection:	MAL
Classification:	mal80.rans.spre.expl.winEXE@33/14@0/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: uOsIQqfgiT.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll	saiya.exe	Get hash	malicious	AsyncRAT, XWorm	Browse
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse
	OBS-Studio-30.2.3-Windows-Installer.exe	Get hash	malicious	Unknown	Browse
	BrowserUpdate.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	CStealer	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	Payload.exe	Get hash	malicious	Python Stealer, BLX Stealer, XLABB Grabber	Browse
	xor-enc.exe	Get hash	malicious	Unknown	Browse
	PZKAQY0bX5.exe	Get hash	malicious	Blank Grabber	Browse
	Master.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\341vtfaf.exe

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	178688
Entropy (8bit):	6.100307497451274
Encrypted:	false
SSDEEP:	3072:jiK6JyIQ65De3Pobxy94ksVE3nbe/9d9vnKW7+lWiNav49TgUCV7:YyI/DewbQ6VgnbYd9vV7YjMgdgV
MD5:	A1F759941134F8381FCD48863224B585
SHA1:	5CA38697053D45FE4B61F5A689124DD88C0C4389
SHA-256:	D76FCEDCC85391CCA03F98AEEF106DE5A03BE5CAB70FBB0F582B6D94654EA7F6
SHA-512:	6AA5A56117B84F5D7DD3C89EE653E923B3DDD0C2100CC11BBE41612501E913D888D5D8E7D49BBA07C9573552D8DC0D9CD815E7996017D25E24F8FF391D93D9B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.../72g.........."...0.................. .....@..... ....................................`...@......@............... ...................................,........................................................................................... ..H............text....... ...................... ..`.rsrc....,..........................@..@........................................H........v..,.......Q...8C..xe............................................(#....0..........($...o%...(&...r...p('...((...-.....()...r...p('....($...r...po.....,..(+......(,...o-......,..o........,..o.....~/...r1..p.o0...%r]..p....(1...o2...r{..p....(1...o2........(....&..&....(....O..]........E.$i...................0..7.........(3...}G......}H......}F.....\|G.....(...+..\|G...(5.....0..+.........(6...}A......}B......}@.....\|A.....(...+*..0..#.........(6...}D......}C.....\|D.....(..

C:\Users\user\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.641929675972235
Encrypted:	false
SSDEEP:	1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5:	4585A96CC4EEF6AAFD5E27EA09147DC6
SHA1:	489CFFF1B19ABBEC98FDA26AC8958005E88DD0CB
SHA-256:	A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
SHA-512:	D78260C66331FE3029D2CC1B41A5D002EC651F2E3BBF55076D65839B5E3C6297955AFD4D9AB8951FBDC9F929DBC65EB18B14B59BCE1F2994318564EB4920F286
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: saiya.exe, Detection: malicious, Browse Filename: RuntimeusererVers.exe, Detection: malicious, Browse Filename: OBS-Studio-30.2.3-Windows-Installer.exe, Detection: malicious, Browse Filename: BrowserUpdate.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: Payload.exe, Detection: malicious, Browse Filename: xor-enc.exe, Detection: malicious, Browse Filename: PZKAQY0bX5.exe, Detection: malicious, Browse Filename: Master.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d..._#;..........." ...".....`......................................................=.....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.570831353064175
Encrypted:	false
SSDEEP:	1536:PdQz7pZ3catNZTRGE51LOBK5bib8tsfYqpIPCV17SyQPx:VQz9Z5VOwiItsAqpIPCV1Gx
MD5:	3859239CED9A45399B967EBCE5A6BA23
SHA1:	6F8FF3DF90AC833C1EB69208DB462CDA8CA3F8D6
SHA-256:	A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
SHA-512:	030E5CE81E36BD55F69D55CBB8385820EB7C1F95342C1A32058F49ABEABB485B1C4A30877C07A56C9D909228E45A4196872E14DED4F87ADAA8B6AD97463E5C69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A}...............d`.....J`......J`......J`......J`......J`.......`......Nd..........Z....`.......`.......`.......`......Rich............PE..d......d.........." ...".....^......L........................................P.......`....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	123664
Entropy (8bit):	6.058417150946148
Encrypted:	false
SSDEEP:	3072:c7u5LnIx1If3yJdqfLI2AYX5BO89IPLPPUxdF:cwxfijqfLI29BO8VF
MD5:	BD36F7D64660D120C6FB98C8F536D369
SHA1:	6829C9CE6091CB2B085EB3D5469337AC4782F927
SHA-256:	EE543453AC1A2B9B52E80DC66207D3767012CA24CE2B44206804767F37443902
SHA-512:	BD15F6D4492DDBC89FCBADBA07FC10AA6698B13030DD301340B5F1B02B74191FAF9B3DCF66B72ECF96084656084B531034EA5CADC1DD333EF64AFB69A1D1FD56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........G...&...&...&...^...&...Z...&...Z...&...Z...&...Z...&..$Z...&...^...&...^...&..-Z...&...&...&..$Z...&..$Z...&..$Zv..&..$Z...&..Rich.&..........................PE..d...!..d.........." ..."............p\..............................................\|o....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253200
Entropy (8bit):	6.559097478184273
Encrypted:	false
SSDEEP:	6144:7t9gXW32tb0yf6CgLp+E4YECs5wxvj9qWM53pLW1Apw9tBg2YAp:7ngXW3wgyCiE4texvGI4Ap
MD5:	65B4AB77D6C6231C145D3E20E7073F51
SHA1:	23D5CE68ED6AA8EAABE3366D2DD04E89D248328E
SHA-256:	93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614
SHA-512:	28023446E5AC90E9E618673C879CA46F598A62FBB9E69EF925DB334AD9CB1544916CAF81E2ECDC26B75964DCEDBA4AD4DE1BA2C42FB838D0DF504D963FCF17EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........nyR.............w.......s.......s.......s.......s.......s.......w.........._....s.......s.......s.......s.......s......Rich............PE..d......d.........." ...".v...<......L...............................................Rn....`..........................................T..P...`T...................&......./......P.......T...........................P...@............................................text....u.......v.................. ..`.rdata..<............z..............@..@.data....*...p...$...R..............@....pdata...&.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65304
Entropy (8bit):	6.222786912280051
Encrypted:	false
SSDEEP:	1536:6TO+CPN/pV8ETeERZX/fchw/IpBIPOIVQ7SygPx:mClZZow/IpBIPOIVQyx
MD5:	4255C44DC64F11F32C961BF275AAB3A2
SHA1:	C1631B2821A7E8A1783ECFE9A14DB453BE54C30A
SHA-256:	E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
SHA-512:	7D3A306755A123B246F31994CD812E7922943CDBBC9DB5A6E4D3372EA434A635FFD3945B5D2046DE669E7983EF2845BD007A441D09CFE05CF346523C12BDAD52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.u.'.&.'.&.'.&._,&.'.&.[.'.'.&.[.'.'.&.[.'.'.&.[.'.'.&._.'.'.&[.'.'.&.'.&e'.&[.'.'.&[.'.'.&[@&.'.&*[.'.'.&Rich.'.&........PE..d......d.........." ...".T...~......`?...............................................%....`.............................................P.......................,......../......\...0}..T............................{..@............p..(............................text...uR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158992
Entropy (8bit):	6.8491146526380025
Encrypted:	false
SSDEEP:	3072:A4lirS97HrdVmEkGCm5hAznf49mNo2NOvJ02pIPZ1wBExN:VlirG0EkTVAYO2NQ3w
MD5:	E5ABC3A72996F8FDE0BCF709E6577D9D
SHA1:	15770BDCD06E171F0B868C803B8CF33A8581EDD3
SHA-256:	1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
SHA-512:	B347474DC071F2857E1E16965B43DB6518E35915B8168BDEFF1EAD4DFF710A1CC9F04CA0CED23A6DE40D717EEA375EEDB0BF3714DAF35DE6A77F071DB33DFAE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...D,..D,..D,...,..D,..E-..D,..A-..D,..@-..D,..G-..D,M.E-..D,..E-..D,..E,.D,M.I-..D,M.D-..D,M.,..D,M.F-..D,Rich..D,........PE..d...$..d.........." ...".b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	79640
Entropy (8bit):	6.290841920161528
Encrypted:	false
SSDEEP:	1536:0JltpedXL+3ujz9/s+S+pzpMoiyivViaE9IPLwj7SyZPx:07tp4i3ujz9/sT+pzqoavVpE9IPLwjHx
MD5:	1EEA9568D6FDEF29B9963783827F5867
SHA1:	A17760365094966220661AD87E57EFE09CD85B84
SHA-256:	74181072392A3727049EA3681FE9E59516373809CED53E08F6DA7C496B76E117
SHA-512:	D9443B70FCDC4D0EA1CB93A88325012D3F99DB88C36393A7DED6D04F590E582F7F1640D8B153FE3C5342FA93802A8374F03F6CD37DD40CDBB5ADE2E07FAD1E09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RXY..97..97..97..A...97.YE6..97.YE2..97.YE3..97.YE4..97..E6..97..96..97.]A6..97..E:..97..E7..97..E...97..E5..97.Rich.97.................PE..d... ..d.........." ...".l...........%.......................................P......V.....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...:k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1438373
Entropy (8bit):	5.59108786847922
Encrypted:	false
SSDEEP:	24576:mQR5pATu7xm4lUKdcubgAnyfbcZ0iwhBdYf9P3sRHHL:mQR5plxmQJy
MD5:	2F6D57BCCF7F7735ACB884A980410F6A
SHA1:	93A6926887A08DC09CD92864CD82B2BEC7B24EC5
SHA-256:	1B7D326BAD406E96A4C83B5A49714819467E3174ED0A74F81C9EBD96D1DD40B3
SHA-512:	95BCFC66DBE7B6AD324BD2DC2258A3366A3594BFC50118AB37A2A204906109E42192FB10A91172B340CC28C12640513DB268C854947FB9ED8426F214FF8889B4
Malicious:	false
Preview:	PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3445016
Entropy (8bit):	6.099467326309974
Encrypted:	false
SSDEEP:	98304:+/+YgEQaGDoWS04ki7x+QRsZ51CPwDv3uFfJx:MLgEXGUZ37x+VZ51CPwDv3uFfJx
MD5:	E94733523BCD9A1FB6AC47E10A267287
SHA1:	94033B405386D04C75FFE6A424B9814B75C608AC
SHA-256:	F20EB4EFD8647B5273FDAAFCEB8CCB2B8BA5329665878E01986CBFC1E6832C44
SHA-512:	07DD0EB86498497E693DA0F9DD08DE5B7B09052A2D6754CFBC2AA260E7F56790E6C0A968875F7803CB735609B1E9B9C91A91B84913059C561BFFED5AB2CBB29F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).h.z.h.z.h.z..Oz.h.z...{.h.z...{.h.z...{.h.z...{.h.z.h.zjh.z...{.h.z=..{.h.z=..{.j.z=..{.h.z=.#z.h.z=..{.h.zRich.h.z........................PE..d.....wd.........." ..."..$...................................................5......o5...`..........................................y/..h...J4.@.....4.\|....p2......b4../....4..O..P.,.8.............................,.@............@4..............................text...$.$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata..h....p2.......1.............@..@.idata..^#...@4..$....3.............@..@.00cfg..u....p4.......3.............@..@.rsrc...\|.....4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5762840
Entropy (8bit):	6.089392282930885
Encrypted:	false
SSDEEP:	49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgVr42I1vJHH++:73ZOKRtlrJ7wfGrs1BHeM+2PocL2
MD5:	5A5DD7CAD8028097842B0AFEF45BFBCF
SHA1:	E247A2E460687C607253949C52AE2801FF35DC4A
SHA-256:	A811C7516F531F1515D10743AE78004DD627EBA0DC2D3BC0D2E033B2722043CE
SHA-512:	E6268E4FAD2CE3EF16B68298A57498E16F0262BF3531539AD013A66F72DF471569F94C6FCC48154B7C3049A3AD15CBFCBB6345DACB4F4ED7D528C74D589C9858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.D.5..5..5..z.+.7..z...;..z./.9..z...=..z.).1..<../..~.+.>..5.+.P....'......4......4....(.4..Rich5.*.........................PE..d......d.........." ...".X%..47.....\H........................................\.......X...`...........................................@......WA......p[.......V.d0....W../....[..C....).T.............................).@............p%..............................text...rV%......X%................. ..`.rdata.......p%......\%.............@..@.data.........A..L...hA.............@....pdata..d0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......rV.............@..@.reloc...C....[..D...\|V.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30480
Entropy (8bit):	6.578957517354568
Encrypted:	false
SSDEEP:	384:N1ecReJKrHqDUI7A700EZ9IPQGNHQIYiSy1pCQn1tPxh8E9VF0NykfF:3eUeJGHqNbD9IPQGR5YiSyvnnPxWEuN
MD5:	C97A587E19227D03A85E90A04D7937F6
SHA1:	463703CF1CAC4E2297B442654FC6169B70CFB9BF
SHA-256:	C4AA9A106381835CFB5F9BADFB9D77DF74338BC66E69183757A5A3774CCDACCF
SHA-512:	97784363F3B0B794D2F9FD6A2C862D64910C71591006A34EEDFF989ECCA669AC245B3DFE68EAA6DA621209A3AB61D36E9118EBB4BE4C0E72CE80FAB7B43BDE12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tB.t'B.t'B.t'K..'@.t'..u&@.t'..q&N.t'..p&J.t'..w&F.t'..u&@.t'B.u'..t'..u&G.t'..y&C.t'..t&C.t'...'C.t'..v&C.t'RichB.t'................PE..d......d.........." ...".....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\uOsIQqfgiT.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1141016
Entropy (8bit):	5.435086202175289
Encrypted:	false
SSDEEP:	12288:83kYbfjwR6nblonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ol:8UYbMA0IDJcjEwPgPOG6Xyd461ol
MD5:	AA13EE6770452AF73828B55AF5CD1A32
SHA1:	C01ECE61C7623E36A834D8B3C660E7F28C91177E
SHA-256:	8FBED20E9225FF82132E97B4FEFBB5DDBC10C062D9E3F920A6616AB27BB5B0FB
SHA-512:	B2EEB9A7D4A32E91084FDAE302953AAC57388A5390F9404D8DFE5C4A8F66CA2AB73253CF5BA4CC55350D8306230DD1114A61E22C23F42FBCC5C0098046E97E0F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................,...............,.....,.....,.y...,.....Rich..........PE..d......d.........." ...".@..........P*...............................................!....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.986362984326343
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	uOsIQqfgiT.exe
File size:	6'746'220 bytes
MD5:	a12133b2aadd267558975a8952daac3e
SHA1:	4f770593e992d7423aafdc6a2593d18d46d5f21b
SHA256:	bbdd058ce8a5e7ebfcd229b2a6edd562497b4c58f3c7efb30b2cf73be35302a4
SHA512:	a71cce55be3e73fb993d22e02fa0229aec1b3d4a7a857cdcbc8e18c7ecf8d07cd414d98f838711d78bc11bbf6c1c4247bb010851140a86b760df40e045df4efb
SSDEEP:	98304:tbA5nzNBS27wy4Pf1N2zIh3ET9qMxVMOPUh3PdWPEUrJY6AOxbHFvKJ1ngOcsS4m:tbcx4FMIZETPjPePdrQJ/BMnPc
TLSH:	A66623756A5019F2E7EAC0789489C406D53A2C2DC72CB16602F472661FF3F7B572BA0D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	0b03084c4e4e0383

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x67326D83 [Mon Nov 11 20:48:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FCE94E3805Ch
dec eax
add esp, 28h
jmp 00007FCE94E37C7Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FCE94E38428h
test eax, eax
je 00007FCE94E37E23h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FCE94E37E07h
dec eax
cmp ecx, eax
je 00007FCE94E37E16h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007FCE94E37DF0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FCE94E37DF9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FCE94E37E09h
mov byte ptr [00038425h], 00000001h
call 00007FCE94E37555h
call 00007FCE94E38840h
test al, al
jne 00007FCE94E37E06h
xor al, al
jmp 00007FCE94E37E16h
call 00007FCE94E4534Fh
test al, al
jne 00007FCE94E37E0Bh
xor ecx, ecx
call 00007FCE94E38850h
jmp 00007FCE94E37DECh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007FCE94E37E69h
cmp ecx, 01h
jnbe 00007FCE94E37E6Ch
call 00007FCE94E3839Eh
test eax, eax
je 00007FCE94E37E2Ah
test ebx, ebx
jne 00007FCE94E37E26h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007FCE94E45142h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x10e34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	2c306a7e453ae8485f55c8111ca5c00e	False	0.5245196368243243	data	5.750833589213045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x10e34	0x11000	9d352827d61a24ef0aff58c346928c01	False	0.07390280330882353	data	4.740756993386539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x490e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 15118 x 15118 px/m	0.06374955637051934
RT_GROUP_ICON	0x59910	0x14	data	1.15
RT_MANIFEST	0x59924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 13:57:06.177949905 CET	49730	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:06.178004026 CET	49731	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:06.178994894 CET	49732	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:06.180625916 CET	49734	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:06.180843115 CET	49733	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:06.182511091 CET	49735	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:06.182950974 CET	49736	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:06.183468103 CET	49737	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:06.186592102 CET	49739	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:06.186593056 CET	49738	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:06.187566042 CET	49740	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:06.189596891 CET	49741	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:06.189659119 CET	49742	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:06.191251040 CET	49743	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:06.191421032 CET	49744	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:06.191848040 CET	49745	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:06.192569017 CET	49746	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:06.198641062 CET	49748	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:06.198741913 CET	49747	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:06.199481010 CET	49749	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:06.201608896 CET	49750	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:06.201617002 CET	49751	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:06.202788115 CET	49752	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:06.204605103 CET	49754	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:06.204615116 CET	49753	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:06.206002951 CET	49755	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:06.206494093 CET	49756	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:06.206928015 CET	49757	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:06.210577965 CET	49758	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:06.210608959 CET	49759	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:06.211782932 CET	49760	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:06.213557005 CET	49761	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:06.213583946 CET	49762	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:06.214834929 CET	49763	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:06.214955091 CET	49764	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:06.215786934 CET	49765	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:06.216562986 CET	49766	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:06.222582102 CET	49768	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:06.222583055 CET	49767	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:06.223706961 CET	49769	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:06.225574017 CET	49770	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:06.225589037 CET	49771	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:06.226843119 CET	49772	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:06.227161884 CET	49773	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:06.227834940 CET	49774	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:06.229430914 CET	49775	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:06.229470015 CET	49776	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:06.229904890 CET	49777	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:06.234585047 CET	49779	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:06.234631062 CET	49778	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:06.235424042 CET	49780	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:06.237591982 CET	49781	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:06.237714052 CET	49782	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:06.238738060 CET	49783	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:06.240602970 CET	49784	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:06.240636110 CET	49785	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:06.241890907 CET	49786	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:06.241909027 CET	49787	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:06.243046045 CET	49788	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:06.246577024 CET	49789	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:06.246759892 CET	49790	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:06.249658108 CET	49791	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:06.252626896 CET	49792	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:06.258626938 CET	49793	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:06.261583090 CET	49794	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:06.264861107 CET	49795	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:06.270610094 CET	49796	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:06.273585081 CET	49797	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:06.276629925 CET	49798	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:06.282939911 CET	49799	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:06.285593987 CET	49800	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:06.288642883 CET	49801	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:06.294639111 CET	49802	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:06.297615051 CET	49803	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:06.298160076 CET	445	49730	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:06.298176050 CET	445	49731	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:06.298243046 CET	49730	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:06.298274994 CET	49731	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:06.298357010 CET	49730	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:06.299009085 CET	445	49732	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:06.299386024 CET	49732	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:06.300424099 CET	49731	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:06.300568104 CET	49804	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:06.300915956 CET	445	49734	192.168.1.5	192.168.2.4
Dec 3, 2024 13:57:06.300997019 CET	445	49733	192.168.1.4	192.168.2.4
Dec 3, 2024 13:57:06.301064014 CET	49733	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:06.301064968 CET	49734	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:06.302746058 CET	445	49735	192.168.1.6	192.168.2.4
Dec 3, 2024 13:57:06.302823067 CET	49735	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:06.302937984 CET	445	49736	192.168.1.8	192.168.2.4
Dec 3, 2024 13:57:06.302993059 CET	49736	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:06.303523064 CET	445	49737	192.168.1.7	192.168.2.4
Dec 3, 2024 13:57:06.303576946 CET	49737	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:06.303993940 CET	49734	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:06.306741953 CET	445	49739	192.168.1.10	192.168.2.4
Dec 3, 2024 13:57:06.306868076 CET	445	49738	192.168.1.9	192.168.2.4
Dec 3, 2024 13:57:06.306898117 CET	49739	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:06.306917906 CET	49738	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:06.307384968 CET	49739	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:06.310348988 CET	49737	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:06.319137096 CET	49732	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:06.345756054 CET	49735	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:06.345798969 CET	49733	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:06.345825911 CET	49736	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:06.357086897 CET	49738	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:06.372730970 CET	49805	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:06.378634930 CET	49806	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:06.384860039 CET	49807	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:06.386507988 CET	49808	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:06.387732029 CET	49809	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:06.387972116 CET	49810	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:06.388978004 CET	49811	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:06.389887094 CET	49812	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:06.390564919 CET	49813	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:06.393755913 CET	49814	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:06.396615028 CET	49815	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:06.396838903 CET	49816	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:06.397834063 CET	49817	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:06.402591944 CET	49819	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:06.402606964 CET	49818	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:06.403816938 CET	49820	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:06.405591965 CET	49821	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:06.405601025 CET	49822	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:06.406701088 CET	49823	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:06.406927109 CET	49824	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:06.407767057 CET	49825	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:06.408643961 CET	49826	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:06.412278891 CET	49827	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:06.412305117 CET	49828	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:06.413636923 CET	49829	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:06.413950920 CET	49830	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:06.415102959 CET	49831	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:06.415600061 CET	49832	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:06.416609049 CET	49833	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:06.417370081 CET	49834	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:06.417499065 CET	49835	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:06.418792009 CET	49836	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:06.419611931 CET	49837	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:06.419977903 CET	49838	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:06.421268940 CET	49839	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:06.422322989 CET	49840	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:06.422379017 CET	49841	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:06.422987938 CET	445	49740	192.168.1.11	192.168.2.4
Dec 3, 2024 13:57:06.423005104 CET	445	49741	192.168.1.13	192.168.2.4
Dec 3, 2024 13:57:06.423016071 CET	445	49742	192.168.1.12	192.168.2.4
Dec 3, 2024 13:57:06.423027039 CET	445	49743	192.168.1.15	192.168.2.4
Dec 3, 2024 13:57:06.423038960 CET	445	49744	192.168.1.16	192.168.2.4
Dec 3, 2024 13:57:06.423049927 CET	445	49745	192.168.1.14	192.168.2.4
Dec 3, 2024 13:57:06.423060894 CET	445	49746	192.168.1.17	192.168.2.4
Dec 3, 2024 13:57:06.423073053 CET	445	49748	192.168.1.19	192.168.2.4
Dec 3, 2024 13:57:06.423079967 CET	49740	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:06.423083067 CET	445	49747	192.168.1.18	192.168.2.4
Dec 3, 2024 13:57:06.423094034 CET	445	49749	192.168.1.20	192.168.2.4
Dec 3, 2024 13:57:06.423099041 CET	49741	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:06.423104048 CET	445	49750	192.168.1.21	192.168.2.4
Dec 3, 2024 13:57:06.423114061 CET	445	49751	192.168.1.22	192.168.2.4
Dec 3, 2024 13:57:06.423119068 CET	445	49752	192.168.1.23	192.168.2.4
Dec 3, 2024 13:57:06.423127890 CET	445	49754	192.168.1.25	192.168.2.4
Dec 3, 2024 13:57:06.423137903 CET	445	49753	192.168.1.24	192.168.2.4
Dec 3, 2024 13:57:06.423146963 CET	445	49755	192.168.1.27	192.168.2.4
Dec 3, 2024 13:57:06.423156977 CET	445	49756	192.168.1.26	192.168.2.4
Dec 3, 2024 13:57:06.423157930 CET	49742	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:06.423167944 CET	49743	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:06.423168898 CET	445	49757	192.168.1.28	192.168.2.4
Dec 3, 2024 13:57:06.423178911 CET	49744	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:06.423190117 CET	49745	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:06.423192978 CET	49746	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:06.423197031 CET	49748	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:06.423300028 CET	49749	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:06.423300982 CET	49750	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:06.423310041 CET	49754	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:06.423317909 CET	49752	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:06.423324108 CET	49747	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:06.423324108 CET	49751	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:06.423327923 CET	49755	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:06.423327923 CET	49753	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:06.423329115 CET	49756	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:06.423445940 CET	49757	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:06.423602104 CET	49740	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:06.423613071 CET	49742	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:06.426002026 CET	49745	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:06.426723957 CET	445	49758	192.168.1.29	192.168.2.4
Dec 3, 2024 13:57:06.426737070 CET	445	49759	192.168.1.30	192.168.2.4
Dec 3, 2024 13:57:06.426747084 CET	445	49760	192.168.1.31	192.168.2.4
Dec 3, 2024 13:57:06.426755905 CET	445	49761	192.168.1.32	192.168.2.4
Dec 3, 2024 13:57:06.426764965 CET	445	49762	192.168.1.33	192.168.2.4
Dec 3, 2024 13:57:06.426769018 CET	445	49763	192.168.1.34	192.168.2.4
Dec 3, 2024 13:57:06.426778078 CET	445	49764	192.168.1.35	192.168.2.4
Dec 3, 2024 13:57:06.426780939 CET	49758	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:06.426788092 CET	445	49765	192.168.1.36	192.168.2.4
Dec 3, 2024 13:57:06.426800013 CET	445	49766	192.168.1.37	192.168.2.4
Dec 3, 2024 13:57:06.426809072 CET	445	49768	192.168.1.39	192.168.2.4
Dec 3, 2024 13:57:06.426819086 CET	445	49767	192.168.1.38	192.168.2.4
Dec 3, 2024 13:57:06.426827908 CET	445	49769	192.168.1.40	192.168.2.4
Dec 3, 2024 13:57:06.426842928 CET	445	49770	192.168.1.41	192.168.2.4
Dec 3, 2024 13:57:06.426853895 CET	445	49771	192.168.1.42	192.168.2.4
Dec 3, 2024 13:57:06.426862001 CET	49762	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:06.426865101 CET	445	49772	192.168.1.44	192.168.2.4
Dec 3, 2024 13:57:06.426867962 CET	49761	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:06.426868916 CET	49760	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:06.426871061 CET	49763	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:06.426878929 CET	445	49773	192.168.1.43	192.168.2.4
Dec 3, 2024 13:57:06.426881075 CET	49759	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:06.426889896 CET	445	49774	192.168.1.45	192.168.2.4
Dec 3, 2024 13:57:06.426899910 CET	445	49775	192.168.1.47	192.168.2.4
Dec 3, 2024 13:57:06.426909924 CET	445	49776	192.168.1.48	192.168.2.4
Dec 3, 2024 13:57:06.426918983 CET	445	49777	192.168.1.46	192.168.2.4
Dec 3, 2024 13:57:06.426928997 CET	445	49779	192.168.1.50	192.168.2.4
Dec 3, 2024 13:57:06.426939964 CET	445	49778	192.168.1.49	192.168.2.4
Dec 3, 2024 13:57:06.426950932 CET	445	49780	192.168.1.51	192.168.2.4
Dec 3, 2024 13:57:06.426961899 CET	49765	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:06.426963091 CET	49764	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:06.426965952 CET	445	49781	192.168.1.52	192.168.2.4
Dec 3, 2024 13:57:06.426969051 CET	49766	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:06.426970959 CET	49767	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:06.426975012 CET	49768	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:06.426975012 CET	49769	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:06.426975965 CET	49770	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:06.426979065 CET	445	49782	192.168.1.53	192.168.2.4
Dec 3, 2024 13:57:06.426986933 CET	49771	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:06.426990986 CET	445	49783	192.168.1.54	192.168.2.4
Dec 3, 2024 13:57:06.427001953 CET	445	49784	192.168.1.55	192.168.2.4
Dec 3, 2024 13:57:06.427011967 CET	445	49785	192.168.1.56	192.168.2.4
Dec 3, 2024 13:57:06.427021980 CET	445	49786	192.168.1.57	192.168.2.4
Dec 3, 2024 13:57:06.427031040 CET	445	49787	192.168.1.58	192.168.2.4
Dec 3, 2024 13:57:06.427040100 CET	445	49788	192.168.1.59	192.168.2.4
Dec 3, 2024 13:57:06.427050114 CET	445	49789	192.168.1.60	192.168.2.4
Dec 3, 2024 13:57:06.427059889 CET	445	49790	192.168.1.61	192.168.2.4
Dec 3, 2024 13:57:06.427068949 CET	445	49791	192.168.1.62	192.168.2.4
Dec 3, 2024 13:57:06.427078962 CET	445	49792	192.168.1.63	192.168.2.4
Dec 3, 2024 13:57:06.427088022 CET	445	49793	192.168.1.64	192.168.2.4
Dec 3, 2024 13:57:06.427095890 CET	49772	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:06.427099943 CET	445	49794	192.168.1.65	192.168.2.4
Dec 3, 2024 13:57:06.427105904 CET	49774	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:06.427105904 CET	49775	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:06.427114010 CET	445	49795	192.168.1.66	192.168.2.4
Dec 3, 2024 13:57:06.427115917 CET	49776	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:06.427124977 CET	445	49796	192.168.1.67	192.168.2.4
Dec 3, 2024 13:57:06.427129984 CET	49773	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:06.427134991 CET	445	49797	192.168.1.68	192.168.2.4
Dec 3, 2024 13:57:06.427139997 CET	49777	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:06.427150965 CET	49779	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:06.427150965 CET	445	49798	192.168.1.69	192.168.2.4
Dec 3, 2024 13:57:06.427160978 CET	445	49799	192.168.1.70	192.168.2.4
Dec 3, 2024 13:57:06.427170992 CET	445	49800	192.168.1.71	192.168.2.4
Dec 3, 2024 13:57:06.427180052 CET	49778	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:06.427181005 CET	445	49801	192.168.1.72	192.168.2.4
Dec 3, 2024 13:57:06.427181959 CET	49780	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:06.427191019 CET	49781	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:06.427191973 CET	445	49802	192.168.1.73	192.168.2.4
Dec 3, 2024 13:57:06.427196980 CET	49782	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:06.427201986 CET	445	49803	192.168.1.74	192.168.2.4
Dec 3, 2024 13:57:06.427212954 CET	445	49730	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:06.427223921 CET	445	49804	192.168.1.75	192.168.2.4
Dec 3, 2024 13:57:06.427232981 CET	445	49731	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:06.427242994 CET	445	49734	192.168.1.5	192.168.2.4
Dec 3, 2024 13:57:06.427392006 CET	49783	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:06.427400112 CET	49784	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:06.427400112 CET	49785	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:06.427418947 CET	49788	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:06.427419901 CET	49787	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:06.427423000 CET	49786	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:06.427423000 CET	49789	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:06.427443027 CET	49792	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:06.427443027 CET	49791	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:06.427453995 CET	49794	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:06.427457094 CET	49793	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:06.427458048 CET	49790	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:06.427458048 CET	49795	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:06.427473068 CET	49796	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:06.427495956 CET	49797	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:06.427500963 CET	49798	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:06.427509069 CET	49799	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:06.427509069 CET	49800	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:06.427509069 CET	49801	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:06.427524090 CET	49803	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:06.427525997 CET	49802	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:06.427556992 CET	49730	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:06.427584887 CET	49731	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:06.427597046 CET	49734	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:06.427608967 CET	49804	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:06.429121971 CET	49766	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:06.429164886 CET	49768	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:06.431555033 CET	49771	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:06.433315992 CET	49774	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:06.435062885 CET	49777	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:06.436952114 CET	49780	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:06.442341089 CET	49783	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:06.442356110 CET	49784	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:06.454128981 CET	49787	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:06.457686901 CET	49782	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:06.459028006 CET	49779	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:06.460469961 CET	49770	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:06.460494041 CET	49773	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:06.460575104 CET	49772	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:06.462146997 CET	49749	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:06.462184906 CET	49751	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:06.464098930 CET	49755	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:06.465831041 CET	49757	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:06.468786955 CET	49744	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:06.470283031 CET	49759	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:06.471609116 CET	49761	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:06.473086119 CET	49763	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:06.474714041 CET	49753	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:06.479125977 CET	49747	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:06.480803013 CET	49769	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:06.482331991 CET	49775	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:06.483872890 CET	49785	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:06.483881950 CET	49786	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:06.485508919 CET	49793	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:06.486999989 CET	49794	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:06.488548040 CET	49797	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:06.489980936 CET	49799	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:06.490015030 CET	49802	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:06.491552114 CET	49741	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:06.493150949 CET	49746	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:06.494577885 CET	49760	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:06.495946884 CET	49764	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:06.497298002 CET	49750	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:06.498636007 CET	49776	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:06.500050068 CET	49778	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:06.501446962 CET	49789	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:06.502955914 CET	49791	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:06.504292965 CET	49798	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:06.505701065 CET	49801	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:06.507085085 CET	49790	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:06.508480072 CET	49788	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:06.509814978 CET	49767	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:06.511204004 CET	49804	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:06.511229038 CET	49765	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:06.512571096 CET	49743	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:06.513897896 CET	49800	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:06.515515089 CET	49796	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:06.515542030 CET	49792	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:06.519870996 CET	49752	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:06.521336079 CET	49758	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:06.522736073 CET	49803	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:06.524055958 CET	49795	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:06.525511026 CET	49762	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:06.525540113 CET	49781	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:06.527148962 CET	49748	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:06.537666082 CET	49754	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:06.539670944 CET	49756	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:06.539869070 CET	49842	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:06.541260958 CET	49843	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:06.542277098 CET	49844	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:06.543204069 CET	49845	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:06.544428110 CET	49846	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:06.545438051 CET	49847	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:06.546216011 CET	49848	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:06.547087908 CET	49849	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:06.547880888 CET	49850	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:06.547947884 CET	445	49739	192.168.1.10	192.168.2.4
Dec 3, 2024 13:57:06.547961950 CET	445	49737	192.168.1.7	192.168.2.4
Dec 3, 2024 13:57:06.547985077 CET	445	49732	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:06.547992945 CET	445	49732	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:06.548002958 CET	445	49735	192.168.1.6	192.168.2.4
Dec 3, 2024 13:57:06.548006058 CET	49739	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:06.548007965 CET	445	49733	192.168.1.4	192.168.2.4
Dec 3, 2024 13:57:06.548013926 CET	445	49805	192.168.1.76	192.168.2.4
Dec 3, 2024 13:57:06.548023939 CET	445	49736	192.168.1.8	192.168.2.4
Dec 3, 2024 13:57:06.548029900 CET	49737	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:06.548034906 CET	445	49806	192.168.1.77	192.168.2.4
Dec 3, 2024 13:57:06.548046112 CET	445	49807	192.168.1.78	192.168.2.4
Dec 3, 2024 13:57:06.548049927 CET	445	49808	192.168.1.79	192.168.2.4
Dec 3, 2024 13:57:06.548058987 CET	445	49809	192.168.1.80	192.168.2.4
Dec 3, 2024 13:57:06.548063040 CET	445	49810	192.168.1.81	192.168.2.4
Dec 3, 2024 13:57:06.548073053 CET	49732	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:06.548074961 CET	445	49738	192.168.1.9	192.168.2.4
Dec 3, 2024 13:57:06.548085928 CET	445	49811	192.168.1.82	192.168.2.4
Dec 3, 2024 13:57:06.548090935 CET	49735	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:06.548094988 CET	445	49812	192.168.1.83	192.168.2.4
Dec 3, 2024 13:57:06.548105955 CET	445	49813	192.168.1.84	192.168.2.4
Dec 3, 2024 13:57:06.548110008 CET	49733	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:06.548115015 CET	445	49814	192.168.1.86	192.168.2.4
Dec 3, 2024 13:57:06.548151970 CET	49736	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:06.548244953 CET	49738	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:06.548245907 CET	49805	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:06.548284054 CET	49806	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:06.548301935 CET	49809	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:06.548302889 CET	49808	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:06.548305988 CET	49807	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:06.548311949 CET	49810	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:06.548315048 CET	49811	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:06.548326015 CET	49812	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:06.548326015 CET	49813	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:06.548490047 CET	49814	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:06.548633099 CET	445	49815	192.168.1.85	192.168.2.4
Dec 3, 2024 13:57:06.548634052 CET	49805	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:06.548646927 CET	445	49816	192.168.1.87	192.168.2.4
Dec 3, 2024 13:57:06.548652887 CET	49807	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:06.548655987 CET	445	49817	192.168.1.88	192.168.2.4
Dec 3, 2024 13:57:06.548666954 CET	445	49819	192.168.1.90	192.168.2.4
Dec 3, 2024 13:57:06.548676014 CET	445	49818	192.168.1.89	192.168.2.4
Dec 3, 2024 13:57:06.548686028 CET	445	49820	192.168.1.91	192.168.2.4
Dec 3, 2024 13:57:06.548695087 CET	445	49821	192.168.1.92	192.168.2.4
Dec 3, 2024 13:57:06.548700094 CET	49815	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:06.548705101 CET	445	49822	192.168.1.93	192.168.2.4
Dec 3, 2024 13:57:06.548706055 CET	49816	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:06.548715115 CET	445	49823	192.168.1.94	192.168.2.4
Dec 3, 2024 13:57:06.548723936 CET	445	49824	192.168.1.95	192.168.2.4
Dec 3, 2024 13:57:06.548737049 CET	445	49825	192.168.1.96	192.168.2.4
Dec 3, 2024 13:57:06.548746109 CET	445	49826	192.168.1.97	192.168.2.4
Dec 3, 2024 13:57:06.548755884 CET	445	49827	192.168.1.98	192.168.2.4
Dec 3, 2024 13:57:06.548758030 CET	49817	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:06.548762083 CET	49819	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:06.548765898 CET	49818	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:06.548767090 CET	445	49828	192.168.1.99	192.168.2.4
Dec 3, 2024 13:57:06.548772097 CET	49820	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:06.548778057 CET	445	49829	192.168.1.100	192.168.2.4
Dec 3, 2024 13:57:06.548782110 CET	445	49830	192.168.1.101	192.168.2.4
Dec 3, 2024 13:57:06.548785925 CET	445	49831	192.168.1.103	192.168.2.4
Dec 3, 2024 13:57:06.548790932 CET	445	49832	192.168.1.102	192.168.2.4
Dec 3, 2024 13:57:06.548799038 CET	445	49833	192.168.1.104	192.168.2.4
Dec 3, 2024 13:57:06.548803091 CET	445	49834	192.168.1.105	192.168.2.4
Dec 3, 2024 13:57:06.548806906 CET	445	49835	192.168.1.106	192.168.2.4
Dec 3, 2024 13:57:06.548816919 CET	445	49836	192.168.1.107	192.168.2.4
Dec 3, 2024 13:57:06.548827887 CET	445	49837	192.168.1.108	192.168.2.4
Dec 3, 2024 13:57:06.548836946 CET	445	49838	192.168.1.109	192.168.2.4
Dec 3, 2024 13:57:06.548846006 CET	445	49839	192.168.1.110	192.168.2.4
Dec 3, 2024 13:57:06.548847914 CET	49821	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:06.548856020 CET	445	49840	192.168.1.111	192.168.2.4
Dec 3, 2024 13:57:06.548858881 CET	49822	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:06.548861027 CET	49823	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:06.548870087 CET	445	49841	192.168.1.112	192.168.2.4
Dec 3, 2024 13:57:06.548872948 CET	49824	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:06.548877954 CET	49825	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:06.548883915 CET	445	49740	192.168.1.11	192.168.2.4
Dec 3, 2024 13:57:06.548888922 CET	49826	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:06.548892975 CET	445	49742	192.168.1.12	192.168.2.4
Dec 3, 2024 13:57:06.548902035 CET	49827	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:06.548902988 CET	445	49745	192.168.1.14	192.168.2.4
Dec 3, 2024 13:57:06.549035072 CET	49740	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:06.549056053 CET	49742	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:06.549067020 CET	49828	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:06.549081087 CET	49829	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:06.549087048 CET	49830	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:06.549096107 CET	49833	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:06.549098015 CET	49832	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:06.549103022 CET	49831	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:06.549113035 CET	49834	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:06.549115896 CET	49835	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:06.549132109 CET	49837	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:06.549133062 CET	49836	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:06.549137115 CET	49838	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:06.549149036 CET	49840	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:06.549149990 CET	49841	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:06.549151897 CET	49839	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:06.549176931 CET	49745	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:06.550749063 CET	49810	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:06.551136971 CET	445	49766	192.168.1.37	192.168.2.4
Dec 3, 2024 13:57:06.551290989 CET	49766	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:06.552433968 CET	49814	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:06.553817987 CET	49806	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:06.555368900 CET	49815	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:06.556772947 CET	49819	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:06.558162928 CET	49821	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:06.559575081 CET	49824	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:06.560895920 CET	49827	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:06.562203884 CET	49830	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:06.563576937 CET	49833	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:06.564928055 CET	49836	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:06.566698074 CET	49839	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:06.568382025 CET	49811	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:06.577037096 CET	49808	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:06.583662987 CET	49816	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:06.586117029 CET	49813	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:06.589308977 CET	49838	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:06.591269970 CET	49834	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:06.594439030 CET	49829	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:06.595998049 CET	49825	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:06.596026897 CET	49823	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:06.598458052 CET	49817	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:06.603137970 CET	49809	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:06.610089064 CET	49822	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:06.620857954 CET	49826	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:06.623675108 CET	49818	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:06.623758078 CET	49812	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:06.623856068 CET	49841	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:06.623946905 CET	49840	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:06.624053001 CET	49837	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:06.624104023 CET	49835	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:06.624161959 CET	49831	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:06.624269962 CET	49832	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:06.625062943 CET	49828	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:06.628560066 CET	49820	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:06.628860950 CET	49851	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:06.630053043 CET	49852	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:06.631683111 CET	445	49768	192.168.1.39	192.168.2.4
Dec 3, 2024 13:57:06.631696939 CET	445	49771	192.168.1.42	192.168.2.4
Dec 3, 2024 13:57:06.631706953 CET	445	49774	192.168.1.45	192.168.2.4
Dec 3, 2024 13:57:06.631716967 CET	445	49774	192.168.1.45	192.168.2.4
Dec 3, 2024 13:57:06.631725073 CET	445	49777	192.168.1.46	192.168.2.4
Dec 3, 2024 13:57:06.631735086 CET	445	49780	192.168.1.51	192.168.2.4
Dec 3, 2024 13:57:06.631743908 CET	445	49783	192.168.1.54	192.168.2.4
Dec 3, 2024 13:57:06.631755114 CET	445	49784	192.168.1.55	192.168.2.4
Dec 3, 2024 13:57:06.631763935 CET	445	49787	192.168.1.58	192.168.2.4
Dec 3, 2024 13:57:06.631769896 CET	49768	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:06.631772995 CET	445	49782	192.168.1.53	192.168.2.4
Dec 3, 2024 13:57:06.631778002 CET	445	49779	192.168.1.50	192.168.2.4
Dec 3, 2024 13:57:06.631781101 CET	445	49770	192.168.1.41	192.168.2.4
Dec 3, 2024 13:57:06.631784916 CET	445	49773	192.168.1.43	192.168.2.4
Dec 3, 2024 13:57:06.631793976 CET	445	49772	192.168.1.44	192.168.2.4
Dec 3, 2024 13:57:06.631798029 CET	445	49749	192.168.1.20	192.168.2.4
Dec 3, 2024 13:57:06.631808043 CET	445	49751	192.168.1.22	192.168.2.4
Dec 3, 2024 13:57:06.631808043 CET	49771	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:06.631815910 CET	445	49755	192.168.1.27	192.168.2.4
Dec 3, 2024 13:57:06.631827116 CET	445	49757	192.168.1.28	192.168.2.4
Dec 3, 2024 13:57:06.631834984 CET	445	49744	192.168.1.16	192.168.2.4
Dec 3, 2024 13:57:06.631845951 CET	445	49759	192.168.1.30	192.168.2.4
Dec 3, 2024 13:57:06.631866932 CET	49774	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:06.631884098 CET	49777	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:06.631891966 CET	49780	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:06.631905079 CET	49783	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:06.631917000 CET	49784	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:06.631927967 CET	49787	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:06.631962061 CET	49770	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:06.631963968 CET	49779	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:06.631982088 CET	49772	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:06.632004976 CET	445	49759	192.168.1.30	192.168.2.4
Dec 3, 2024 13:57:06.632004976 CET	49749	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:06.632015944 CET	445	49761	192.168.1.32	192.168.2.4
Dec 3, 2024 13:57:06.632042885 CET	49755	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:06.632055044 CET	445	49763	192.168.1.34	192.168.2.4
Dec 3, 2024 13:57:06.632065058 CET	445	49753	192.168.1.24	192.168.2.4
Dec 3, 2024 13:57:06.632076025 CET	445	49747	192.168.1.18	192.168.2.4
Dec 3, 2024 13:57:06.632082939 CET	49757	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:06.632095098 CET	445	49769	192.168.1.40	192.168.2.4
Dec 3, 2024 13:57:06.632098913 CET	49782	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:06.632098913 CET	49773	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:06.632098913 CET	49751	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:06.632098913 CET	49744	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:06.632103920 CET	445	49775	192.168.1.47	192.168.2.4
Dec 3, 2024 13:57:06.632122040 CET	49761	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:06.632133961 CET	445	49785	192.168.1.56	192.168.2.4
Dec 3, 2024 13:57:06.632143974 CET	445	49786	192.168.1.57	192.168.2.4
Dec 3, 2024 13:57:06.632153988 CET	49763	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:06.632165909 CET	49753	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:06.632189035 CET	49769	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:06.632200003 CET	49775	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:06.632217884 CET	445	49793	192.168.1.64	192.168.2.4
Dec 3, 2024 13:57:06.632221937 CET	49785	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:06.632227898 CET	445	49794	192.168.1.65	192.168.2.4
Dec 3, 2024 13:57:06.632261992 CET	49793	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:06.632282019 CET	49794	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:06.632289886 CET	445	49797	192.168.1.68	192.168.2.4
Dec 3, 2024 13:57:06.632298946 CET	445	49799	192.168.1.70	192.168.2.4
Dec 3, 2024 13:57:06.632333994 CET	49797	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:06.632391930 CET	445	49802	192.168.1.73	192.168.2.4
Dec 3, 2024 13:57:06.632401943 CET	445	49741	192.168.1.13	192.168.2.4
Dec 3, 2024 13:57:06.632411957 CET	445	49746	192.168.1.17	192.168.2.4
Dec 3, 2024 13:57:06.632438898 CET	49802	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:06.632447004 CET	49741	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:06.632452011 CET	445	49760	192.168.1.31	192.168.2.4
Dec 3, 2024 13:57:06.632461071 CET	445	49764	192.168.1.35	192.168.2.4
Dec 3, 2024 13:57:06.632469893 CET	445	49750	192.168.1.21	192.168.2.4
Dec 3, 2024 13:57:06.632481098 CET	49746	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:06.632508039 CET	49760	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:06.632517099 CET	49764	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:06.632528067 CET	49750	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:06.633368015 CET	49759	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:06.633368015 CET	49747	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:06.633368015 CET	49786	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:06.633368015 CET	49799	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:06.638048887 CET	445	49776	192.168.1.48	192.168.2.4
Dec 3, 2024 13:57:06.638118982 CET	49776	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:06.638257027 CET	445	49778	192.168.1.49	192.168.2.4
Dec 3, 2024 13:57:06.638266087 CET	445	49789	192.168.1.60	192.168.2.4
Dec 3, 2024 13:57:06.638318062 CET	49789	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:06.642355919 CET	49778	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:06.661189079 CET	445	49791	192.168.1.62	192.168.2.4
Dec 3, 2024 13:57:06.661226988 CET	445	49842	192.168.1.113	192.168.2.4
Dec 3, 2024 13:57:06.661236048 CET	445	49843	192.168.1.114	192.168.2.4
Dec 3, 2024 13:57:06.661307096 CET	49791	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:06.661356926 CET	49842	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:06.661370039 CET	49843	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:06.661761045 CET	445	49798	192.168.1.69	192.168.2.4
Dec 3, 2024 13:57:06.661771059 CET	445	49801	192.168.1.72	192.168.2.4
Dec 3, 2024 13:57:06.661782026 CET	445	49790	192.168.1.61	192.168.2.4
Dec 3, 2024 13:57:06.661817074 CET	49798	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:06.661819935 CET	445	49788	192.168.1.59	192.168.2.4
Dec 3, 2024 13:57:06.661829948 CET	445	49767	192.168.1.38	192.168.2.4
Dec 3, 2024 13:57:06.661839962 CET	49801	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:06.661874056 CET	445	49804	192.168.1.75	192.168.2.4
Dec 3, 2024 13:57:06.661884069 CET	445	49765	192.168.1.36	192.168.2.4
Dec 3, 2024 13:57:06.661885977 CET	49788	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:06.661906004 CET	49767	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:06.661932945 CET	49804	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:06.661947012 CET	49765	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:06.662043095 CET	445	49743	192.168.1.15	192.168.2.4
Dec 3, 2024 13:57:06.662053108 CET	445	49800	192.168.1.71	192.168.2.4
Dec 3, 2024 13:57:06.662061930 CET	445	49796	192.168.1.67	192.168.2.4
Dec 3, 2024 13:57:06.662092924 CET	49743	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:06.662105083 CET	49800	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:06.662127972 CET	445	49792	192.168.1.63	192.168.2.4
Dec 3, 2024 13:57:06.662137032 CET	445	49752	192.168.1.23	192.168.2.4
Dec 3, 2024 13:57:06.662137985 CET	49796	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:06.662168980 CET	49792	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:06.662175894 CET	445	49844	192.168.1.115	192.168.2.4
Dec 3, 2024 13:57:06.662184954 CET	445	49758	192.168.1.29	192.168.2.4
Dec 3, 2024 13:57:06.662194014 CET	445	49803	192.168.1.74	192.168.2.4
Dec 3, 2024 13:57:06.662197113 CET	49752	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:06.662240028 CET	49758	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:06.662250996 CET	49844	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:06.662286043 CET	445	49795	192.168.1.66	192.168.2.4
Dec 3, 2024 13:57:06.662296057 CET	445	49762	192.168.1.33	192.168.2.4
Dec 3, 2024 13:57:06.662350893 CET	49762	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:06.662390947 CET	445	49781	192.168.1.52	192.168.2.4
Dec 3, 2024 13:57:06.662400961 CET	445	49748	192.168.1.19	192.168.2.4
Dec 3, 2024 13:57:06.662432909 CET	49781	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:06.662460089 CET	49748	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:06.662529945 CET	445	49754	192.168.1.25	192.168.2.4
Dec 3, 2024 13:57:06.662539959 CET	445	49756	192.168.1.26	192.168.2.4
Dec 3, 2024 13:57:06.662585020 CET	49754	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:06.662596941 CET	49756	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:06.664446115 CET	445	49845	192.168.1.116	192.168.2.4
Dec 3, 2024 13:57:06.664457083 CET	445	49846	192.168.1.117	192.168.2.4
Dec 3, 2024 13:57:06.664516926 CET	49845	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:06.664524078 CET	49846	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:06.665389061 CET	445	49847	192.168.1.118	192.168.2.4
Dec 3, 2024 13:57:06.666357994 CET	49790	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:06.666357994 CET	49803	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:06.666357994 CET	49795	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:06.666383028 CET	445	49848	192.168.1.119	192.168.2.4
Dec 3, 2024 13:57:06.666416883 CET	49847	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:06.666445017 CET	49848	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:06.668277979 CET	445	49849	192.168.1.120	192.168.2.4
Dec 3, 2024 13:57:06.668287992 CET	445	49850	192.168.1.121	192.168.2.4
Dec 3, 2024 13:57:06.668339968 CET	49849	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:06.668351889 CET	49850	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:06.670099020 CET	445	49805	192.168.1.76	192.168.2.4
Dec 3, 2024 13:57:06.671380043 CET	445	49807	192.168.1.78	192.168.2.4
Dec 3, 2024 13:57:06.671437979 CET	49805	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:06.672327995 CET	445	49810	192.168.1.81	192.168.2.4
Dec 3, 2024 13:57:06.672379017 CET	49807	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:06.672413111 CET	49810	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:06.673006058 CET	445	49814	192.168.1.86	192.168.2.4
Dec 3, 2024 13:57:06.675664902 CET	445	49806	192.168.1.77	192.168.2.4
Dec 3, 2024 13:57:06.675674915 CET	445	49815	192.168.1.85	192.168.2.4
Dec 3, 2024 13:57:06.675718069 CET	49814	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:06.675741911 CET	49806	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:06.675753117 CET	49815	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:06.678373098 CET	445	49819	192.168.1.90	192.168.2.4
Dec 3, 2024 13:57:06.679289103 CET	445	49821	192.168.1.92	192.168.2.4
Dec 3, 2024 13:57:06.679339886 CET	49819	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:06.679356098 CET	49821	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:06.680380106 CET	445	49824	192.168.1.95	192.168.2.4
Dec 3, 2024 13:57:06.681395054 CET	445	49827	192.168.1.98	192.168.2.4
Dec 3, 2024 13:57:06.681406021 CET	49824	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:06.681441069 CET	49827	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:06.683705091 CET	445	49830	192.168.1.101	192.168.2.4
Dec 3, 2024 13:57:06.683734894 CET	445	49833	192.168.1.104	192.168.2.4
Dec 3, 2024 13:57:06.683839083 CET	49833	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:06.684377909 CET	49830	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:06.685523987 CET	445	49836	192.168.1.107	192.168.2.4
Dec 3, 2024 13:57:06.685589075 CET	49836	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:06.687370062 CET	445	49839	192.168.1.110	192.168.2.4
Dec 3, 2024 13:57:06.687419891 CET	49839	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:06.687601089 CET	49842	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:06.687851906 CET	49843	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:06.687963963 CET	49844	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:06.688091040 CET	49845	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:06.688160896 CET	49846	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:06.688512087 CET	49847	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:06.688576937 CET	49848	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:06.688647032 CET	49849	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:06.688698053 CET	49850	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:06.690378904 CET	445	49811	192.168.1.82	192.168.2.4
Dec 3, 2024 13:57:06.690438986 CET	49811	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:06.705817938 CET	445	49808	192.168.1.79	192.168.2.4
Dec 3, 2024 13:57:06.705828905 CET	445	49816	192.168.1.87	192.168.2.4
Dec 3, 2024 13:57:06.705868959 CET	49808	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:06.705897093 CET	49816	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:06.708408117 CET	445	49813	192.168.1.84	192.168.2.4
Dec 3, 2024 13:57:06.708450079 CET	49813	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:06.711457014 CET	445	49838	192.168.1.109	192.168.2.4
Dec 3, 2024 13:57:06.711467981 CET	445	49834	192.168.1.105	192.168.2.4
Dec 3, 2024 13:57:06.711602926 CET	49838	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:06.711602926 CET	49834	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:06.716073990 CET	445	49829	192.168.1.100	192.168.2.4
Dec 3, 2024 13:57:06.716084957 CET	445	49825	192.168.1.96	192.168.2.4
Dec 3, 2024 13:57:06.716123104 CET	49829	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:06.716150045 CET	49825	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:06.730186939 CET	49853	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:06.730319023 CET	49854	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:06.732743025 CET	49855	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:06.738765001 CET	49856	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:06.743993998 CET	49857	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:06.745879889 CET	49858	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:06.747071981 CET	49859	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:06.747714043 CET	49860	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:06.747976065 CET	49861	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:06.748434067 CET	49862	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:06.748663902 CET	49863	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:06.749002934 CET	49864	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:06.749303102 CET	49865	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:06.749830961 CET	49866	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:06.750031948 CET	49867	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:06.750403881 CET	49868	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:06.751964092 CET	445	49823	192.168.1.94	192.168.2.4
Dec 3, 2024 13:57:06.752012968 CET	445	49851	192.168.1.122	192.168.2.4
Dec 3, 2024 13:57:06.752023935 CET	445	49852	192.168.1.123	192.168.2.4
Dec 3, 2024 13:57:06.752033949 CET	49823	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:06.752104044 CET	49851	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:06.752140045 CET	49852	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:06.752203941 CET	49851	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:06.752315044 CET	49852	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:06.752451897 CET	445	49817	192.168.1.88	192.168.2.4
Dec 3, 2024 13:57:06.752463102 CET	445	49809	192.168.1.80	192.168.2.4
Dec 3, 2024 13:57:06.752506018 CET	49817	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:06.752518892 CET	49809	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:06.752528906 CET	445	49822	192.168.1.93	192.168.2.4
Dec 3, 2024 13:57:06.752583027 CET	445	49826	192.168.1.97	192.168.2.4
Dec 3, 2024 13:57:06.752634048 CET	49822	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:06.752645016 CET	445	49818	192.168.1.89	192.168.2.4
Dec 3, 2024 13:57:06.752655029 CET	445	49812	192.168.1.83	192.168.2.4
Dec 3, 2024 13:57:06.752660036 CET	49826	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:06.752665043 CET	445	49841	192.168.1.112	192.168.2.4
Dec 3, 2024 13:57:06.752686024 CET	49818	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:06.752690077 CET	445	49840	192.168.1.111	192.168.2.4
Dec 3, 2024 13:57:06.752701998 CET	445	49837	192.168.1.108	192.168.2.4
Dec 3, 2024 13:57:06.752717018 CET	49812	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:06.752737045 CET	49841	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:06.752769947 CET	49840	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:06.752783060 CET	49837	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:06.752887011 CET	445	49835	192.168.1.106	192.168.2.4
Dec 3, 2024 13:57:06.752927065 CET	445	49831	192.168.1.103	192.168.2.4
Dec 3, 2024 13:57:06.752932072 CET	49835	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:06.752937078 CET	445	49832	192.168.1.102	192.168.2.4
Dec 3, 2024 13:57:06.752969027 CET	445	49828	192.168.1.99	192.168.2.4
Dec 3, 2024 13:57:06.752979040 CET	445	49820	192.168.1.91	192.168.2.4
Dec 3, 2024 13:57:06.752985954 CET	49831	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:06.752990961 CET	49832	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:06.753015995 CET	49828	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:06.753022909 CET	49820	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:06.804267883 CET	49869	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:06.805316925 CET	49870	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:06.805538893 CET	49871	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:06.805748940 CET	49872	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:06.805927992 CET	49873	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:06.806381941 CET	49874	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:06.807668924 CET	445	49842	192.168.1.113	192.168.2.4
Dec 3, 2024 13:57:06.807732105 CET	49842	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:06.807795048 CET	445	49843	192.168.1.114	192.168.2.4
Dec 3, 2024 13:57:06.807969093 CET	445	49844	192.168.1.115	192.168.2.4
Dec 3, 2024 13:57:06.808012009 CET	445	49845	192.168.1.116	192.168.2.4
Dec 3, 2024 13:57:06.808012962 CET	49843	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:06.808021069 CET	49844	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:06.808056116 CET	49845	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:06.808082104 CET	445	49846	192.168.1.117	192.168.2.4
Dec 3, 2024 13:57:06.808120012 CET	49846	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:06.808408022 CET	445	49847	192.168.1.118	192.168.2.4
Dec 3, 2024 13:57:06.808500051 CET	49876	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:06.808507919 CET	445	49848	192.168.1.119	192.168.2.4
Dec 3, 2024 13:57:06.808527946 CET	49847	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:06.808559895 CET	49848	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:06.808665037 CET	445	49849	192.168.1.120	192.168.2.4
Dec 3, 2024 13:57:06.808698893 CET	445	49850	192.168.1.121	192.168.2.4
Dec 3, 2024 13:57:06.808701992 CET	49849	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:06.808732986 CET	49850	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:06.808948994 CET	49877	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:06.810090065 CET	49875	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:06.810709953 CET	49878	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:06.811331987 CET	49879	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:06.811471939 CET	49880	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:06.811671972 CET	49881	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:06.812640905 CET	49882	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:06.813364029 CET	49884	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:06.813376904 CET	49883	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:06.813607931 CET	49885	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:06.813802004 CET	49886	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:06.814395905 CET	49888	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:06.814649105 CET	49889	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:06.814840078 CET	49890	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:06.815020084 CET	49891	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:06.815340042 CET	49887	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:06.815629005 CET	49892	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:06.815903902 CET	49893	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:06.816107988 CET	49894	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:06.816313028 CET	49895	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:06.816608906 CET	49896	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:06.817030907 CET	49897	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:06.817281008 CET	49898	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:06.818119049 CET	49899	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:06.818460941 CET	49900	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:06.820868969 CET	49901	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:06.821207047 CET	49902	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:06.821477890 CET	49903	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:06.821751118 CET	49904	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:06.821881056 CET	49905	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:06.822115898 CET	49906	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:06.822225094 CET	49907	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:06.822396040 CET	49908	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:06.822570086 CET	49909	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:06.822810888 CET	49910	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:06.822913885 CET	49911	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:06.823090076 CET	49912	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:06.823302984 CET	49913	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:06.823503971 CET	49914	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:06.823694944 CET	49915	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:06.823899984 CET	49916	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:06.824110031 CET	49917	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:06.824323893 CET	49918	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:06.824466944 CET	49919	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:06.824654102 CET	49920	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:06.824848890 CET	49921	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:06.825043917 CET	49922	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:06.825232983 CET	49923	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:06.825653076 CET	49924	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:06.825850964 CET	49925	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:06.826052904 CET	49926	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:06.826260090 CET	49927	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:06.826524973 CET	49928	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:06.826785088 CET	49929	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:06.827012062 CET	49930	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:06.827254057 CET	49931	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:06.827449083 CET	49932	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:06.827661991 CET	49933	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:06.827845097 CET	49934	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:06.828042030 CET	49935	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:06.828238964 CET	49936	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:06.828408957 CET	49937	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:06.828609943 CET	49938	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:06.828885078 CET	49939	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:06.828953028 CET	49940	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:06.829149961 CET	49941	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:06.829474926 CET	49942	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:06.829543114 CET	49943	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:06.829751968 CET	49944	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:06.829960108 CET	49945	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:06.830267906 CET	49946	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:06.830344915 CET	49947	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:06.830529928 CET	49948	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:06.830728054 CET	49949	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:06.830982924 CET	49950	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:06.831132889 CET	49951	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:06.831401110 CET	49952	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:06.831613064 CET	49953	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:06.831861973 CET	49954	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:06.832077026 CET	49955	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:06.832268000 CET	49956	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:06.832474947 CET	49957	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:06.832660913 CET	49958	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:06.832854033 CET	49959	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:06.833065033 CET	49960	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:06.833256006 CET	49961	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:06.833477020 CET	49962	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:06.833656073 CET	49963	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:06.833854914 CET	49964	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:06.834043026 CET	49965	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:06.834222078 CET	49966	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:06.834403992 CET	49967	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:06.834595919 CET	49968	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:06.834794998 CET	49969	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:06.834969044 CET	49970	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:06.835180998 CET	49971	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:06.835338116 CET	49972	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:06.835545063 CET	49973	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:06.835910082 CET	49974	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:06.836241961 CET	49975	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:06.836291075 CET	49976	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:06.836486101 CET	49977	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:06.836685896 CET	49978	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:06.836937904 CET	49979	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:06.837034941 CET	49980	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:06.837212086 CET	49981	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:06.837400913 CET	49982	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:06.838376999 CET	49983	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:06.850274086 CET	445	49853	192.168.1.124	192.168.2.4
Dec 3, 2024 13:57:06.850330114 CET	445	49854	192.168.1.125	192.168.2.4
Dec 3, 2024 13:57:06.850400925 CET	49853	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:06.850472927 CET	49854	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:06.850474119 CET	49853	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:06.851001978 CET	49854	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:06.852710962 CET	445	49855	192.168.1.126	192.168.2.4
Dec 3, 2024 13:57:06.857199907 CET	49855	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:06.857285976 CET	49855	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:06.858834982 CET	445	49856	192.168.1.127	192.168.2.4
Dec 3, 2024 13:57:06.858901024 CET	49856	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:06.858948946 CET	49856	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:06.864043951 CET	445	49857	192.168.1.128	192.168.2.4
Dec 3, 2024 13:57:06.864109993 CET	49857	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:06.864175081 CET	49857	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:06.865885019 CET	445	49858	192.168.1.129	192.168.2.4
Dec 3, 2024 13:57:06.865946054 CET	49858	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:06.866039038 CET	49858	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:06.867136002 CET	445	49859	192.168.1.130	192.168.2.4
Dec 3, 2024 13:57:06.867194891 CET	49859	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:06.867280960 CET	49859	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:06.867954969 CET	445	49860	192.168.1.131	192.168.2.4
Dec 3, 2024 13:57:06.868005037 CET	49860	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:06.868068933 CET	49860	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:06.868103981 CET	445	49861	192.168.1.132	192.168.2.4
Dec 3, 2024 13:57:06.868432045 CET	445	49862	192.168.1.133	192.168.2.4
Dec 3, 2024 13:57:06.868485928 CET	49861	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:06.868552923 CET	49861	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:06.868554115 CET	49862	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:06.868650913 CET	49862	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:06.868678093 CET	445	49863	192.168.1.134	192.168.2.4
Dec 3, 2024 13:57:06.868724108 CET	49863	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:06.868791103 CET	49863	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:06.868994951 CET	445	49864	192.168.1.135	192.168.2.4
Dec 3, 2024 13:57:06.869038105 CET	49864	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:06.869076967 CET	49864	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:06.869121075 CET	445	49865	192.168.1.136	192.168.2.4
Dec 3, 2024 13:57:06.869755983 CET	445	49866	192.168.1.137	192.168.2.4
Dec 3, 2024 13:57:06.869806051 CET	49865	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:06.869849920 CET	49865	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:06.869851112 CET	49866	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:06.869877100 CET	445	49867	192.168.1.138	192.168.2.4
Dec 3, 2024 13:57:06.869923115 CET	49866	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:06.869946957 CET	49867	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:06.870019913 CET	49867	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:06.870349884 CET	445	49868	192.168.1.139	192.168.2.4
Dec 3, 2024 13:57:06.870868921 CET	49868	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:06.870925903 CET	49868	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:06.872917891 CET	445	49851	192.168.1.122	192.168.2.4
Dec 3, 2024 13:57:06.873117924 CET	445	49852	192.168.1.123	192.168.2.4
Dec 3, 2024 13:57:06.873163939 CET	49851	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:06.873179913 CET	49852	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:06.924464941 CET	445	49869	192.168.1.140	192.168.2.4
Dec 3, 2024 13:57:06.925251961 CET	445	49870	192.168.1.141	192.168.2.4
Dec 3, 2024 13:57:06.925353050 CET	49869	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:06.925405979 CET	445	49871	192.168.1.142	192.168.2.4
Dec 3, 2024 13:57:06.925431013 CET	49870	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:06.925451040 CET	49871	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:06.925595045 CET	49869	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:06.925705910 CET	445	49872	192.168.1.143	192.168.2.4
Dec 3, 2024 13:57:06.925789118 CET	49870	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:06.925808907 CET	445	49873	192.168.1.144	192.168.2.4
Dec 3, 2024 13:57:06.925815105 CET	49872	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:06.925851107 CET	49873	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:06.925904036 CET	49871	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:06.925996065 CET	49872	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:06.926076889 CET	49873	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:06.926259995 CET	445	49874	192.168.1.145	192.168.2.4
Dec 3, 2024 13:57:06.928488016 CET	445	49876	192.168.1.147	192.168.2.4
Dec 3, 2024 13:57:06.928550005 CET	49876	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:06.928550005 CET	49874	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:06.928595066 CET	49874	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:06.928675890 CET	49876	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:06.928828001 CET	445	49877	192.168.1.148	192.168.2.4
Dec 3, 2024 13:57:06.928878069 CET	49877	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:06.928920984 CET	49877	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:06.929949999 CET	445	49875	192.168.1.146	192.168.2.4
Dec 3, 2024 13:57:06.930536032 CET	445	49878	192.168.1.149	192.168.2.4
Dec 3, 2024 13:57:06.931196928 CET	445	49879	192.168.1.150	192.168.2.4
Dec 3, 2024 13:57:06.931272984 CET	49878	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:06.931296110 CET	445	49880	192.168.1.151	192.168.2.4
Dec 3, 2024 13:57:06.931307077 CET	49878	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:06.931350946 CET	49880	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:06.931514025 CET	445	49881	192.168.1.152	192.168.2.4
Dec 3, 2024 13:57:06.931514978 CET	49880	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:06.931552887 CET	49881	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:06.931601048 CET	49881	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:06.932574034 CET	445	49882	192.168.1.153	192.168.2.4
Dec 3, 2024 13:57:06.933378935 CET	49875	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:06.933378935 CET	49875	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:06.933378935 CET	49879	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:06.933378935 CET	49879	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:06.933412075 CET	49882	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:06.933450937 CET	49882	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:06.933479071 CET	445	49884	192.168.1.155	192.168.2.4
Dec 3, 2024 13:57:06.933490038 CET	445	49883	192.168.1.154	192.168.2.4
Dec 3, 2024 13:57:06.933543921 CET	49884	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:06.933581114 CET	445	49885	192.168.1.156	192.168.2.4
Dec 3, 2024 13:57:06.933594942 CET	49884	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:06.933619976 CET	49885	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:06.933757067 CET	445	49886	192.168.1.157	192.168.2.4
Dec 3, 2024 13:57:06.933773041 CET	49885	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:06.933803082 CET	49886	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:06.933872938 CET	49886	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:06.934206963 CET	445	49888	192.168.1.159	192.168.2.4
Dec 3, 2024 13:57:06.934468031 CET	445	49889	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:06.934523106 CET	49888	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:06.934593916 CET	49889	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:06.934595108 CET	49888	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:06.934676886 CET	49889	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:06.934735060 CET	445	49890	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:06.934890985 CET	445	49891	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:06.934942007 CET	49890	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:06.934978008 CET	49890	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:06.934981108 CET	49891	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:06.935051918 CET	49891	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:06.935172081 CET	445	49887	192.168.1.158	192.168.2.4
Dec 3, 2024 13:57:06.935506105 CET	445	49892	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:06.935719013 CET	445	49893	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:06.935772896 CET	49893	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:06.935774088 CET	49892	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:06.935815096 CET	49892	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:06.935897112 CET	49893	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:06.935934067 CET	445	49894	192.168.1.165	192.168.2.4
Dec 3, 2024 13:57:06.935980082 CET	49894	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:06.936019897 CET	49894	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:06.936147928 CET	445	49895	192.168.1.166	192.168.2.4
Dec 3, 2024 13:57:06.936193943 CET	49895	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:06.936230898 CET	49895	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:06.936388016 CET	49883	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:06.936388016 CET	49883	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:06.936388016 CET	49887	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:06.936388016 CET	49887	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:06.936495066 CET	445	49896	192.168.1.167	192.168.2.4
Dec 3, 2024 13:57:06.937012911 CET	445	49897	192.168.1.168	192.168.2.4
Dec 3, 2024 13:57:06.937069893 CET	49896	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:06.937069893 CET	49897	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:06.937113047 CET	49896	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:06.937191963 CET	49897	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:06.937244892 CET	445	49898	192.168.1.169	192.168.2.4
Dec 3, 2024 13:57:06.938368082 CET	445	49899	192.168.1.170	192.168.2.4
Dec 3, 2024 13:57:06.938424110 CET	49898	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:06.938425064 CET	49899	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:06.938462019 CET	49898	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:06.938540936 CET	49899	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:06.939137936 CET	445	49900	192.168.1.171	192.168.2.4
Dec 3, 2024 13:57:06.941919088 CET	445	49901	192.168.1.172	192.168.2.4
Dec 3, 2024 13:57:06.941935062 CET	445	49902	192.168.1.173	192.168.2.4
Dec 3, 2024 13:57:06.941982985 CET	49900	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:06.942015886 CET	49900	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:06.942015886 CET	49902	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:06.942015886 CET	49901	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:06.942092896 CET	49901	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:06.942202091 CET	49902	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:06.947010040 CET	445	49903	192.168.1.174	192.168.2.4
Dec 3, 2024 13:57:06.947027922 CET	445	49904	192.168.1.175	192.168.2.4
Dec 3, 2024 13:57:06.947057009 CET	445	49905	192.168.1.176	192.168.2.4
Dec 3, 2024 13:57:06.947067022 CET	445	49906	192.168.1.177	192.168.2.4
Dec 3, 2024 13:57:06.947076082 CET	445	49907	192.168.1.178	192.168.2.4
Dec 3, 2024 13:57:06.947086096 CET	445	49908	192.168.1.179	192.168.2.4
Dec 3, 2024 13:57:06.947093964 CET	445	49909	192.168.1.180	192.168.2.4
Dec 3, 2024 13:57:06.947108984 CET	49903	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:06.947113037 CET	445	49910	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:06.947124004 CET	445	49911	192.168.1.182	192.168.2.4
Dec 3, 2024 13:57:06.947133064 CET	445	49912	192.168.1.183	192.168.2.4
Dec 3, 2024 13:57:06.947143078 CET	445	49913	192.168.1.184	192.168.2.4
Dec 3, 2024 13:57:06.947151899 CET	445	49914	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:06.947163105 CET	445	49915	192.168.1.186	192.168.2.4
Dec 3, 2024 13:57:06.947171926 CET	445	49916	192.168.1.187	192.168.2.4
Dec 3, 2024 13:57:06.947180033 CET	445	49917	192.168.1.188	192.168.2.4
Dec 3, 2024 13:57:06.947191000 CET	445	49918	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:06.947191954 CET	49905	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:06.947201967 CET	49907	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:06.947207928 CET	49908	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:06.947215080 CET	49909	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:06.947231054 CET	445	49919	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:06.947241068 CET	445	49920	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:06.947248936 CET	445	49921	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:06.947259903 CET	445	49922	192.168.1.193	192.168.2.4
Dec 3, 2024 13:57:06.947268009 CET	445	49923	192.168.1.194	192.168.2.4
Dec 3, 2024 13:57:06.947277069 CET	445	49924	192.168.1.195	192.168.2.4
Dec 3, 2024 13:57:06.947334051 CET	49911	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:06.947334051 CET	49912	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:06.947334051 CET	49913	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:06.947352886 CET	49915	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:06.947355986 CET	445	49925	192.168.1.196	192.168.2.4
Dec 3, 2024 13:57:06.947367907 CET	49917	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:06.947369099 CET	49916	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:06.947375059 CET	445	49926	192.168.1.197	192.168.2.4
Dec 3, 2024 13:57:06.947381020 CET	49904	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:06.947381020 CET	49906	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:06.947381020 CET	49910	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:06.947381020 CET	49914	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:06.947381020 CET	49918	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:06.947385073 CET	445	49927	192.168.1.198	192.168.2.4
Dec 3, 2024 13:57:06.947396994 CET	445	49928	192.168.1.199	192.168.2.4
Dec 3, 2024 13:57:06.947458982 CET	49919	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:06.947465897 CET	49921	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:06.947467089 CET	49920	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:06.947479963 CET	49922	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:06.947482109 CET	49923	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:06.947491884 CET	49925	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:06.947494030 CET	49924	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:06.947536945 CET	49926	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:06.947550058 CET	49928	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:06.947550058 CET	49927	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:06.947650909 CET	49903	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:06.947896004 CET	49905	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:06.948143959 CET	49907	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:06.948231936 CET	49908	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:06.948271036 CET	49904	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:06.948271036 CET	49906	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:06.948308945 CET	49909	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:06.948395014 CET	49910	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:06.948478937 CET	49911	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:06.948579073 CET	49912	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:06.948724985 CET	49913	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:06.948879957 CET	49914	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:06.948924065 CET	49915	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:06.948997021 CET	49916	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:06.949079037 CET	49917	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:06.949243069 CET	49919	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:06.949321985 CET	49920	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:06.949357986 CET	49918	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:06.949402094 CET	49921	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:06.949491024 CET	49922	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:06.949558973 CET	49923	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:06.949651957 CET	49924	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:06.949728966 CET	49925	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:06.949810028 CET	49926	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:06.949886084 CET	49927	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:06.949966908 CET	49928	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:06.953289032 CET	445	49929	192.168.1.200	192.168.2.4
Dec 3, 2024 13:57:06.953309059 CET	445	49930	192.168.1.201	192.168.2.4
Dec 3, 2024 13:57:06.953319073 CET	445	49931	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:06.953329086 CET	445	49932	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:06.953337908 CET	445	49933	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:06.953346968 CET	445	49934	192.168.1.205	192.168.2.4
Dec 3, 2024 13:57:06.953372955 CET	445	49935	192.168.1.206	192.168.2.4
Dec 3, 2024 13:57:06.953382015 CET	445	49936	192.168.1.207	192.168.2.4
Dec 3, 2024 13:57:06.953385115 CET	49929	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:06.953392029 CET	445	49937	192.168.1.208	192.168.2.4
Dec 3, 2024 13:57:06.953397989 CET	49930	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:06.953399897 CET	49931	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:06.953402996 CET	445	49938	192.168.1.209	192.168.2.4
Dec 3, 2024 13:57:06.953413963 CET	445	49939	192.168.1.210	192.168.2.4
Dec 3, 2024 13:57:06.953432083 CET	445	49940	192.168.1.211	192.168.2.4
Dec 3, 2024 13:57:06.953440905 CET	445	49941	192.168.1.212	192.168.2.4
Dec 3, 2024 13:57:06.953450918 CET	445	49942	192.168.1.213	192.168.2.4
Dec 3, 2024 13:57:06.953459024 CET	445	49943	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:06.953463078 CET	49932	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:06.953469038 CET	445	49944	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:06.953478098 CET	445	49945	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:06.953478098 CET	49934	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:06.953480005 CET	49933	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:06.953486919 CET	49935	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:06.953497887 CET	445	49946	192.168.1.217	192.168.2.4
Dec 3, 2024 13:57:06.953507900 CET	445	49947	192.168.1.218	192.168.2.4
Dec 3, 2024 13:57:06.953517914 CET	445	49948	192.168.1.219	192.168.2.4
Dec 3, 2024 13:57:06.953531027 CET	445	49949	192.168.1.220	192.168.2.4
Dec 3, 2024 13:57:06.953540087 CET	445	49950	192.168.1.221	192.168.2.4
Dec 3, 2024 13:57:06.953548908 CET	445	49951	192.168.1.222	192.168.2.4
Dec 3, 2024 13:57:06.953591108 CET	49937	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:06.953604937 CET	49940	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:06.953604937 CET	49941	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:06.953605890 CET	49939	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:06.953617096 CET	49943	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:06.953623056 CET	49944	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:06.953625917 CET	445	49952	192.168.1.223	192.168.2.4
Dec 3, 2024 13:57:06.953633070 CET	49945	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:06.953636885 CET	445	49953	192.168.1.224	192.168.2.4
Dec 3, 2024 13:57:06.953645945 CET	445	49954	192.168.1.225	192.168.2.4
Dec 3, 2024 13:57:06.953670979 CET	445	49955	192.168.1.226	192.168.2.4
Dec 3, 2024 13:57:06.953680992 CET	445	49956	192.168.1.227	192.168.2.4
Dec 3, 2024 13:57:06.953691006 CET	445	49957	192.168.1.228	192.168.2.4
Dec 3, 2024 13:57:06.953720093 CET	49948	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:06.953721046 CET	49947	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:06.953756094 CET	49951	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:06.953756094 CET	49949	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:06.953756094 CET	49936	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:06.953756094 CET	49952	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:06.953756094 CET	49938	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:06.953756094 CET	49942	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:06.953756094 CET	49946	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:06.953756094 CET	49950	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:06.953803062 CET	49953	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:06.953815937 CET	49955	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:06.953816891 CET	49954	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:06.953828096 CET	49957	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:06.953829050 CET	49956	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:06.953891039 CET	49929	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:06.953988075 CET	49930	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:06.954071045 CET	49931	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:06.954154015 CET	49932	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:06.954229116 CET	49933	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:06.954308987 CET	49934	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:06.954418898 CET	49935	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:06.954454899 CET	445	49958	192.168.1.229	192.168.2.4
Dec 3, 2024 13:57:06.954469919 CET	445	49959	192.168.1.230	192.168.2.4
Dec 3, 2024 13:57:06.954478979 CET	445	49960	192.168.1.231	192.168.2.4
Dec 3, 2024 13:57:06.954497099 CET	445	49961	192.168.1.232	192.168.2.4
Dec 3, 2024 13:57:06.954503059 CET	49958	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:06.954508066 CET	445	49962	192.168.1.233	192.168.2.4
Dec 3, 2024 13:57:06.954535961 CET	49959	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:06.954572916 CET	49960	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:06.954572916 CET	49961	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:06.954615116 CET	49962	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:06.954708099 CET	49937	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:06.954854012 CET	49939	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:06.954927921 CET	49940	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:06.955007076 CET	49941	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:06.955051899 CET	49936	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:06.955051899 CET	49938	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:06.955153942 CET	49943	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:06.955226898 CET	49944	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:06.955303907 CET	49945	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:06.955327988 CET	49942	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:06.955475092 CET	49947	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:06.955544949 CET	49948	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:06.955667973 CET	49949	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:06.955840111 CET	49951	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:06.955908060 CET	49946	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:06.955908060 CET	49950	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:06.955926895 CET	49952	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:06.956015110 CET	49953	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:06.956068993 CET	445	49963	192.168.1.234	192.168.2.4
Dec 3, 2024 13:57:06.956084967 CET	445	49964	192.168.1.235	192.168.2.4
Dec 3, 2024 13:57:06.956089973 CET	49954	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:06.956095934 CET	445	49965	192.168.1.236	192.168.2.4
Dec 3, 2024 13:57:06.956116915 CET	445	49966	192.168.1.237	192.168.2.4
Dec 3, 2024 13:57:06.956119061 CET	49963	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:06.956126928 CET	445	49967	192.168.1.238	192.168.2.4
Dec 3, 2024 13:57:06.956135988 CET	445	49968	192.168.1.239	192.168.2.4
Dec 3, 2024 13:57:06.956146002 CET	445	49969	192.168.1.240	192.168.2.4
Dec 3, 2024 13:57:06.956155062 CET	49964	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:06.956156015 CET	445	49970	192.168.1.241	192.168.2.4
Dec 3, 2024 13:57:06.956166029 CET	445	49971	192.168.1.242	192.168.2.4
Dec 3, 2024 13:57:06.956167936 CET	49965	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:06.956182957 CET	445	49972	192.168.1.243	192.168.2.4
Dec 3, 2024 13:57:06.956192017 CET	445	49973	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:06.956201077 CET	445	49974	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:06.956212997 CET	49966	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:06.956222057 CET	445	49975	192.168.1.247	192.168.2.4
Dec 3, 2024 13:57:06.956227064 CET	49967	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:06.956233025 CET	49969	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:06.956233025 CET	49968	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:06.956300974 CET	49970	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:06.956305981 CET	49972	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:06.956326008 CET	49974	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:06.956330061 CET	49973	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:06.956338882 CET	49971	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:06.956424952 CET	49955	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:06.956429958 CET	49975	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:06.956518888 CET	49956	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:06.956588984 CET	49957	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:06.956681967 CET	49958	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:06.956753016 CET	49959	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:06.956823111 CET	49960	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:06.956896067 CET	49961	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:06.956976891 CET	49962	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:06.957051992 CET	49963	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:06.957124949 CET	49964	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:06.957211018 CET	49965	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:06.957288027 CET	49966	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:06.957360983 CET	49967	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:06.957444906 CET	49968	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:06.957535982 CET	49969	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:06.957614899 CET	49970	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:06.957751989 CET	49972	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:06.957817078 CET	49971	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:06.957848072 CET	49973	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:06.957928896 CET	49974	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:06.957998991 CET	49975	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:06.970592022 CET	445	49976	192.168.1.246	192.168.2.4
Dec 3, 2024 13:57:06.970607996 CET	445	49977	192.168.1.248	192.168.2.4
Dec 3, 2024 13:57:06.970618010 CET	445	49978	192.168.1.249	192.168.2.4
Dec 3, 2024 13:57:06.970628023 CET	445	49979	192.168.1.250	192.168.2.4
Dec 3, 2024 13:57:06.970638037 CET	445	49980	192.168.1.251	192.168.2.4
Dec 3, 2024 13:57:06.970645905 CET	445	49981	192.168.1.252	192.168.2.4
Dec 3, 2024 13:57:06.970654964 CET	445	49982	192.168.1.253	192.168.2.4
Dec 3, 2024 13:57:06.970669031 CET	445	49983	192.168.1.254	192.168.2.4
Dec 3, 2024 13:57:06.970854044 CET	49976	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:06.970879078 CET	49977	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:06.970879078 CET	49978	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:06.970899105 CET	49980	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:06.970906019 CET	49981	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:06.970906019 CET	49982	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:06.970911980 CET	445	49853	192.168.1.124	192.168.2.4
Dec 3, 2024 13:57:06.970935106 CET	49979	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:06.970935106 CET	49983	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:06.970974922 CET	49853	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:06.971091032 CET	49976	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:06.971240044 CET	49977	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:06.971324921 CET	49978	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:06.971424103 CET	49979	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:06.971481085 CET	49980	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:06.971580029 CET	49981	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:06.971657991 CET	49982	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:06.971764088 CET	49983	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:06.973376036 CET	445	49854	192.168.1.125	192.168.2.4
Dec 3, 2024 13:57:06.973432064 CET	49854	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:06.979952097 CET	445	49855	192.168.1.126	192.168.2.4
Dec 3, 2024 13:57:06.980003119 CET	49855	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:06.984843969 CET	445	49856	192.168.1.127	192.168.2.4
Dec 3, 2024 13:57:06.984900951 CET	49856	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:06.986308098 CET	445	49857	192.168.1.128	192.168.2.4
Dec 3, 2024 13:57:06.986366987 CET	49857	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:06.987795115 CET	445	49858	192.168.1.129	192.168.2.4
Dec 3, 2024 13:57:06.987837076 CET	49858	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:06.988425970 CET	445	49859	192.168.1.130	192.168.2.4
Dec 3, 2024 13:57:06.988485098 CET	49859	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:06.988780975 CET	445	49860	192.168.1.131	192.168.2.4
Dec 3, 2024 13:57:06.988833904 CET	49860	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:06.989399910 CET	445	49861	192.168.1.132	192.168.2.4
Dec 3, 2024 13:57:06.989707947 CET	445	49862	192.168.1.133	192.168.2.4
Dec 3, 2024 13:57:06.989753008 CET	49861	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:06.989778042 CET	49862	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:06.989984989 CET	445	49863	192.168.1.134	192.168.2.4
Dec 3, 2024 13:57:06.990111113 CET	445	49864	192.168.1.135	192.168.2.4
Dec 3, 2024 13:57:06.990252018 CET	49863	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:06.990262985 CET	49864	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:06.990864992 CET	445	49865	192.168.1.136	192.168.2.4
Dec 3, 2024 13:57:06.991076946 CET	445	49866	192.168.1.137	192.168.2.4
Dec 3, 2024 13:57:06.991126060 CET	49865	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:06.991147041 CET	49866	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:06.991350889 CET	445	49867	192.168.1.138	192.168.2.4
Dec 3, 2024 13:57:06.991396904 CET	49867	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:06.992930889 CET	445	49868	192.168.1.139	192.168.2.4
Dec 3, 2024 13:57:06.992989063 CET	49868	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:07.049791098 CET	445	49869	192.168.1.140	192.168.2.4
Dec 3, 2024 13:57:07.049885988 CET	49869	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:07.050203085 CET	445	49870	192.168.1.141	192.168.2.4
Dec 3, 2024 13:57:07.050333977 CET	49870	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:07.050479889 CET	445	49871	192.168.1.142	192.168.2.4
Dec 3, 2024 13:57:07.050578117 CET	49871	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:07.050898075 CET	445	49872	192.168.1.143	192.168.2.4
Dec 3, 2024 13:57:07.050961971 CET	49872	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:07.051038980 CET	445	49873	192.168.1.144	192.168.2.4
Dec 3, 2024 13:57:07.051091909 CET	49873	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:07.052382946 CET	445	49874	192.168.1.145	192.168.2.4
Dec 3, 2024 13:57:07.052452087 CET	49874	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:07.052706003 CET	445	49876	192.168.1.147	192.168.2.4
Dec 3, 2024 13:57:07.052826881 CET	445	49877	192.168.1.148	192.168.2.4
Dec 3, 2024 13:57:07.052882910 CET	49876	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:07.052891970 CET	49877	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:07.054735899 CET	445	49878	192.168.1.149	192.168.2.4
Dec 3, 2024 13:57:07.054809093 CET	49878	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:07.055200100 CET	445	49880	192.168.1.151	192.168.2.4
Dec 3, 2024 13:57:07.055263042 CET	49880	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:07.055365086 CET	445	49881	192.168.1.152	192.168.2.4
Dec 3, 2024 13:57:07.055444002 CET	49881	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:07.056879044 CET	445	49875	192.168.1.146	192.168.2.4
Dec 3, 2024 13:57:07.057087898 CET	49875	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:07.057317972 CET	445	49879	192.168.1.150	192.168.2.4
Dec 3, 2024 13:57:07.057393074 CET	49879	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:07.057729959 CET	445	49882	192.168.1.153	192.168.2.4
Dec 3, 2024 13:57:07.057785034 CET	49882	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:07.058080912 CET	445	49884	192.168.1.155	192.168.2.4
Dec 3, 2024 13:57:07.058332920 CET	49884	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:07.058357954 CET	445	49885	192.168.1.156	192.168.2.4
Dec 3, 2024 13:57:07.058414936 CET	49885	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:07.058630943 CET	445	49886	192.168.1.157	192.168.2.4
Dec 3, 2024 13:57:07.058689117 CET	49886	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:07.059053898 CET	445	49888	192.168.1.159	192.168.2.4
Dec 3, 2024 13:57:07.059357882 CET	445	49893	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:07.059369087 CET	445	49892	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:07.059379101 CET	445	49891	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:07.059389114 CET	445	49890	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:07.059398890 CET	445	49889	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:07.059408903 CET	49888	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:07.059465885 CET	445	49889	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:07.059510946 CET	49889	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:07.059798956 CET	445	49890	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:07.059855938 CET	49890	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:07.060273886 CET	445	49891	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:07.060316086 CET	49891	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:07.060555935 CET	445	49893	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:07.060648918 CET	49893	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:07.060837030 CET	445	49892	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:07.060888052 CET	49892	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:07.061173916 CET	445	49894	192.168.1.165	192.168.2.4
Dec 3, 2024 13:57:07.061223030 CET	49894	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:07.061381102 CET	445	49895	192.168.1.166	192.168.2.4
Dec 3, 2024 13:57:07.061661005 CET	445	49883	192.168.1.154	192.168.2.4
Dec 3, 2024 13:57:07.061708927 CET	49895	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:07.061758995 CET	49883	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:07.061952114 CET	445	49887	192.168.1.158	192.168.2.4
Dec 3, 2024 13:57:07.062016964 CET	49887	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:07.062181950 CET	445	49896	192.168.1.167	192.168.2.4
Dec 3, 2024 13:57:07.062232971 CET	49896	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:07.062472105 CET	445	49897	192.168.1.168	192.168.2.4
Dec 3, 2024 13:57:07.062524080 CET	49897	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:07.062803984 CET	445	49898	192.168.1.169	192.168.2.4
Dec 3, 2024 13:57:07.062855959 CET	49898	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:07.062899113 CET	445	49899	192.168.1.170	192.168.2.4
Dec 3, 2024 13:57:07.062942982 CET	49899	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:07.066214085 CET	445	49900	192.168.1.171	192.168.2.4
Dec 3, 2024 13:57:07.066261053 CET	49900	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:07.066586018 CET	445	49901	192.168.1.172	192.168.2.4
Dec 3, 2024 13:57:07.066596985 CET	445	49902	192.168.1.173	192.168.2.4
Dec 3, 2024 13:57:07.066641092 CET	49901	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:07.066652060 CET	49902	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:07.078542948 CET	445	49903	192.168.1.174	192.168.2.4
Dec 3, 2024 13:57:07.078557968 CET	445	49905	192.168.1.176	192.168.2.4
Dec 3, 2024 13:57:07.078577995 CET	445	49907	192.168.1.178	192.168.2.4
Dec 3, 2024 13:57:07.078588009 CET	445	49908	192.168.1.179	192.168.2.4
Dec 3, 2024 13:57:07.078597069 CET	445	49909	192.168.1.180	192.168.2.4
Dec 3, 2024 13:57:07.078603029 CET	49903	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:07.078614950 CET	445	49911	192.168.1.182	192.168.2.4
Dec 3, 2024 13:57:07.078625917 CET	445	49912	192.168.1.183	192.168.2.4
Dec 3, 2024 13:57:07.078627110 CET	49905	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:07.078635931 CET	445	49904	192.168.1.175	192.168.2.4
Dec 3, 2024 13:57:07.078653097 CET	49907	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:07.078660965 CET	49908	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:07.078679085 CET	49909	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:07.078689098 CET	445	49913	192.168.1.184	192.168.2.4
Dec 3, 2024 13:57:07.078697920 CET	49911	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:07.078715086 CET	49912	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:07.078747034 CET	49913	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:07.078784943 CET	49904	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:07.079436064 CET	445	49915	192.168.1.186	192.168.2.4
Dec 3, 2024 13:57:07.079483986 CET	49915	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:07.079536915 CET	445	49916	192.168.1.187	192.168.2.4
Dec 3, 2024 13:57:07.079546928 CET	445	49917	192.168.1.188	192.168.2.4
Dec 3, 2024 13:57:07.079559088 CET	445	49906	192.168.1.177	192.168.2.4
Dec 3, 2024 13:57:07.079577923 CET	49916	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:07.079586029 CET	49917	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:07.079602957 CET	445	49928	192.168.1.199	192.168.2.4
Dec 3, 2024 13:57:07.079626083 CET	445	49927	192.168.1.198	192.168.2.4
Dec 3, 2024 13:57:07.079643965 CET	49906	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:07.079678059 CET	445	49926	192.168.1.197	192.168.2.4
Dec 3, 2024 13:57:07.079688072 CET	445	49925	192.168.1.196	192.168.2.4
Dec 3, 2024 13:57:07.079699993 CET	445	49924	192.168.1.195	192.168.2.4
Dec 3, 2024 13:57:07.079710007 CET	445	49923	192.168.1.194	192.168.2.4
Dec 3, 2024 13:57:07.079763889 CET	445	49922	192.168.1.193	192.168.2.4
Dec 3, 2024 13:57:07.079813004 CET	445	49921	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:07.079833031 CET	445	49918	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:07.079859972 CET	445	49920	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:07.079921961 CET	445	49919	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:07.079931021 CET	445	49914	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:07.080080032 CET	445	49910	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:07.080667019 CET	445	49910	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:07.080676079 CET	445	49914	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:07.080728054 CET	49910	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:07.080908060 CET	49914	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:07.081159115 CET	445	49918	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:07.081178904 CET	445	49919	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:07.081212044 CET	49918	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:07.081238985 CET	49919	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:07.081513882 CET	445	49921	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:07.081573963 CET	49921	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:07.081979990 CET	445	49920	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:07.082082987 CET	49920	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:07.082226038 CET	445	49922	192.168.1.193	192.168.2.4
Dec 3, 2024 13:57:07.082277060 CET	49922	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:07.082537889 CET	445	49923	192.168.1.194	192.168.2.4
Dec 3, 2024 13:57:07.082602024 CET	49923	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:07.082758904 CET	445	49925	192.168.1.196	192.168.2.4
Dec 3, 2024 13:57:07.082808018 CET	49925	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:07.083267927 CET	445	49924	192.168.1.195	192.168.2.4
Dec 3, 2024 13:57:07.083281040 CET	445	49952	192.168.1.223	192.168.2.4
Dec 3, 2024 13:57:07.083292007 CET	445	49950	192.168.1.221	192.168.2.4
Dec 3, 2024 13:57:07.083302021 CET	445	49946	192.168.1.217	192.168.2.4
Dec 3, 2024 13:57:07.083326101 CET	49924	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:07.083327055 CET	445	49951	192.168.1.222	192.168.2.4
Dec 3, 2024 13:57:07.083336115 CET	445	49949	192.168.1.220	192.168.2.4
Dec 3, 2024 13:57:07.083348036 CET	445	49948	192.168.1.219	192.168.2.4
Dec 3, 2024 13:57:07.083533049 CET	445	49947	192.168.1.218	192.168.2.4
Dec 3, 2024 13:57:07.083544016 CET	445	49942	192.168.1.213	192.168.2.4
Dec 3, 2024 13:57:07.083553076 CET	445	49945	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:07.083561897 CET	445	49944	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:07.083571911 CET	445	49943	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:07.083580971 CET	445	49938	192.168.1.209	192.168.2.4
Dec 3, 2024 13:57:07.083590984 CET	445	49936	192.168.1.207	192.168.2.4
Dec 3, 2024 13:57:07.083606005 CET	445	49941	192.168.1.212	192.168.2.4
Dec 3, 2024 13:57:07.083615065 CET	445	49940	192.168.1.211	192.168.2.4
Dec 3, 2024 13:57:07.083626032 CET	445	49939	192.168.1.210	192.168.2.4
Dec 3, 2024 13:57:07.083636999 CET	445	49937	192.168.1.208	192.168.2.4
Dec 3, 2024 13:57:07.083647013 CET	445	49935	192.168.1.206	192.168.2.4
Dec 3, 2024 13:57:07.083657026 CET	445	49934	192.168.1.205	192.168.2.4
Dec 3, 2024 13:57:07.083666086 CET	445	49933	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:07.083674908 CET	445	49932	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:07.083684921 CET	445	49931	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:07.083693981 CET	445	49930	192.168.1.201	192.168.2.4
Dec 3, 2024 13:57:07.083703041 CET	445	49929	192.168.1.200	192.168.2.4
Dec 3, 2024 13:57:07.083717108 CET	445	49926	192.168.1.197	192.168.2.4
Dec 3, 2024 13:57:07.083772898 CET	49926	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:07.083889961 CET	445	49928	192.168.1.199	192.168.2.4
Dec 3, 2024 13:57:07.084212065 CET	445	49927	192.168.1.198	192.168.2.4
Dec 3, 2024 13:57:07.084258080 CET	49928	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:07.084266901 CET	49927	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:07.084417105 CET	445	49929	192.168.1.200	192.168.2.4
Dec 3, 2024 13:57:07.084501028 CET	49929	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:07.084652901 CET	445	49930	192.168.1.201	192.168.2.4
Dec 3, 2024 13:57:07.084702969 CET	49930	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:07.084939957 CET	445	49931	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:07.084988117 CET	49931	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:07.085174084 CET	445	49932	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:07.085226059 CET	49932	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:07.085437059 CET	445	49933	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:07.085486889 CET	49933	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:07.085692883 CET	445	49934	192.168.1.205	192.168.2.4
Dec 3, 2024 13:57:07.085838079 CET	49934	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:07.085951090 CET	445	49935	192.168.1.206	192.168.2.4
Dec 3, 2024 13:57:07.085994005 CET	49935	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:07.086219072 CET	445	49937	192.168.1.208	192.168.2.4
Dec 3, 2024 13:57:07.086276054 CET	49937	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:07.086494923 CET	445	49940	192.168.1.211	192.168.2.4
Dec 3, 2024 13:57:07.086545944 CET	49940	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:07.086807966 CET	445	49939	192.168.1.210	192.168.2.4
Dec 3, 2024 13:57:07.086858034 CET	49939	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:07.087043047 CET	445	49941	192.168.1.212	192.168.2.4
Dec 3, 2024 13:57:07.087117910 CET	49941	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:07.087474108 CET	445	49943	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:07.087696075 CET	49943	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:07.087831020 CET	445	49944	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:07.087877989 CET	49944	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:07.088140011 CET	445	49945	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:07.088244915 CET	49945	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:07.088397026 CET	445	49948	192.168.1.219	192.168.2.4
Dec 3, 2024 13:57:07.088447094 CET	49948	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:07.088690042 CET	445	49947	192.168.1.218	192.168.2.4
Dec 3, 2024 13:57:07.088757992 CET	49947	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:07.088948011 CET	445	49951	192.168.1.222	192.168.2.4
Dec 3, 2024 13:57:07.089003086 CET	49951	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:07.089157104 CET	445	49949	192.168.1.220	192.168.2.4
Dec 3, 2024 13:57:07.089204073 CET	49949	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:07.089469910 CET	445	49952	192.168.1.223	192.168.2.4
Dec 3, 2024 13:57:07.089514971 CET	49952	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:07.089674950 CET	445	49936	192.168.1.207	192.168.2.4
Dec 3, 2024 13:57:07.089723110 CET	49936	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:07.089987993 CET	445	49938	192.168.1.209	192.168.2.4
Dec 3, 2024 13:57:07.090080976 CET	49938	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:07.090351105 CET	445	49942	192.168.1.213	192.168.2.4
Dec 3, 2024 13:57:07.090445995 CET	49942	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:07.090727091 CET	445	49946	192.168.1.217	192.168.2.4
Dec 3, 2024 13:57:07.090816975 CET	49946	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:07.091010094 CET	445	49950	192.168.1.221	192.168.2.4
Dec 3, 2024 13:57:07.091336012 CET	49950	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:07.093590021 CET	445	49953	192.168.1.224	192.168.2.4
Dec 3, 2024 13:57:07.093641996 CET	445	49954	192.168.1.225	192.168.2.4
Dec 3, 2024 13:57:07.093645096 CET	49953	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:07.093687057 CET	49954	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:07.093991995 CET	445	49955	192.168.1.226	192.168.2.4
Dec 3, 2024 13:57:07.094002962 CET	445	49956	192.168.1.227	192.168.2.4
Dec 3, 2024 13:57:07.094038010 CET	445	49957	192.168.1.228	192.168.2.4
Dec 3, 2024 13:57:07.094043016 CET	49955	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:07.094048977 CET	445	49958	192.168.1.229	192.168.2.4
Dec 3, 2024 13:57:07.094055891 CET	49956	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:07.094089985 CET	49957	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:07.094094038 CET	49958	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:07.094206095 CET	445	49959	192.168.1.230	192.168.2.4
Dec 3, 2024 13:57:07.094217062 CET	445	49960	192.168.1.231	192.168.2.4
Dec 3, 2024 13:57:07.094227076 CET	445	49961	192.168.1.232	192.168.2.4
Dec 3, 2024 13:57:07.094235897 CET	445	49962	192.168.1.233	192.168.2.4
Dec 3, 2024 13:57:07.094244003 CET	445	49963	192.168.1.234	192.168.2.4
Dec 3, 2024 13:57:07.094258070 CET	49959	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:07.094264030 CET	49960	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:07.094293118 CET	49961	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:07.094301939 CET	49962	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:07.094316959 CET	49963	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:07.094926119 CET	445	49964	192.168.1.235	192.168.2.4
Dec 3, 2024 13:57:07.095207930 CET	445	49975	192.168.1.247	192.168.2.4
Dec 3, 2024 13:57:07.095266104 CET	49964	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:07.095278025 CET	445	49974	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:07.095290899 CET	445	49973	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:07.095300913 CET	445	49971	192.168.1.242	192.168.2.4
Dec 3, 2024 13:57:07.095326900 CET	445	49972	192.168.1.243	192.168.2.4
Dec 3, 2024 13:57:07.095454931 CET	445	49970	192.168.1.241	192.168.2.4
Dec 3, 2024 13:57:07.095475912 CET	445	49969	192.168.1.240	192.168.2.4
Dec 3, 2024 13:57:07.095488071 CET	445	49968	192.168.1.239	192.168.2.4
Dec 3, 2024 13:57:07.095578909 CET	445	49967	192.168.1.238	192.168.2.4
Dec 3, 2024 13:57:07.095606089 CET	445	49966	192.168.1.237	192.168.2.4
Dec 3, 2024 13:57:07.095669031 CET	445	49965	192.168.1.236	192.168.2.4
Dec 3, 2024 13:57:07.095678091 CET	445	49965	192.168.1.236	192.168.2.4
Dec 3, 2024 13:57:07.095716953 CET	49965	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:07.096079111 CET	445	49966	192.168.1.237	192.168.2.4
Dec 3, 2024 13:57:07.096426964 CET	445	49967	192.168.1.238	192.168.2.4
Dec 3, 2024 13:57:07.096471071 CET	49966	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:07.096491098 CET	49967	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:07.096740961 CET	445	49969	192.168.1.240	192.168.2.4
Dec 3, 2024 13:57:07.097063065 CET	445	49968	192.168.1.239	192.168.2.4
Dec 3, 2024 13:57:07.097086906 CET	49984	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:07.097110987 CET	49969	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:07.097124100 CET	49968	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:07.097337961 CET	49985	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:07.097421885 CET	445	49970	192.168.1.241	192.168.2.4
Dec 3, 2024 13:57:07.097467899 CET	49970	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:07.097547054 CET	49986	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:07.097718954 CET	445	49972	192.168.1.243	192.168.2.4
Dec 3, 2024 13:57:07.097726107 CET	49987	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:07.097765923 CET	49972	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:07.097938061 CET	49988	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:07.098001003 CET	445	49974	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:07.098050117 CET	49974	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:07.098094940 CET	49989	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:07.098248959 CET	49990	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:07.098280907 CET	445	49973	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:07.098326921 CET	49973	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:07.098436117 CET	49991	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:07.098604918 CET	49992	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:07.098764896 CET	49993	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:07.098764896 CET	445	49971	192.168.1.242	192.168.2.4
Dec 3, 2024 13:57:07.098814011 CET	49971	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:07.098956108 CET	49994	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:07.099021912 CET	445	49975	192.168.1.247	192.168.2.4
Dec 3, 2024 13:57:07.099181890 CET	49995	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:07.099205017 CET	49975	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:07.099307060 CET	445	49983	192.168.1.254	192.168.2.4
Dec 3, 2024 13:57:07.099359035 CET	445	49982	192.168.1.253	192.168.2.4
Dec 3, 2024 13:57:07.099370003 CET	445	49981	192.168.1.252	192.168.2.4
Dec 3, 2024 13:57:07.099390030 CET	445	49980	192.168.1.251	192.168.2.4
Dec 3, 2024 13:57:07.099400043 CET	445	49979	192.168.1.250	192.168.2.4
Dec 3, 2024 13:57:07.099410057 CET	445	49978	192.168.1.249	192.168.2.4
Dec 3, 2024 13:57:07.099426985 CET	445	49977	192.168.1.248	192.168.2.4
Dec 3, 2024 13:57:07.099436998 CET	445	49976	192.168.1.246	192.168.2.4
Dec 3, 2024 13:57:07.099479914 CET	49996	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:07.099654913 CET	49997	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:07.099777937 CET	445	49976	192.168.1.246	192.168.2.4
Dec 3, 2024 13:57:07.099819899 CET	49998	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:07.099838972 CET	49976	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:07.100002050 CET	49999	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:07.100136995 CET	445	49978	192.168.1.249	192.168.2.4
Dec 3, 2024 13:57:07.100177050 CET	50000	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:07.100347042 CET	50001	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:07.100353003 CET	49978	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:07.100496054 CET	445	49977	192.168.1.248	192.168.2.4
Dec 3, 2024 13:57:07.100516081 CET	50002	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:07.100543022 CET	49977	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:07.100677967 CET	50003	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:07.100833893 CET	50004	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:07.100838900 CET	445	49981	192.168.1.252	192.168.2.4
Dec 3, 2024 13:57:07.101001024 CET	50005	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:07.101027966 CET	49981	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:07.101181030 CET	50006	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:07.101197958 CET	445	49982	192.168.1.253	192.168.2.4
Dec 3, 2024 13:57:07.101243019 CET	49982	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:07.101350069 CET	50007	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:07.101505041 CET	50008	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:07.101527929 CET	445	49980	192.168.1.251	192.168.2.4
Dec 3, 2024 13:57:07.101572990 CET	49980	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:07.101707935 CET	50009	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:07.101810932 CET	445	49979	192.168.1.250	192.168.2.4
Dec 3, 2024 13:57:07.101883888 CET	50010	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:07.101912022 CET	49979	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:07.101988077 CET	445	49983	192.168.1.254	192.168.2.4
Dec 3, 2024 13:57:07.102061987 CET	50011	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:07.102153063 CET	49983	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:07.102241993 CET	50012	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:07.102395058 CET	50013	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:07.102566004 CET	50014	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:07.102832079 CET	50015	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:07.103121996 CET	50016	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:07.103750944 CET	50018	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:07.103784084 CET	50017	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:07.103981018 CET	50019	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:07.104193926 CET	50020	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:07.104648113 CET	50021	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:07.104696035 CET	50022	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:07.104892015 CET	50023	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:07.105120897 CET	50024	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:07.105381012 CET	50025	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:07.105437994 CET	50026	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:07.105593920 CET	50027	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:07.105756044 CET	50028	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:07.106089115 CET	50030	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:07.106425047 CET	50032	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:07.106445074 CET	50029	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:07.106445074 CET	50031	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:07.106662989 CET	50033	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:07.106776953 CET	50034	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:07.106983900 CET	50035	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:07.107127905 CET	50036	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:07.107301950 CET	50037	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:07.107496977 CET	50038	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:07.107682943 CET	50039	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:07.107844114 CET	50040	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:07.108016968 CET	50041	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:07.108190060 CET	50042	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:07.108791113 CET	50043	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:07.109030008 CET	50044	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:07.109227896 CET	50045	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:07.109397888 CET	50046	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:07.109580040 CET	50047	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:07.109762907 CET	50048	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:07.109937906 CET	50049	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:07.110111952 CET	50050	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:07.110290051 CET	50051	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:07.110502005 CET	50052	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:07.110675097 CET	50053	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:07.110857010 CET	50054	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:07.111020088 CET	50055	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:07.111210108 CET	50056	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:07.111557961 CET	50057	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:07.111805916 CET	50058	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:07.111999035 CET	50059	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:07.112183094 CET	50060	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:07.112370968 CET	50061	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:07.112544060 CET	50062	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:07.112715006 CET	50063	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:07.113070965 CET	50065	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:07.113153934 CET	50064	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:07.113235950 CET	50066	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:07.117991924 CET	50067	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:07.118726969 CET	50069	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:07.119205952 CET	50068	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:07.119549990 CET	50070	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:07.119834900 CET	50071	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:07.120552063 CET	50072	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:07.121597052 CET	50073	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:07.122028112 CET	50074	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:07.122518063 CET	50075	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:07.122796059 CET	50076	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:07.122993946 CET	50077	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:07.123183012 CET	50078	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:07.123389006 CET	50079	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:07.123585939 CET	50080	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:07.123760939 CET	50081	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:07.123924971 CET	50082	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:07.124106884 CET	50083	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:07.124294043 CET	50084	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:07.124475956 CET	50085	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:07.125011921 CET	50086	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:07.125220060 CET	50087	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:07.125410080 CET	50088	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:07.125587940 CET	50089	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:07.125775099 CET	50090	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:07.125943899 CET	50091	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:07.126116037 CET	50092	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:07.126296997 CET	50093	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:07.126595974 CET	50094	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:07.128391027 CET	50095	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:07.128665924 CET	50096	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:07.129103899 CET	50097	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:07.129204988 CET	50098	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:07.203516960 CET	50099	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:07.204092026 CET	50100	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:07.204782009 CET	50102	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:07.204932928 CET	50101	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:07.204996109 CET	50103	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:07.205208063 CET	50104	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:07.205521107 CET	50105	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:07.205604076 CET	50106	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:07.205797911 CET	50107	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:07.205979109 CET	50108	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:07.206604004 CET	50109	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:07.206862926 CET	50110	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:07.207048893 CET	50111	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:07.207288027 CET	50112	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:07.207431078 CET	50113	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:07.207602024 CET	50114	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:07.207776070 CET	50115	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:07.208120108 CET	50117	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:07.208499908 CET	50118	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:07.208518028 CET	50119	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:07.209177017 CET	50121	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:07.209367037 CET	50116	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:07.209367037 CET	50120	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:07.209388018 CET	50122	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:07.210015059 CET	50123	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:07.210432053 CET	50125	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:07.210597038 CET	50126	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:07.210787058 CET	50127	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:07.210988998 CET	50128	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:07.211184025 CET	50129	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:07.211359978 CET	50130	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:07.211533070 CET	50131	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:07.211704016 CET	50132	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:07.211759090 CET	50124	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:07.211877108 CET	50133	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:07.212075949 CET	50134	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:07.212255001 CET	50135	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:07.212433100 CET	50136	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:07.212596893 CET	50137	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:07.212759972 CET	50138	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:07.212934017 CET	50139	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:07.213105917 CET	50140	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:07.213285923 CET	50141	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:07.213481903 CET	50142	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:07.213656902 CET	50143	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:07.214004040 CET	50144	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:07.214461088 CET	50146	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:07.214622974 CET	50147	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:07.214854956 CET	50148	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:07.215430975 CET	50150	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:07.215631962 CET	50151	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:07.215822935 CET	50152	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:07.216010094 CET	50145	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:07.216010094 CET	50149	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:07.216010094 CET	50153	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:07.216193914 CET	50154	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:07.216366053 CET	50155	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:07.216933966 CET	50156	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:07.217298985 CET	50158	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:07.217699051 CET	50160	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:07.217870951 CET	50161	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:07.218048096 CET	50162	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:07.218228102 CET	50163	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:07.218365908 CET	50157	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:07.218369961 CET	50159	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:07.218408108 CET	50164	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:07.218578100 CET	50165	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:07.218748093 CET	50166	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:07.218945980 CET	50167	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:07.219116926 CET	50168	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:07.219278097 CET	50169	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:07.219460011 CET	50170	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:07.219640970 CET	50171	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:07.219820023 CET	50172	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:07.219984055 CET	50173	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:07.220156908 CET	50174	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:07.220330000 CET	50175	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:07.223453045 CET	445	49984	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:07.223478079 CET	445	49985	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:07.223489046 CET	445	49986	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:07.223509073 CET	445	49987	192.168.1.4	192.168.2.4
Dec 3, 2024 13:57:07.223519087 CET	445	49988	192.168.1.5	192.168.2.4
Dec 3, 2024 13:57:07.223572016 CET	49985	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:07.223575115 CET	49984	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:07.223598957 CET	445	49989	192.168.1.6	192.168.2.4
Dec 3, 2024 13:57:07.223608971 CET	445	49990	192.168.1.7	192.168.2.4
Dec 3, 2024 13:57:07.223618984 CET	445	49991	192.168.1.8	192.168.2.4
Dec 3, 2024 13:57:07.223628998 CET	49986	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:07.223629951 CET	445	49992	192.168.1.9	192.168.2.4
Dec 3, 2024 13:57:07.223639965 CET	445	49993	192.168.1.10	192.168.2.4
Dec 3, 2024 13:57:07.223642111 CET	49987	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:07.223649025 CET	445	49994	192.168.1.11	192.168.2.4
Dec 3, 2024 13:57:07.223678112 CET	49988	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:07.223694086 CET	49989	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:07.223706007 CET	49990	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:07.223706007 CET	49991	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:07.223742962 CET	49993	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:07.223917007 CET	49992	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:07.224216938 CET	49994	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:07.228090048 CET	445	49995	192.168.1.12	192.168.2.4
Dec 3, 2024 13:57:07.228112936 CET	445	49996	192.168.1.13	192.168.2.4
Dec 3, 2024 13:57:07.228123903 CET	445	49997	192.168.1.14	192.168.2.4
Dec 3, 2024 13:57:07.228174925 CET	445	49998	192.168.1.15	192.168.2.4
Dec 3, 2024 13:57:07.228179932 CET	49995	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:07.228209972 CET	49997	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:07.228214025 CET	445	49999	192.168.1.16	192.168.2.4
Dec 3, 2024 13:57:07.228224993 CET	445	50000	192.168.1.17	192.168.2.4
Dec 3, 2024 13:57:07.228235006 CET	445	50001	192.168.1.18	192.168.2.4
Dec 3, 2024 13:57:07.228236914 CET	49998	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:07.228255987 CET	445	50002	192.168.1.19	192.168.2.4
Dec 3, 2024 13:57:07.228266001 CET	445	50003	192.168.1.20	192.168.2.4
Dec 3, 2024 13:57:07.228270054 CET	49999	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:07.228280067 CET	50000	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:07.228300095 CET	445	50004	192.168.1.21	192.168.2.4
Dec 3, 2024 13:57:07.228311062 CET	445	50005	192.168.1.22	192.168.2.4
Dec 3, 2024 13:57:07.228327990 CET	50002	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:07.228327036 CET	50001	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:07.228351116 CET	50003	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:07.228362083 CET	445	50006	192.168.1.23	192.168.2.4
Dec 3, 2024 13:57:07.228372097 CET	445	50007	192.168.1.24	192.168.2.4
Dec 3, 2024 13:57:07.228375912 CET	50004	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:07.228383064 CET	445	50008	192.168.1.25	192.168.2.4
Dec 3, 2024 13:57:07.228387117 CET	50005	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:07.228411913 CET	50006	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:07.228415966 CET	445	50009	192.168.1.26	192.168.2.4
Dec 3, 2024 13:57:07.228426933 CET	445	50010	192.168.1.27	192.168.2.4
Dec 3, 2024 13:57:07.228437901 CET	445	50011	192.168.1.28	192.168.2.4
Dec 3, 2024 13:57:07.228441000 CET	50008	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:07.228445053 CET	50007	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:07.228473902 CET	50009	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:07.228502989 CET	50010	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:07.228508949 CET	50011	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:07.229187012 CET	445	50012	192.168.1.29	192.168.2.4
Dec 3, 2024 13:57:07.229223013 CET	445	50013	192.168.1.30	192.168.2.4
Dec 3, 2024 13:57:07.229232073 CET	50012	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:07.229263067 CET	445	50014	192.168.1.31	192.168.2.4
Dec 3, 2024 13:57:07.229264975 CET	50013	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:07.229274035 CET	445	50015	192.168.1.32	192.168.2.4
Dec 3, 2024 13:57:07.229302883 CET	50014	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:07.229334116 CET	50015	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:07.229413986 CET	445	50016	192.168.1.33	192.168.2.4
Dec 3, 2024 13:57:07.229424000 CET	445	50018	192.168.1.35	192.168.2.4
Dec 3, 2024 13:57:07.229433060 CET	445	50017	192.168.1.34	192.168.2.4
Dec 3, 2024 13:57:07.229441881 CET	445	50019	192.168.1.36	192.168.2.4
Dec 3, 2024 13:57:07.229453087 CET	445	50020	192.168.1.37	192.168.2.4
Dec 3, 2024 13:57:07.229461908 CET	445	50021	192.168.1.38	192.168.2.4
Dec 3, 2024 13:57:07.229470968 CET	50016	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:07.229473114 CET	445	50022	192.168.1.39	192.168.2.4
Dec 3, 2024 13:57:07.229481936 CET	445	50023	192.168.1.40	192.168.2.4
Dec 3, 2024 13:57:07.229490042 CET	50018	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:07.229490995 CET	445	50024	192.168.1.41	192.168.2.4
Dec 3, 2024 13:57:07.229501009 CET	445	50025	192.168.1.42	192.168.2.4
Dec 3, 2024 13:57:07.229510069 CET	445	50026	192.168.1.43	192.168.2.4
Dec 3, 2024 13:57:07.229518890 CET	445	50027	192.168.1.44	192.168.2.4
Dec 3, 2024 13:57:07.229526997 CET	445	50028	192.168.1.45	192.168.2.4
Dec 3, 2024 13:57:07.229537010 CET	445	50030	192.168.1.47	192.168.2.4
Dec 3, 2024 13:57:07.229538918 CET	49996	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:07.229538918 CET	50017	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:07.229551077 CET	50020	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:07.229552031 CET	50019	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:07.229554892 CET	445	50032	192.168.1.49	192.168.2.4
Dec 3, 2024 13:57:07.229559898 CET	50022	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:07.229564905 CET	445	50029	192.168.1.46	192.168.2.4
Dec 3, 2024 13:57:07.229574919 CET	445	50031	192.168.1.48	192.168.2.4
Dec 3, 2024 13:57:07.229585886 CET	445	50033	192.168.1.50	192.168.2.4
Dec 3, 2024 13:57:07.229589939 CET	445	50034	192.168.1.51	192.168.2.4
Dec 3, 2024 13:57:07.229602098 CET	445	50035	192.168.1.52	192.168.2.4
Dec 3, 2024 13:57:07.229619980 CET	445	50036	192.168.1.53	192.168.2.4
Dec 3, 2024 13:57:07.229629993 CET	445	50037	192.168.1.54	192.168.2.4
Dec 3, 2024 13:57:07.229638100 CET	50024	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:07.229640007 CET	50023	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:07.229641914 CET	50021	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:07.229641914 CET	50025	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:07.229646921 CET	50026	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:07.229649067 CET	50027	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:07.229655027 CET	50028	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:07.229671955 CET	50030	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:07.229696989 CET	445	50038	192.168.1.55	192.168.2.4
Dec 3, 2024 13:57:07.229707003 CET	445	50039	192.168.1.56	192.168.2.4
Dec 3, 2024 13:57:07.229716063 CET	445	50040	192.168.1.57	192.168.2.4
Dec 3, 2024 13:57:07.229726076 CET	445	50041	192.168.1.58	192.168.2.4
Dec 3, 2024 13:57:07.229737043 CET	445	50042	192.168.1.59	192.168.2.4
Dec 3, 2024 13:57:07.229742050 CET	445	50043	192.168.1.60	192.168.2.4
Dec 3, 2024 13:57:07.229759932 CET	50032	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:07.229785919 CET	50033	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:07.229787111 CET	50034	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:07.229789019 CET	445	50044	192.168.1.61	192.168.2.4
Dec 3, 2024 13:57:07.229795933 CET	50035	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:07.229799986 CET	50037	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:07.229800940 CET	445	50045	192.168.1.62	192.168.2.4
Dec 3, 2024 13:57:07.229803085 CET	50036	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:07.229888916 CET	50038	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:07.229901075 CET	50041	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:07.229902029 CET	50039	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:07.229902029 CET	50040	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:07.229914904 CET	50042	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:07.229916096 CET	50043	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:07.229917049 CET	50044	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:07.230117083 CET	50045	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:07.230119944 CET	50031	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:07.230119944 CET	50029	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:07.230154037 CET	445	50046	192.168.1.63	192.168.2.4
Dec 3, 2024 13:57:07.230185986 CET	445	50047	192.168.1.64	192.168.2.4
Dec 3, 2024 13:57:07.230195045 CET	445	50048	192.168.1.65	192.168.2.4
Dec 3, 2024 13:57:07.230206013 CET	50046	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:07.230243921 CET	50048	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:07.230251074 CET	50047	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:07.230341911 CET	445	50049	192.168.1.66	192.168.2.4
Dec 3, 2024 13:57:07.230353117 CET	445	50050	192.168.1.67	192.168.2.4
Dec 3, 2024 13:57:07.230361938 CET	445	50051	192.168.1.68	192.168.2.4
Dec 3, 2024 13:57:07.230390072 CET	50049	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:07.230431080 CET	50050	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:07.230962038 CET	445	50052	192.168.1.69	192.168.2.4
Dec 3, 2024 13:57:07.230972052 CET	445	50053	192.168.1.70	192.168.2.4
Dec 3, 2024 13:57:07.230981112 CET	445	50054	192.168.1.71	192.168.2.4
Dec 3, 2024 13:57:07.230992079 CET	445	50055	192.168.1.72	192.168.2.4
Dec 3, 2024 13:57:07.230992079 CET	50051	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:07.231017113 CET	50052	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:07.231041908 CET	445	50056	192.168.1.73	192.168.2.4
Dec 3, 2024 13:57:07.231055021 CET	50053	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:07.231055975 CET	50054	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:07.231062889 CET	50055	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:07.231086016 CET	50056	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:07.231441975 CET	445	50057	192.168.1.74	192.168.2.4
Dec 3, 2024 13:57:07.231620073 CET	445	50058	192.168.1.75	192.168.2.4
Dec 3, 2024 13:57:07.231673956 CET	50058	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:07.231677055 CET	50057	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:07.232316017 CET	445	50059	192.168.1.76	192.168.2.4
Dec 3, 2024 13:57:07.232326984 CET	445	50060	192.168.1.77	192.168.2.4
Dec 3, 2024 13:57:07.232343912 CET	445	50061	192.168.1.78	192.168.2.4
Dec 3, 2024 13:57:07.232363939 CET	445	50062	192.168.1.79	192.168.2.4
Dec 3, 2024 13:57:07.232369900 CET	50059	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:07.232384920 CET	50060	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:07.232397079 CET	50061	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:07.232420921 CET	50062	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:07.233875990 CET	445	50063	192.168.1.80	192.168.2.4
Dec 3, 2024 13:57:07.233896017 CET	445	50065	192.168.1.82	192.168.2.4
Dec 3, 2024 13:57:07.233906031 CET	445	50064	192.168.1.81	192.168.2.4
Dec 3, 2024 13:57:07.233916044 CET	445	50066	192.168.1.83	192.168.2.4
Dec 3, 2024 13:57:07.233947992 CET	50063	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:07.233984947 CET	50065	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:07.234532118 CET	50064	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:07.236376047 CET	50066	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:07.236855030 CET	49985	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:07.236958981 CET	49986	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:07.237056971 CET	49987	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:07.237227917 CET	49989	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:07.237308979 CET	49990	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:07.237394094 CET	49991	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:07.237477064 CET	49984	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:07.237477064 CET	49988	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:07.237477064 CET	49992	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:07.237560034 CET	49993	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:07.237641096 CET	49994	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:07.237721920 CET	49995	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:07.238162041 CET	445	50067	192.168.1.84	192.168.2.4
Dec 3, 2024 13:57:07.238229036 CET	50067	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:07.243151903 CET	49997	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:07.243204117 CET	49996	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:07.243257046 CET	49998	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:07.243331909 CET	49999	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:07.243437052 CET	50000	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:07.243515015 CET	50001	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:07.243599892 CET	50002	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:07.243719101 CET	50003	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:07.250933886 CET	50004	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:07.251100063 CET	50005	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:07.251132011 CET	50006	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:07.251198053 CET	50008	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:07.251322031 CET	50009	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:07.251394033 CET	50011	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:07.252598047 CET	50012	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:07.252744913 CET	50013	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:07.252835035 CET	50014	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:07.252913952 CET	50015	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:07.253006935 CET	50016	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:07.253087997 CET	50018	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:07.253196001 CET	50017	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:07.253242016 CET	50019	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:07.253351927 CET	50020	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:07.253453970 CET	50021	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:07.253508091 CET	50022	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:07.255764008 CET	50010	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:07.255830050 CET	50023	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:07.255891085 CET	50024	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:07.255995989 CET	50025	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:07.256048918 CET	50026	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:07.259985924 CET	50027	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:07.260083914 CET	50028	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:07.260150909 CET	50030	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:07.260267019 CET	50032	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:07.260305882 CET	50029	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:07.260385990 CET	50031	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:07.260390997 CET	50033	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:07.264116049 CET	50034	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:07.264218092 CET	50035	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:07.264282942 CET	50036	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:07.264341116 CET	50007	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:07.264417887 CET	50037	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:07.264476061 CET	50038	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:07.264538050 CET	50039	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:07.264590025 CET	50040	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:07.264652967 CET	50041	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:07.268439054 CET	50042	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:07.268516064 CET	50043	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:07.268589973 CET	50044	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:07.268641949 CET	50045	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:07.268701077 CET	50046	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:07.268755913 CET	50047	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:07.268821955 CET	50048	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:07.268884897 CET	50049	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:07.268942118 CET	50050	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:07.272336006 CET	50051	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:07.272419930 CET	50052	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:07.272478104 CET	50053	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:07.272540092 CET	50054	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:07.272595882 CET	50055	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:07.272655964 CET	50056	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:07.272707939 CET	50057	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:07.272774935 CET	50058	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:07.272860050 CET	50059	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:07.272918940 CET	50060	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:07.276681900 CET	50061	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:07.276792049 CET	50062	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:07.276851892 CET	50063	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:07.276920080 CET	50065	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:07.276989937 CET	50064	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:07.277036905 CET	50066	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:07.277086020 CET	50067	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:07.281488895 CET	50176	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:07.285739899 CET	50177	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:07.285923958 CET	50178	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:07.290086985 CET	50179	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:07.290361881 CET	50180	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:07.292232990 CET	445	50069	192.168.1.86	192.168.2.4
Dec 3, 2024 13:57:07.292248964 CET	445	50068	192.168.1.85	192.168.2.4
Dec 3, 2024 13:57:07.292258978 CET	445	50070	192.168.1.87	192.168.2.4
Dec 3, 2024 13:57:07.292342901 CET	50069	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:07.292366982 CET	445	50071	192.168.1.88	192.168.2.4
Dec 3, 2024 13:57:07.292377949 CET	445	50072	192.168.1.89	192.168.2.4
Dec 3, 2024 13:57:07.292387962 CET	445	50073	192.168.1.90	192.168.2.4
Dec 3, 2024 13:57:07.292387009 CET	50070	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:07.292397976 CET	445	50074	192.168.1.91	192.168.2.4
Dec 3, 2024 13:57:07.292407990 CET	445	50075	192.168.1.92	192.168.2.4
Dec 3, 2024 13:57:07.292412996 CET	50068	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:07.292416096 CET	50071	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:07.292418957 CET	445	50076	192.168.1.93	192.168.2.4
Dec 3, 2024 13:57:07.292429924 CET	445	50077	192.168.1.94	192.168.2.4
Dec 3, 2024 13:57:07.292439938 CET	445	50078	192.168.1.95	192.168.2.4
Dec 3, 2024 13:57:07.292448997 CET	445	50079	192.168.1.96	192.168.2.4
Dec 3, 2024 13:57:07.292459011 CET	445	50080	192.168.1.97	192.168.2.4
Dec 3, 2024 13:57:07.292474031 CET	50072	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:07.292483091 CET	50074	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:07.292483091 CET	50073	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:07.292517900 CET	445	50081	192.168.1.98	192.168.2.4
Dec 3, 2024 13:57:07.292531013 CET	445	50082	192.168.1.99	192.168.2.4
Dec 3, 2024 13:57:07.292540073 CET	445	50083	192.168.1.100	192.168.2.4
Dec 3, 2024 13:57:07.292548895 CET	445	50084	192.168.1.101	192.168.2.4
Dec 3, 2024 13:57:07.292557955 CET	445	50085	192.168.1.102	192.168.2.4
Dec 3, 2024 13:57:07.292567015 CET	445	50086	192.168.1.103	192.168.2.4
Dec 3, 2024 13:57:07.292577028 CET	445	50087	192.168.1.104	192.168.2.4
Dec 3, 2024 13:57:07.292577028 CET	50075	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:07.292579889 CET	50077	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:07.292582035 CET	50076	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:07.292587042 CET	445	50088	192.168.1.105	192.168.2.4
Dec 3, 2024 13:57:07.292587042 CET	50078	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:07.292598963 CET	50079	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:07.292613983 CET	50080	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:07.292687893 CET	50081	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:07.292695045 CET	445	50089	192.168.1.106	192.168.2.4
Dec 3, 2024 13:57:07.292697906 CET	50083	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:07.292700052 CET	50082	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:07.292706966 CET	445	50090	192.168.1.107	192.168.2.4
Dec 3, 2024 13:57:07.292712927 CET	50085	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:07.292714119 CET	50084	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:07.292717934 CET	445	50091	192.168.1.108	192.168.2.4
Dec 3, 2024 13:57:07.292722940 CET	50086	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:07.292722940 CET	50087	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:07.292727947 CET	50088	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:07.292728901 CET	445	50092	192.168.1.109	192.168.2.4
Dec 3, 2024 13:57:07.292738914 CET	445	50093	192.168.1.110	192.168.2.4
Dec 3, 2024 13:57:07.292748928 CET	445	50094	192.168.1.111	192.168.2.4
Dec 3, 2024 13:57:07.292757034 CET	445	50095	192.168.1.112	192.168.2.4
Dec 3, 2024 13:57:07.292766094 CET	445	50096	192.168.1.113	192.168.2.4
Dec 3, 2024 13:57:07.292778015 CET	50089	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:07.292778969 CET	445	50097	192.168.1.114	192.168.2.4
Dec 3, 2024 13:57:07.292782068 CET	50090	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:07.292785883 CET	50091	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:07.292790890 CET	445	50098	192.168.1.115	192.168.2.4
Dec 3, 2024 13:57:07.292843103 CET	50093	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:07.292843103 CET	50092	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:07.292851925 CET	50095	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:07.292854071 CET	50094	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:07.292896986 CET	50096	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:07.292898893 CET	50098	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:07.292898893 CET	50097	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:07.294645071 CET	50068	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:07.294773102 CET	50070	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:07.294864893 CET	50071	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:07.294945955 CET	50072	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:07.295027018 CET	50073	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:07.298947096 CET	50074	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:07.299069881 CET	50075	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:07.299201012 CET	50076	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:07.299274921 CET	50077	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:07.299354076 CET	50078	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:07.303488016 CET	50079	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:07.303620100 CET	50080	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:07.307423115 CET	50081	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:07.307775021 CET	50082	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:07.307929993 CET	50083	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:07.308068991 CET	50084	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:07.312213898 CET	50085	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:07.312397957 CET	50086	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:07.312535048 CET	50087	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:07.316617012 CET	50088	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:07.316757917 CET	50089	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:07.320724964 CET	50090	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:07.320859909 CET	50091	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:07.321054935 CET	50092	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:07.325021982 CET	445	50099	192.168.1.116	192.168.2.4
Dec 3, 2024 13:57:07.325118065 CET	50099	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:07.325258017 CET	50093	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:07.325352907 CET	445	50100	192.168.1.117	192.168.2.4
Dec 3, 2024 13:57:07.325401068 CET	50100	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:07.325999975 CET	445	50102	192.168.1.119	192.168.2.4
Dec 3, 2024 13:57:07.326169014 CET	445	50101	192.168.1.118	192.168.2.4
Dec 3, 2024 13:57:07.326178074 CET	445	50103	192.168.1.120	192.168.2.4
Dec 3, 2024 13:57:07.326241016 CET	50102	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:07.326309919 CET	445	50104	192.168.1.121	192.168.2.4
Dec 3, 2024 13:57:07.326343060 CET	50103	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:07.326354027 CET	50101	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:07.326363087 CET	50104	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:07.326664925 CET	445	50105	192.168.1.122	192.168.2.4
Dec 3, 2024 13:57:07.326831102 CET	445	50106	192.168.1.123	192.168.2.4
Dec 3, 2024 13:57:07.326906919 CET	50105	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:07.326996088 CET	445	50107	192.168.1.124	192.168.2.4
Dec 3, 2024 13:57:07.327025890 CET	50106	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:07.327048063 CET	50107	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:07.327176094 CET	445	50108	192.168.1.125	192.168.2.4
Dec 3, 2024 13:57:07.327223063 CET	50108	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:07.327862978 CET	445	50109	192.168.1.126	192.168.2.4
Dec 3, 2024 13:57:07.327970028 CET	50109	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:07.328192949 CET	445	50110	192.168.1.127	192.168.2.4
Dec 3, 2024 13:57:07.328361034 CET	445	50111	192.168.1.128	192.168.2.4
Dec 3, 2024 13:57:07.328409910 CET	50110	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:07.328411102 CET	50111	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:07.328514099 CET	445	50112	192.168.1.129	192.168.2.4
Dec 3, 2024 13:57:07.328562975 CET	50112	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:07.328679085 CET	445	50113	192.168.1.130	192.168.2.4
Dec 3, 2024 13:57:07.328727007 CET	50113	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:07.328835964 CET	445	50114	192.168.1.131	192.168.2.4
Dec 3, 2024 13:57:07.328882933 CET	50114	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:07.329063892 CET	445	50115	192.168.1.132	192.168.2.4
Dec 3, 2024 13:57:07.329112053 CET	50115	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:07.329405069 CET	445	50117	192.168.1.134	192.168.2.4
Dec 3, 2024 13:57:07.329488039 CET	50117	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:07.329602957 CET	50094	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:07.329901934 CET	445	50118	192.168.1.135	192.168.2.4
Dec 3, 2024 13:57:07.329915047 CET	445	50119	192.168.1.136	192.168.2.4
Dec 3, 2024 13:57:07.329967976 CET	50118	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:07.329983950 CET	50119	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:07.330064058 CET	50095	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:07.330600023 CET	445	50121	192.168.1.138	192.168.2.4
Dec 3, 2024 13:57:07.330749035 CET	445	50116	192.168.1.133	192.168.2.4
Dec 3, 2024 13:57:07.330759048 CET	445	50120	192.168.1.137	192.168.2.4
Dec 3, 2024 13:57:07.330769062 CET	445	50122	192.168.1.139	192.168.2.4
Dec 3, 2024 13:57:07.330809116 CET	50121	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:07.330847979 CET	50120	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:07.330847979 CET	50116	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:07.331340075 CET	445	50123	192.168.1.140	192.168.2.4
Dec 3, 2024 13:57:07.331365108 CET	50122	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:07.331387997 CET	50123	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:07.331649065 CET	445	50125	192.168.1.142	192.168.2.4
Dec 3, 2024 13:57:07.331696033 CET	50125	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:07.331955910 CET	445	50126	192.168.1.143	192.168.2.4
Dec 3, 2024 13:57:07.332056999 CET	445	50127	192.168.1.144	192.168.2.4
Dec 3, 2024 13:57:07.332108021 CET	50126	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:07.332182884 CET	445	50128	192.168.1.145	192.168.2.4
Dec 3, 2024 13:57:07.332211971 CET	50127	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:07.332235098 CET	50128	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:07.332367897 CET	445	50129	192.168.1.146	192.168.2.4
Dec 3, 2024 13:57:07.332524061 CET	445	50130	192.168.1.147	192.168.2.4
Dec 3, 2024 13:57:07.332582951 CET	50129	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:07.332690001 CET	445	50131	192.168.1.148	192.168.2.4
Dec 3, 2024 13:57:07.332715034 CET	50130	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:07.332739115 CET	50131	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:07.332930088 CET	445	50132	192.168.1.149	192.168.2.4
Dec 3, 2024 13:57:07.332941055 CET	445	50124	192.168.1.141	192.168.2.4
Dec 3, 2024 13:57:07.332987070 CET	50132	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:07.333144903 CET	445	50133	192.168.1.150	192.168.2.4
Dec 3, 2024 13:57:07.333156109 CET	445	50134	192.168.1.151	192.168.2.4
Dec 3, 2024 13:57:07.333164930 CET	445	50135	192.168.1.152	192.168.2.4
Dec 3, 2024 13:57:07.333177090 CET	445	50136	192.168.1.153	192.168.2.4
Dec 3, 2024 13:57:07.333187103 CET	445	50137	192.168.1.154	192.168.2.4
Dec 3, 2024 13:57:07.333200932 CET	445	50138	192.168.1.155	192.168.2.4
Dec 3, 2024 13:57:07.333203077 CET	50133	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:07.333204985 CET	50134	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:07.333209038 CET	50124	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:07.333210945 CET	445	50139	192.168.1.156	192.168.2.4
Dec 3, 2024 13:57:07.333230972 CET	50135	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:07.333230972 CET	445	50140	192.168.1.157	192.168.2.4
Dec 3, 2024 13:57:07.333237886 CET	50136	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:07.333271027 CET	50137	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:07.333281040 CET	50138	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:07.333281040 CET	50139	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:07.333306074 CET	50140	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:07.333337069 CET	445	50141	192.168.1.158	192.168.2.4
Dec 3, 2024 13:57:07.333556890 CET	445	50142	192.168.1.159	192.168.2.4
Dec 3, 2024 13:57:07.333607912 CET	50141	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:07.333816051 CET	445	50143	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:07.333847046 CET	50142	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:07.333869934 CET	50143	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:07.334167957 CET	445	50144	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:07.334217072 CET	50144	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:07.334420919 CET	50096	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:07.334631920 CET	50097	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:07.334729910 CET	445	50146	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:07.334731102 CET	50098	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:07.334789991 CET	445	50147	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:07.334803104 CET	50069	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:07.334882975 CET	50146	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:07.334928989 CET	50147	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:07.335005045 CET	50099	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:07.335026026 CET	445	50148	192.168.1.165	192.168.2.4
Dec 3, 2024 13:57:07.335073948 CET	50148	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:07.335158110 CET	50100	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:07.335586071 CET	445	50150	192.168.1.167	192.168.2.4
Dec 3, 2024 13:57:07.335736036 CET	445	50151	192.168.1.168	192.168.2.4
Dec 3, 2024 13:57:07.335793018 CET	50150	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:07.336031914 CET	445	50152	192.168.1.169	192.168.2.4
Dec 3, 2024 13:57:07.336061954 CET	50151	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:07.336077929 CET	50152	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:07.336324930 CET	445	50145	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:07.336381912 CET	445	50149	192.168.1.166	192.168.2.4
Dec 3, 2024 13:57:07.336393118 CET	445	50153	192.168.1.170	192.168.2.4
Dec 3, 2024 13:57:07.336431026 CET	445	50154	192.168.1.171	192.168.2.4
Dec 3, 2024 13:57:07.336436987 CET	50145	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:07.336478949 CET	50153	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:07.336478949 CET	50149	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:07.336496115 CET	50154	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:07.336663961 CET	445	50155	192.168.1.172	192.168.2.4
Dec 3, 2024 13:57:07.337295055 CET	445	50156	192.168.1.173	192.168.2.4
Dec 3, 2024 13:57:07.337347984 CET	50155	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:07.337709904 CET	445	50158	192.168.1.175	192.168.2.4
Dec 3, 2024 13:57:07.337739944 CET	50156	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:07.337758064 CET	50158	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:07.338252068 CET	445	50160	192.168.1.177	192.168.2.4
Dec 3, 2024 13:57:07.338385105 CET	445	50161	192.168.1.178	192.168.2.4
Dec 3, 2024 13:57:07.338387966 CET	50160	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:07.338430882 CET	50161	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:07.338577986 CET	445	50162	192.168.1.179	192.168.2.4
Dec 3, 2024 13:57:07.338623047 CET	50162	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:07.338795900 CET	445	50163	192.168.1.180	192.168.2.4
Dec 3, 2024 13:57:07.338841915 CET	50163	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:07.339006901 CET	445	50157	192.168.1.174	192.168.2.4
Dec 3, 2024 13:57:07.339016914 CET	445	50159	192.168.1.176	192.168.2.4
Dec 3, 2024 13:57:07.339025974 CET	445	50164	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:07.339085102 CET	50164	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:07.339090109 CET	50157	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:07.339090109 CET	50159	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:07.339253902 CET	445	50165	192.168.1.182	192.168.2.4
Dec 3, 2024 13:57:07.339365959 CET	445	50166	192.168.1.183	192.168.2.4
Dec 3, 2024 13:57:07.339427948 CET	50165	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:07.339596033 CET	445	50167	192.168.1.184	192.168.2.4
Dec 3, 2024 13:57:07.339627028 CET	50166	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:07.339646101 CET	50167	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:07.339766026 CET	50102	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:07.339839935 CET	445	50168	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:07.339955091 CET	50101	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:07.339956045 CET	50168	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:07.340122938 CET	445	50169	192.168.1.186	192.168.2.4
Dec 3, 2024 13:57:07.340179920 CET	50169	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:07.340332031 CET	445	50170	192.168.1.187	192.168.2.4
Dec 3, 2024 13:57:07.340382099 CET	50170	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:07.340555906 CET	445	50171	192.168.1.188	192.168.2.4
Dec 3, 2024 13:57:07.340862036 CET	445	50172	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:07.340913057 CET	50171	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:07.341089964 CET	445	50173	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:07.341115952 CET	50172	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:07.341136932 CET	50173	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:07.341221094 CET	445	50174	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:07.341402054 CET	50174	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:07.341528893 CET	445	50175	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:07.343960047 CET	50175	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:07.344011068 CET	50103	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:07.344132900 CET	50104	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:07.344315052 CET	50105	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:07.348174095 CET	50106	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:07.348493099 CET	50107	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:07.352456093 CET	50108	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:07.352684021 CET	50109	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:07.352817059 CET	50110	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:07.352894068 CET	50111	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:07.357197046 CET	50112	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:07.357279062 CET	50113	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:07.357369900 CET	50114	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:07.359180927 CET	445	49995	192.168.1.12	192.168.2.4
Dec 3, 2024 13:57:07.359191895 CET	445	49994	192.168.1.11	192.168.2.4
Dec 3, 2024 13:57:07.359203100 CET	445	49993	192.168.1.10	192.168.2.4
Dec 3, 2024 13:57:07.359214067 CET	445	49992	192.168.1.9	192.168.2.4
Dec 3, 2024 13:57:07.359270096 CET	445	49988	192.168.1.5	192.168.2.4
Dec 3, 2024 13:57:07.359280109 CET	445	49984	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:07.359289885 CET	445	49991	192.168.1.8	192.168.2.4
Dec 3, 2024 13:57:07.359298944 CET	445	49990	192.168.1.7	192.168.2.4
Dec 3, 2024 13:57:07.359308004 CET	445	49989	192.168.1.6	192.168.2.4
Dec 3, 2024 13:57:07.359317064 CET	445	49987	192.168.1.4	192.168.2.4
Dec 3, 2024 13:57:07.359323025 CET	445	49986	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:07.359352112 CET	445	49985	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:07.361025095 CET	445	49985	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:07.361083984 CET	445	49986	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:07.361093998 CET	445	49987	192.168.1.4	192.168.2.4
Dec 3, 2024 13:57:07.361102104 CET	445	49989	192.168.1.6	192.168.2.4
Dec 3, 2024 13:57:07.361114979 CET	445	49990	192.168.1.7	192.168.2.4
Dec 3, 2024 13:57:07.361135960 CET	49985	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:07.361150026 CET	49986	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:07.361159086 CET	445	49991	192.168.1.8	192.168.2.4
Dec 3, 2024 13:57:07.361162901 CET	49987	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:57:07.361171007 CET	445	49984	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:07.361186028 CET	49989	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:57:07.361190081 CET	49990	445	192.168.2.4	192.168.1.7
Dec 3, 2024 13:57:07.361206055 CET	49991	445	192.168.2.4	192.168.1.8
Dec 3, 2024 13:57:07.361219883 CET	49984	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:07.361229897 CET	445	49988	192.168.1.5	192.168.2.4
Dec 3, 2024 13:57:07.361239910 CET	445	49992	192.168.1.9	192.168.2.4
Dec 3, 2024 13:57:07.361251116 CET	445	49993	192.168.1.10	192.168.2.4
Dec 3, 2024 13:57:07.361273050 CET	445	49994	192.168.1.11	192.168.2.4
Dec 3, 2024 13:57:07.361280918 CET	445	49995	192.168.1.12	192.168.2.4
Dec 3, 2024 13:57:07.361284018 CET	49988	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:57:07.361284018 CET	49992	445	192.168.2.4	192.168.1.9
Dec 3, 2024 13:57:07.361320019 CET	49993	445	192.168.2.4	192.168.1.10
Dec 3, 2024 13:57:07.361335993 CET	49994	445	192.168.2.4	192.168.1.11
Dec 3, 2024 13:57:07.361337900 CET	49995	445	192.168.2.4	192.168.1.12
Dec 3, 2024 13:57:07.361735106 CET	50115	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:07.361857891 CET	50117	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:07.361983061 CET	50118	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:07.362051010 CET	50119	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:07.362134933 CET	50121	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:07.366265059 CET	50116	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:07.366405964 CET	50120	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:07.370670080 CET	50122	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:07.370767117 CET	50123	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:07.374825954 CET	50125	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:07.374978065 CET	50126	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:07.375173092 CET	50127	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:07.378989935 CET	50128	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:07.379168987 CET	50129	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:07.379302025 CET	50130	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:07.379416943 CET	50131	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:07.412307024 CET	445	49997	192.168.1.14	192.168.2.4
Dec 3, 2024 13:57:07.412332058 CET	445	49996	192.168.1.13	192.168.2.4
Dec 3, 2024 13:57:07.412342072 CET	445	49998	192.168.1.15	192.168.2.4
Dec 3, 2024 13:57:07.412354946 CET	445	49999	192.168.1.16	192.168.2.4
Dec 3, 2024 13:57:07.412395000 CET	50132	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:07.412398100 CET	445	50000	192.168.1.17	192.168.2.4
Dec 3, 2024 13:57:07.412410021 CET	445	50001	192.168.1.18	192.168.2.4
Dec 3, 2024 13:57:07.412424088 CET	49997	445	192.168.2.4	192.168.1.14
Dec 3, 2024 13:57:07.412425041 CET	49996	445	192.168.2.4	192.168.1.13
Dec 3, 2024 13:57:07.412430048 CET	445	50002	192.168.1.19	192.168.2.4
Dec 3, 2024 13:57:07.412441015 CET	445	50003	192.168.1.20	192.168.2.4
Dec 3, 2024 13:57:07.412446022 CET	49998	445	192.168.2.4	192.168.1.15
Dec 3, 2024 13:57:07.412455082 CET	445	50004	192.168.1.21	192.168.2.4
Dec 3, 2024 13:57:07.412472963 CET	445	50005	192.168.1.22	192.168.2.4
Dec 3, 2024 13:57:07.412476063 CET	49999	445	192.168.2.4	192.168.1.16
Dec 3, 2024 13:57:07.412488937 CET	50000	445	192.168.2.4	192.168.1.17
Dec 3, 2024 13:57:07.412504911 CET	50001	445	192.168.2.4	192.168.1.18
Dec 3, 2024 13:57:07.412513971 CET	50002	445	192.168.2.4	192.168.1.19
Dec 3, 2024 13:57:07.412547112 CET	50003	445	192.168.2.4	192.168.1.20
Dec 3, 2024 13:57:07.412558079 CET	50004	445	192.168.2.4	192.168.1.21
Dec 3, 2024 13:57:07.412565947 CET	445	50006	192.168.1.23	192.168.2.4
Dec 3, 2024 13:57:07.412578106 CET	445	50008	192.168.1.25	192.168.2.4
Dec 3, 2024 13:57:07.412578106 CET	50005	445	192.168.2.4	192.168.1.22
Dec 3, 2024 13:57:07.412587881 CET	445	50009	192.168.1.26	192.168.2.4
Dec 3, 2024 13:57:07.412630081 CET	50006	445	192.168.2.4	192.168.1.23
Dec 3, 2024 13:57:07.412658930 CET	50008	445	192.168.2.4	192.168.1.25
Dec 3, 2024 13:57:07.412671089 CET	50009	445	192.168.2.4	192.168.1.26
Dec 3, 2024 13:57:07.412689924 CET	445	50011	192.168.1.28	192.168.2.4
Dec 3, 2024 13:57:07.412700891 CET	445	50012	192.168.1.29	192.168.2.4
Dec 3, 2024 13:57:07.412709951 CET	445	50013	192.168.1.30	192.168.2.4
Dec 3, 2024 13:57:07.412718058 CET	445	50014	192.168.1.31	192.168.2.4
Dec 3, 2024 13:57:07.412723064 CET	445	50015	192.168.1.32	192.168.2.4
Dec 3, 2024 13:57:07.412733078 CET	445	50016	192.168.1.33	192.168.2.4
Dec 3, 2024 13:57:07.412741899 CET	445	50018	192.168.1.35	192.168.2.4
Dec 3, 2024 13:57:07.412743092 CET	50011	445	192.168.2.4	192.168.1.28
Dec 3, 2024 13:57:07.412753105 CET	50012	445	192.168.2.4	192.168.1.29
Dec 3, 2024 13:57:07.412795067 CET	50013	445	192.168.2.4	192.168.1.30
Dec 3, 2024 13:57:07.412801027 CET	445	50017	192.168.1.34	192.168.2.4
Dec 3, 2024 13:57:07.412803888 CET	50014	445	192.168.2.4	192.168.1.31
Dec 3, 2024 13:57:07.412811995 CET	445	50019	192.168.1.36	192.168.2.4
Dec 3, 2024 13:57:07.412826061 CET	50015	445	192.168.2.4	192.168.1.32
Dec 3, 2024 13:57:07.412834883 CET	50016	445	192.168.2.4	192.168.1.33
Dec 3, 2024 13:57:07.412842035 CET	50018	445	192.168.2.4	192.168.1.35
Dec 3, 2024 13:57:07.412882090 CET	50019	445	192.168.2.4	192.168.1.36
Dec 3, 2024 13:57:07.412898064 CET	50017	445	192.168.2.4	192.168.1.34
Dec 3, 2024 13:57:07.413882971 CET	445	50020	192.168.1.37	192.168.2.4
Dec 3, 2024 13:57:07.413892984 CET	445	50021	192.168.1.38	192.168.2.4
Dec 3, 2024 13:57:07.413934946 CET	50020	445	192.168.2.4	192.168.1.37
Dec 3, 2024 13:57:07.413947105 CET	445	50022	192.168.1.39	192.168.2.4
Dec 3, 2024 13:57:07.413957119 CET	445	50010	192.168.1.27	192.168.2.4
Dec 3, 2024 13:57:07.413965940 CET	445	50023	192.168.1.40	192.168.2.4
Dec 3, 2024 13:57:07.413981915 CET	50021	445	192.168.2.4	192.168.1.38
Dec 3, 2024 13:57:07.413983107 CET	445	50024	192.168.1.41	192.168.2.4
Dec 3, 2024 13:57:07.413994074 CET	50022	445	192.168.2.4	192.168.1.39
Dec 3, 2024 13:57:07.413994074 CET	445	50025	192.168.1.42	192.168.2.4
Dec 3, 2024 13:57:07.414002895 CET	50010	445	192.168.2.4	192.168.1.27
Dec 3, 2024 13:57:07.414005041 CET	445	50026	192.168.1.43	192.168.2.4
Dec 3, 2024 13:57:07.414030075 CET	445	50027	192.168.1.44	192.168.2.4
Dec 3, 2024 13:57:07.414038897 CET	445	50028	192.168.1.45	192.168.2.4
Dec 3, 2024 13:57:07.414045095 CET	50023	445	192.168.2.4	192.168.1.40
Dec 3, 2024 13:57:07.414051056 CET	50024	445	192.168.2.4	192.168.1.41
Dec 3, 2024 13:57:07.414067984 CET	50025	445	192.168.2.4	192.168.1.42
Dec 3, 2024 13:57:07.414072990 CET	50026	445	192.168.2.4	192.168.1.43
Dec 3, 2024 13:57:07.414088964 CET	445	50030	192.168.1.47	192.168.2.4
Dec 3, 2024 13:57:07.414096117 CET	50027	445	192.168.2.4	192.168.1.44
Dec 3, 2024 13:57:07.414099932 CET	445	50032	192.168.1.49	192.168.2.4
Dec 3, 2024 13:57:07.414113045 CET	50028	445	192.168.2.4	192.168.1.45
Dec 3, 2024 13:57:07.414140940 CET	445	50029	192.168.1.46	192.168.2.4
Dec 3, 2024 13:57:07.414140940 CET	50030	445	192.168.2.4	192.168.1.47
Dec 3, 2024 13:57:07.414150953 CET	445	50031	192.168.1.48	192.168.2.4
Dec 3, 2024 13:57:07.414160013 CET	445	50033	192.168.1.50	192.168.2.4
Dec 3, 2024 13:57:07.414163113 CET	50032	445	192.168.2.4	192.168.1.49
Dec 3, 2024 13:57:07.414189100 CET	445	50034	192.168.1.51	192.168.2.4
Dec 3, 2024 13:57:07.414202929 CET	50029	445	192.168.2.4	192.168.1.46
Dec 3, 2024 13:57:07.414202929 CET	50031	445	192.168.2.4	192.168.1.48
Dec 3, 2024 13:57:07.414222002 CET	50033	445	192.168.2.4	192.168.1.50
Dec 3, 2024 13:57:07.414236069 CET	445	50035	192.168.1.52	192.168.2.4
Dec 3, 2024 13:57:07.414242983 CET	50034	445	192.168.2.4	192.168.1.51
Dec 3, 2024 13:57:07.414246082 CET	445	50036	192.168.1.53	192.168.2.4
Dec 3, 2024 13:57:07.414254904 CET	445	50007	192.168.1.24	192.168.2.4
Dec 3, 2024 13:57:07.414283991 CET	50035	445	192.168.2.4	192.168.1.52
Dec 3, 2024 13:57:07.414290905 CET	50036	445	192.168.2.4	192.168.1.53
Dec 3, 2024 13:57:07.414325953 CET	50007	445	192.168.2.4	192.168.1.24
Dec 3, 2024 13:57:07.414377928 CET	445	50037	192.168.1.54	192.168.2.4
Dec 3, 2024 13:57:07.414387941 CET	445	50038	192.168.1.55	192.168.2.4
Dec 3, 2024 13:57:07.414397001 CET	445	50039	192.168.1.56	192.168.2.4
Dec 3, 2024 13:57:07.414422035 CET	50037	445	192.168.2.4	192.168.1.54
Dec 3, 2024 13:57:07.414463043 CET	50038	445	192.168.2.4	192.168.1.55
Dec 3, 2024 13:57:07.414463043 CET	50039	445	192.168.2.4	192.168.1.56
Dec 3, 2024 13:57:07.414974928 CET	50124	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:07.415261984 CET	445	50060	192.168.1.77	192.168.2.4
Dec 3, 2024 13:57:07.415272951 CET	445	50059	192.168.1.76	192.168.2.4
Dec 3, 2024 13:57:07.415282011 CET	445	50058	192.168.1.75	192.168.2.4
Dec 3, 2024 13:57:07.415298939 CET	445	50057	192.168.1.74	192.168.2.4
Dec 3, 2024 13:57:07.415308952 CET	445	50056	192.168.1.73	192.168.2.4
Dec 3, 2024 13:57:07.415334940 CET	445	50055	192.168.1.72	192.168.2.4
Dec 3, 2024 13:57:07.415344000 CET	445	50054	192.168.1.71	192.168.2.4
Dec 3, 2024 13:57:07.415354013 CET	445	50053	192.168.1.70	192.168.2.4
Dec 3, 2024 13:57:07.415364027 CET	445	50052	192.168.1.69	192.168.2.4
Dec 3, 2024 13:57:07.415374041 CET	445	50051	192.168.1.68	192.168.2.4
Dec 3, 2024 13:57:07.415384054 CET	445	50050	192.168.1.67	192.168.2.4
Dec 3, 2024 13:57:07.415402889 CET	445	50049	192.168.1.66	192.168.2.4
Dec 3, 2024 13:57:07.415411949 CET	445	50048	192.168.1.65	192.168.2.4
Dec 3, 2024 13:57:07.415421009 CET	445	50047	192.168.1.64	192.168.2.4
Dec 3, 2024 13:57:07.415430069 CET	445	50046	192.168.1.63	192.168.2.4
Dec 3, 2024 13:57:07.415457010 CET	50133	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:07.415549994 CET	445	50045	192.168.1.62	192.168.2.4
Dec 3, 2024 13:57:07.415560961 CET	445	50044	192.168.1.61	192.168.2.4
Dec 3, 2024 13:57:07.415570021 CET	445	50043	192.168.1.60	192.168.2.4
Dec 3, 2024 13:57:07.415580034 CET	445	50042	192.168.1.59	192.168.2.4
Dec 3, 2024 13:57:07.415589094 CET	445	50041	192.168.1.58	192.168.2.4
Dec 3, 2024 13:57:07.415604115 CET	445	50040	192.168.1.57	192.168.2.4
Dec 3, 2024 13:57:07.415666103 CET	445	50040	192.168.1.57	192.168.2.4
Dec 3, 2024 13:57:07.415674925 CET	445	50041	192.168.1.58	192.168.2.4
Dec 3, 2024 13:57:07.415683985 CET	445	50042	192.168.1.59	192.168.2.4
Dec 3, 2024 13:57:07.415710926 CET	50040	445	192.168.2.4	192.168.1.57
Dec 3, 2024 13:57:07.415719032 CET	50041	445	192.168.2.4	192.168.1.58
Dec 3, 2024 13:57:07.415728092 CET	445	50043	192.168.1.60	192.168.2.4
Dec 3, 2024 13:57:07.415740013 CET	50042	445	192.168.2.4	192.168.1.59
Dec 3, 2024 13:57:07.415770054 CET	50043	445	192.168.2.4	192.168.1.60
Dec 3, 2024 13:57:07.415802956 CET	445	50044	192.168.1.61	192.168.2.4
Dec 3, 2024 13:57:07.415812969 CET	445	50045	192.168.1.62	192.168.2.4
Dec 3, 2024 13:57:07.415821075 CET	445	50046	192.168.1.63	192.168.2.4
Dec 3, 2024 13:57:07.415828943 CET	445	50047	192.168.1.64	192.168.2.4
Dec 3, 2024 13:57:07.415847063 CET	445	50048	192.168.1.65	192.168.2.4
Dec 3, 2024 13:57:07.415857077 CET	445	50049	192.168.1.66	192.168.2.4
Dec 3, 2024 13:57:07.415858984 CET	50045	445	192.168.2.4	192.168.1.62
Dec 3, 2024 13:57:07.415867090 CET	50044	445	192.168.2.4	192.168.1.61
Dec 3, 2024 13:57:07.415868044 CET	445	50050	192.168.1.67	192.168.2.4
Dec 3, 2024 13:57:07.415868998 CET	50046	445	192.168.2.4	192.168.1.63
Dec 3, 2024 13:57:07.415890932 CET	445	50051	192.168.1.68	192.168.2.4
Dec 3, 2024 13:57:07.415894985 CET	50047	445	192.168.2.4	192.168.1.64
Dec 3, 2024 13:57:07.415911913 CET	50048	445	192.168.2.4	192.168.1.65
Dec 3, 2024 13:57:07.415913105 CET	50049	445	192.168.2.4	192.168.1.66
Dec 3, 2024 13:57:07.415932894 CET	50050	445	192.168.2.4	192.168.1.67
Dec 3, 2024 13:57:07.415942907 CET	445	50052	192.168.1.69	192.168.2.4
Dec 3, 2024 13:57:07.415952921 CET	445	50053	192.168.1.70	192.168.2.4
Dec 3, 2024 13:57:07.415963888 CET	445	50054	192.168.1.71	192.168.2.4
Dec 3, 2024 13:57:07.415975094 CET	50051	445	192.168.2.4	192.168.1.68
Dec 3, 2024 13:57:07.415981054 CET	445	50055	192.168.1.72	192.168.2.4
Dec 3, 2024 13:57:07.415987968 CET	50052	445	192.168.2.4	192.168.1.69
Dec 3, 2024 13:57:07.415988922 CET	445	50056	192.168.1.73	192.168.2.4
Dec 3, 2024 13:57:07.416008949 CET	50053	445	192.168.2.4	192.168.1.70
Dec 3, 2024 13:57:07.416019917 CET	50054	445	192.168.2.4	192.168.1.71
Dec 3, 2024 13:57:07.416030884 CET	445	50057	192.168.1.74	192.168.2.4
Dec 3, 2024 13:57:07.416043043 CET	50055	445	192.168.2.4	192.168.1.72
Dec 3, 2024 13:57:07.416052103 CET	50056	445	192.168.2.4	192.168.1.73
Dec 3, 2024 13:57:07.416068077 CET	50057	445	192.168.2.4	192.168.1.74
Dec 3, 2024 13:57:07.416100025 CET	445	50058	192.168.1.75	192.168.2.4
Dec 3, 2024 13:57:07.416110039 CET	445	50059	192.168.1.76	192.168.2.4
Dec 3, 2024 13:57:07.416141987 CET	50058	445	192.168.2.4	192.168.1.75
Dec 3, 2024 13:57:07.416152000 CET	50059	445	192.168.2.4	192.168.1.76
Dec 3, 2024 13:57:07.416239023 CET	445	50060	192.168.1.77	192.168.2.4
Dec 3, 2024 13:57:07.416249990 CET	445	50061	192.168.1.78	192.168.2.4
Dec 3, 2024 13:57:07.416287899 CET	50060	445	192.168.2.4	192.168.1.77
Dec 3, 2024 13:57:07.416296959 CET	50061	445	192.168.2.4	192.168.1.78
Dec 3, 2024 13:57:07.416455984 CET	50134	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:07.416563034 CET	50135	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:07.416654110 CET	50136	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:07.416837931 CET	50137	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:07.416955948 CET	50138	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:07.417129993 CET	50139	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:07.417325974 CET	50140	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:07.417396069 CET	50141	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:07.417870045 CET	50142	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:07.417954922 CET	50143	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:07.418122053 CET	50144	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:07.418204069 CET	50146	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:07.418421030 CET	50147	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:07.418492079 CET	50148	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:07.418668985 CET	50150	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:07.419143915 CET	50151	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:07.419261932 CET	50152	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:07.419353008 CET	50145	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:07.419421911 CET	50149	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:07.419630051 CET	50153	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:07.419756889 CET	50154	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:07.420155048 CET	50155	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:07.420247078 CET	50156	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:07.420322895 CET	50158	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:07.420520067 CET	50160	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:07.420835972 CET	50161	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:07.420947075 CET	50162	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:07.421015024 CET	50163	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:07.421101093 CET	50157	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:07.421355009 CET	50159	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:07.421601057 CET	50164	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:07.421680927 CET	50165	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:07.421837091 CET	50166	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:07.422249079 CET	50167	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:07.422337055 CET	50168	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:07.422409058 CET	50169	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:07.422481060 CET	50170	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:07.422719002 CET	50171	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:07.422800064 CET	50172	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:07.422934055 CET	50173	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:07.423041105 CET	50174	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:07.423109055 CET	50175	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:07.424019098 CET	50181	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:07.425780058 CET	50182	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:07.426367044 CET	50183	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:07.426597118 CET	50184	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:07.427037001 CET	50185	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:07.438875914 CET	50186	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:07.439235926 CET	50187	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:07.445557117 CET	445	50062	192.168.1.79	192.168.2.4
Dec 3, 2024 13:57:07.445576906 CET	445	50176	192.168.1.193	192.168.2.4
Dec 3, 2024 13:57:07.445636034 CET	445	50177	192.168.1.194	192.168.2.4
Dec 3, 2024 13:57:07.445643902 CET	50062	445	192.168.2.4	192.168.1.79
Dec 3, 2024 13:57:07.445687056 CET	50176	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:07.445720911 CET	50177	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:07.445724964 CET	445	50178	192.168.1.195	192.168.2.4
Dec 3, 2024 13:57:07.445736885 CET	445	50179	192.168.1.196	192.168.2.4
Dec 3, 2024 13:57:07.445764065 CET	445	50180	192.168.1.197	192.168.2.4
Dec 3, 2024 13:57:07.445774078 CET	50178	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:07.445774078 CET	445	50063	192.168.1.80	192.168.2.4
Dec 3, 2024 13:57:07.445799112 CET	50179	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:07.445831060 CET	50063	445	192.168.2.4	192.168.1.80
Dec 3, 2024 13:57:07.445837975 CET	445	50065	192.168.1.82	192.168.2.4
Dec 3, 2024 13:57:07.445848942 CET	445	50064	192.168.1.81	192.168.2.4
Dec 3, 2024 13:57:07.445866108 CET	50180	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:07.445878029 CET	50065	445	192.168.2.4	192.168.1.82
Dec 3, 2024 13:57:07.445907116 CET	50064	445	192.168.2.4	192.168.1.81
Dec 3, 2024 13:57:07.445938110 CET	445	50066	192.168.1.83	192.168.2.4
Dec 3, 2024 13:57:07.445950031 CET	445	50067	192.168.1.84	192.168.2.4
Dec 3, 2024 13:57:07.445981979 CET	50066	445	192.168.2.4	192.168.1.83
Dec 3, 2024 13:57:07.446006060 CET	50067	445	192.168.2.4	192.168.1.84
Dec 3, 2024 13:57:07.447117090 CET	445	50070	192.168.1.87	192.168.2.4
Dec 3, 2024 13:57:07.447284937 CET	445	50071	192.168.1.88	192.168.2.4
Dec 3, 2024 13:57:07.447340012 CET	50070	445	192.168.2.4	192.168.1.87
Dec 3, 2024 13:57:07.447352886 CET	50071	445	192.168.2.4	192.168.1.88
Dec 3, 2024 13:57:07.447531939 CET	445	50068	192.168.1.85	192.168.2.4
Dec 3, 2024 13:57:07.448075056 CET	445	50072	192.168.1.89	192.168.2.4
Dec 3, 2024 13:57:07.448121071 CET	50068	445	192.168.2.4	192.168.1.85
Dec 3, 2024 13:57:07.448142052 CET	50072	445	192.168.2.4	192.168.1.89
Dec 3, 2024 13:57:07.448393106 CET	445	50074	192.168.1.91	192.168.2.4
Dec 3, 2024 13:57:07.448766947 CET	445	50073	192.168.1.90	192.168.2.4
Dec 3, 2024 13:57:07.448817968 CET	50074	445	192.168.2.4	192.168.1.91
Dec 3, 2024 13:57:07.448846102 CET	50073	445	192.168.2.4	192.168.1.90
Dec 3, 2024 13:57:07.449057102 CET	445	50077	192.168.1.94	192.168.2.4
Dec 3, 2024 13:57:07.449409962 CET	50077	445	192.168.2.4	192.168.1.94
Dec 3, 2024 13:57:07.449546099 CET	445	50076	192.168.1.93	192.168.2.4
Dec 3, 2024 13:57:07.449892998 CET	445	50078	192.168.1.95	192.168.2.4
Dec 3, 2024 13:57:07.449955940 CET	50078	445	192.168.2.4	192.168.1.95
Dec 3, 2024 13:57:07.449978113 CET	50076	445	192.168.2.4	192.168.1.93
Dec 3, 2024 13:57:07.450321913 CET	445	50075	192.168.1.92	192.168.2.4
Dec 3, 2024 13:57:07.450599909 CET	445	50079	192.168.1.96	192.168.2.4
Dec 3, 2024 13:57:07.450649977 CET	50075	445	192.168.2.4	192.168.1.92
Dec 3, 2024 13:57:07.450658083 CET	50079	445	192.168.2.4	192.168.1.96
Dec 3, 2024 13:57:07.450980902 CET	445	50080	192.168.1.97	192.168.2.4
Dec 3, 2024 13:57:07.451278925 CET	445	50093	192.168.1.110	192.168.2.4
Dec 3, 2024 13:57:07.451287985 CET	445	50092	192.168.1.109	192.168.2.4
Dec 3, 2024 13:57:07.451297045 CET	445	50091	192.168.1.108	192.168.2.4
Dec 3, 2024 13:57:07.451306105 CET	445	50090	192.168.1.107	192.168.2.4
Dec 3, 2024 13:57:07.451318026 CET	445	50089	192.168.1.106	192.168.2.4
Dec 3, 2024 13:57:07.451328039 CET	445	50088	192.168.1.105	192.168.2.4
Dec 3, 2024 13:57:07.451343060 CET	50080	445	192.168.2.4	192.168.1.97
Dec 3, 2024 13:57:07.451345921 CET	445	50087	192.168.1.104	192.168.2.4
Dec 3, 2024 13:57:07.451354980 CET	445	50086	192.168.1.103	192.168.2.4
Dec 3, 2024 13:57:07.451364040 CET	445	50085	192.168.1.102	192.168.2.4
Dec 3, 2024 13:57:07.451371908 CET	445	50084	192.168.1.101	192.168.2.4
Dec 3, 2024 13:57:07.451380968 CET	445	50083	192.168.1.100	192.168.2.4
Dec 3, 2024 13:57:07.451396942 CET	445	50082	192.168.1.99	192.168.2.4
Dec 3, 2024 13:57:07.451410055 CET	445	50081	192.168.1.98	192.168.2.4
Dec 3, 2024 13:57:07.451419115 CET	445	50095	192.168.1.112	192.168.2.4
Dec 3, 2024 13:57:07.451426029 CET	445	50094	192.168.1.111	192.168.2.4
Dec 3, 2024 13:57:07.451433897 CET	445	50081	192.168.1.98	192.168.2.4
Dec 3, 2024 13:57:07.451472998 CET	50081	445	192.168.2.4	192.168.1.98
Dec 3, 2024 13:57:07.451726913 CET	445	50083	192.168.1.100	192.168.2.4
Dec 3, 2024 13:57:07.451771975 CET	50083	445	192.168.2.4	192.168.1.100
Dec 3, 2024 13:57:07.452126026 CET	445	50082	192.168.1.99	192.168.2.4
Dec 3, 2024 13:57:07.452388048 CET	50082	445	192.168.2.4	192.168.1.99
Dec 3, 2024 13:57:07.452415943 CET	445	50085	192.168.1.102	192.168.2.4
Dec 3, 2024 13:57:07.452460051 CET	50085	445	192.168.2.4	192.168.1.102
Dec 3, 2024 13:57:07.452761889 CET	445	50084	192.168.1.101	192.168.2.4
Dec 3, 2024 13:57:07.452816010 CET	50084	445	192.168.2.4	192.168.1.101
Dec 3, 2024 13:57:07.453031063 CET	445	50086	192.168.1.103	192.168.2.4
Dec 3, 2024 13:57:07.453077078 CET	50086	445	192.168.2.4	192.168.1.103
Dec 3, 2024 13:57:07.453274965 CET	445	50087	192.168.1.104	192.168.2.4
Dec 3, 2024 13:57:07.453320026 CET	50087	445	192.168.2.4	192.168.1.104
Dec 3, 2024 13:57:07.453696966 CET	445	50088	192.168.1.105	192.168.2.4
Dec 3, 2024 13:57:07.453737020 CET	50088	445	192.168.2.4	192.168.1.105
Dec 3, 2024 13:57:07.454039097 CET	445	50089	192.168.1.106	192.168.2.4
Dec 3, 2024 13:57:07.454315901 CET	445	50090	192.168.1.107	192.168.2.4
Dec 3, 2024 13:57:07.454361916 CET	50089	445	192.168.2.4	192.168.1.106
Dec 3, 2024 13:57:07.454372883 CET	50090	445	192.168.2.4	192.168.1.107
Dec 3, 2024 13:57:07.454648972 CET	445	50091	192.168.1.108	192.168.2.4
Dec 3, 2024 13:57:07.454889059 CET	445	50092	192.168.1.109	192.168.2.4
Dec 3, 2024 13:57:07.454936981 CET	50091	445	192.168.2.4	192.168.1.108
Dec 3, 2024 13:57:07.454943895 CET	50092	445	192.168.2.4	192.168.1.109
Dec 3, 2024 13:57:07.455240011 CET	445	50093	192.168.1.110	192.168.2.4
Dec 3, 2024 13:57:07.455317974 CET	445	50069	192.168.1.86	192.168.2.4
Dec 3, 2024 13:57:07.455363035 CET	50093	445	192.168.2.4	192.168.1.110
Dec 3, 2024 13:57:07.455378056 CET	50069	445	192.168.2.4	192.168.1.86
Dec 3, 2024 13:57:07.455574036 CET	445	50095	192.168.1.112	192.168.2.4
Dec 3, 2024 13:57:07.455621958 CET	50095	445	192.168.2.4	192.168.1.112
Dec 3, 2024 13:57:07.455852985 CET	445	50094	192.168.1.111	192.168.2.4
Dec 3, 2024 13:57:07.455900908 CET	50094	445	192.168.2.4	192.168.1.111
Dec 3, 2024 13:57:07.456402063 CET	445	50096	192.168.1.113	192.168.2.4
Dec 3, 2024 13:57:07.456808090 CET	445	50098	192.168.1.115	192.168.2.4
Dec 3, 2024 13:57:07.456862926 CET	50096	445	192.168.2.4	192.168.1.113
Dec 3, 2024 13:57:07.456875086 CET	50098	445	192.168.2.4	192.168.1.115
Dec 3, 2024 13:57:07.457253933 CET	445	50097	192.168.1.114	192.168.2.4
Dec 3, 2024 13:57:07.457604885 CET	445	50099	192.168.1.116	192.168.2.4
Dec 3, 2024 13:57:07.457659960 CET	50097	445	192.168.2.4	192.168.1.114
Dec 3, 2024 13:57:07.457668066 CET	50099	445	192.168.2.4	192.168.1.116
Dec 3, 2024 13:57:07.457938910 CET	445	50100	192.168.1.117	192.168.2.4
Dec 3, 2024 13:57:07.458389997 CET	50100	445	192.168.2.4	192.168.1.117
Dec 3, 2024 13:57:07.460235119 CET	445	50102	192.168.1.119	192.168.2.4
Dec 3, 2024 13:57:07.460297108 CET	50102	445	192.168.2.4	192.168.1.119
Dec 3, 2024 13:57:07.460602045 CET	445	50101	192.168.1.118	192.168.2.4
Dec 3, 2024 13:57:07.460689068 CET	50101	445	192.168.2.4	192.168.1.118
Dec 3, 2024 13:57:07.466644049 CET	445	50103	192.168.1.120	192.168.2.4
Dec 3, 2024 13:57:07.466654062 CET	445	50104	192.168.1.121	192.168.2.4
Dec 3, 2024 13:57:07.466687918 CET	445	50105	192.168.1.122	192.168.2.4
Dec 3, 2024 13:57:07.466701031 CET	50103	445	192.168.2.4	192.168.1.120
Dec 3, 2024 13:57:07.466713905 CET	50104	445	192.168.2.4	192.168.1.121
Dec 3, 2024 13:57:07.466759920 CET	50105	445	192.168.2.4	192.168.1.122
Dec 3, 2024 13:57:07.468386889 CET	445	50106	192.168.1.123	192.168.2.4
Dec 3, 2024 13:57:07.468424082 CET	50106	445	192.168.2.4	192.168.1.123
Dec 3, 2024 13:57:07.468621969 CET	445	50107	192.168.1.124	192.168.2.4
Dec 3, 2024 13:57:07.469069958 CET	50107	445	192.168.2.4	192.168.1.124
Dec 3, 2024 13:57:07.472367048 CET	445	50108	192.168.1.125	192.168.2.4
Dec 3, 2024 13:57:07.472414970 CET	50108	445	192.168.2.4	192.168.1.125
Dec 3, 2024 13:57:07.472628117 CET	445	50109	192.168.1.126	192.168.2.4
Dec 3, 2024 13:57:07.472753048 CET	50109	445	192.168.2.4	192.168.1.126
Dec 3, 2024 13:57:07.472758055 CET	445	50110	192.168.1.127	192.168.2.4
Dec 3, 2024 13:57:07.472835064 CET	445	50111	192.168.1.128	192.168.2.4
Dec 3, 2024 13:57:07.472870111 CET	50110	445	192.168.2.4	192.168.1.127
Dec 3, 2024 13:57:07.472877026 CET	50111	445	192.168.2.4	192.168.1.128
Dec 3, 2024 13:57:07.477166891 CET	445	50112	192.168.1.129	192.168.2.4
Dec 3, 2024 13:57:07.477411032 CET	445	50113	192.168.1.130	192.168.2.4
Dec 3, 2024 13:57:07.477471113 CET	50113	445	192.168.2.4	192.168.1.130
Dec 3, 2024 13:57:07.477478981 CET	50112	445	192.168.2.4	192.168.1.129
Dec 3, 2024 13:57:07.477672100 CET	445	50114	192.168.1.131	192.168.2.4
Dec 3, 2024 13:57:07.477813005 CET	50114	445	192.168.2.4	192.168.1.131
Dec 3, 2024 13:57:07.483253956 CET	445	50118	192.168.1.135	192.168.2.4
Dec 3, 2024 13:57:07.483275890 CET	445	50117	192.168.1.134	192.168.2.4
Dec 3, 2024 13:57:07.483287096 CET	445	50115	192.168.1.132	192.168.2.4
Dec 3, 2024 13:57:07.483320951 CET	445	50115	192.168.1.132	192.168.2.4
Dec 3, 2024 13:57:07.483407974 CET	445	50117	192.168.1.134	192.168.2.4
Dec 3, 2024 13:57:07.483417988 CET	445	50118	192.168.1.135	192.168.2.4
Dec 3, 2024 13:57:07.483450890 CET	50115	445	192.168.2.4	192.168.1.132
Dec 3, 2024 13:57:07.483460903 CET	50117	445	192.168.2.4	192.168.1.134
Dec 3, 2024 13:57:07.483483076 CET	50118	445	192.168.2.4	192.168.1.135
Dec 3, 2024 13:57:07.483746052 CET	445	50119	192.168.1.136	192.168.2.4
Dec 3, 2024 13:57:07.483788013 CET	445	50121	192.168.1.138	192.168.2.4
Dec 3, 2024 13:57:07.483791113 CET	50119	445	192.168.2.4	192.168.1.136
Dec 3, 2024 13:57:07.483824968 CET	50121	445	192.168.2.4	192.168.1.138
Dec 3, 2024 13:57:07.486851931 CET	445	50116	192.168.1.133	192.168.2.4
Dec 3, 2024 13:57:07.486927032 CET	50116	445	192.168.2.4	192.168.1.133
Dec 3, 2024 13:57:07.487010956 CET	445	50120	192.168.1.137	192.168.2.4
Dec 3, 2024 13:57:07.487157106 CET	50120	445	192.168.2.4	192.168.1.137
Dec 3, 2024 13:57:07.491044998 CET	445	50122	192.168.1.139	192.168.2.4
Dec 3, 2024 13:57:07.491262913 CET	445	50123	192.168.1.140	192.168.2.4
Dec 3, 2024 13:57:07.491318941 CET	50122	445	192.168.2.4	192.168.1.139
Dec 3, 2024 13:57:07.491344929 CET	50123	445	192.168.2.4	192.168.1.140
Dec 3, 2024 13:57:07.494914055 CET	445	50125	192.168.1.142	192.168.2.4
Dec 3, 2024 13:57:07.495220900 CET	445	50126	192.168.1.143	192.168.2.4
Dec 3, 2024 13:57:07.495254040 CET	445	50127	192.168.1.144	192.168.2.4
Dec 3, 2024 13:57:07.495271921 CET	50125	445	192.168.2.4	192.168.1.142
Dec 3, 2024 13:57:07.495290995 CET	50126	445	192.168.2.4	192.168.1.143
Dec 3, 2024 13:57:07.495323896 CET	50127	445	192.168.2.4	192.168.1.144
Dec 3, 2024 13:57:07.499079943 CET	445	50128	192.168.1.145	192.168.2.4
Dec 3, 2024 13:57:07.499140978 CET	50128	445	192.168.2.4	192.168.1.145
Dec 3, 2024 13:57:07.499268055 CET	445	50129	192.168.1.146	192.168.2.4
Dec 3, 2024 13:57:07.499520063 CET	445	50130	192.168.1.147	192.168.2.4
Dec 3, 2024 13:57:07.499583006 CET	50129	445	192.168.2.4	192.168.1.146
Dec 3, 2024 13:57:07.499588013 CET	50130	445	192.168.2.4	192.168.1.147
Dec 3, 2024 13:57:07.499639988 CET	445	50131	192.168.1.148	192.168.2.4
Dec 3, 2024 13:57:07.501411915 CET	50131	445	192.168.2.4	192.168.1.148
Dec 3, 2024 13:57:07.503041983 CET	50176	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:07.503328085 CET	50177	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:07.503345966 CET	50178	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:07.503427029 CET	50179	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:07.503511906 CET	50180	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:07.504075050 CET	50188	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:07.514864922 CET	50189	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:07.515149117 CET	50190	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:07.515355110 CET	50191	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:07.515521049 CET	50192	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:07.515698910 CET	50193	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:07.528579950 CET	50194	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:07.528969049 CET	50195	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:07.529182911 CET	50196	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:07.529387951 CET	50197	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:07.529581070 CET	50198	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:07.529804945 CET	50199	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:07.532826900 CET	445	50132	192.168.1.149	192.168.2.4
Dec 3, 2024 13:57:07.532897949 CET	50132	445	192.168.2.4	192.168.1.149
Dec 3, 2024 13:57:07.535537958 CET	445	50124	192.168.1.141	192.168.2.4
Dec 3, 2024 13:57:07.536829948 CET	50124	445	192.168.2.4	192.168.1.141
Dec 3, 2024 13:57:07.540487051 CET	50200	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:07.540771961 CET	50201	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:07.540967941 CET	50202	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:07.550153017 CET	50203	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:07.550463915 CET	50204	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:07.550713062 CET	50205	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:07.558692932 CET	50206	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:07.559019089 CET	50207	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:07.559714079 CET	50208	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:07.560112953 CET	50209	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:07.561058044 CET	50210	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:07.561305046 CET	50211	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:07.561702013 CET	50212	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:07.561954021 CET	50213	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:07.562215090 CET	50214	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:07.562413931 CET	50215	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:07.562661886 CET	50216	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:07.562870026 CET	50217	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:07.563426018 CET	50218	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:07.563653946 CET	50219	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:07.564305067 CET	50220	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:07.564344883 CET	50221	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:07.564555883 CET	50222	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:07.564723969 CET	50223	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:07.564898968 CET	50224	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:07.565063953 CET	50225	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:07.565226078 CET	50226	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:07.565676928 CET	50227	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:07.566051006 CET	445	50133	192.168.1.150	192.168.2.4
Dec 3, 2024 13:57:07.566102982 CET	50133	445	192.168.2.4	192.168.1.150
Dec 3, 2024 13:57:07.566404104 CET	50228	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:07.566474915 CET	445	50134	192.168.1.151	192.168.2.4
Dec 3, 2024 13:57:07.566535950 CET	445	50135	192.168.1.152	192.168.2.4
Dec 3, 2024 13:57:07.566545963 CET	445	50136	192.168.1.153	192.168.2.4
Dec 3, 2024 13:57:07.566559076 CET	445	50137	192.168.1.154	192.168.2.4
Dec 3, 2024 13:57:07.566569090 CET	445	50138	192.168.1.155	192.168.2.4
Dec 3, 2024 13:57:07.566581011 CET	50134	445	192.168.2.4	192.168.1.151
Dec 3, 2024 13:57:07.566591024 CET	50135	445	192.168.2.4	192.168.1.152
Dec 3, 2024 13:57:07.566617966 CET	50136	445	192.168.2.4	192.168.1.153
Dec 3, 2024 13:57:07.566629887 CET	50137	445	192.168.2.4	192.168.1.154
Dec 3, 2024 13:57:07.566648960 CET	50138	445	192.168.2.4	192.168.1.155
Dec 3, 2024 13:57:07.566986084 CET	445	50139	192.168.1.156	192.168.2.4
Dec 3, 2024 13:57:07.567027092 CET	50139	445	192.168.2.4	192.168.1.156
Dec 3, 2024 13:57:07.567054987 CET	445	50140	192.168.1.157	192.168.2.4
Dec 3, 2024 13:57:07.567069054 CET	445	50141	192.168.1.158	192.168.2.4
Dec 3, 2024 13:57:07.567080021 CET	445	50142	192.168.1.159	192.168.2.4
Dec 3, 2024 13:57:07.567090988 CET	445	50181	192.168.1.198	192.168.2.4
Dec 3, 2024 13:57:07.567092896 CET	50140	445	192.168.2.4	192.168.1.157
Dec 3, 2024 13:57:07.567101955 CET	445	50182	192.168.1.199	192.168.2.4
Dec 3, 2024 13:57:07.567120075 CET	445	50183	192.168.1.200	192.168.2.4
Dec 3, 2024 13:57:07.567125082 CET	50142	445	192.168.2.4	192.168.1.159
Dec 3, 2024 13:57:07.567128897 CET	50141	445	192.168.2.4	192.168.1.158
Dec 3, 2024 13:57:07.567197084 CET	50182	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:07.567197084 CET	50183	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:07.567203045 CET	50181	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:07.567228079 CET	445	50184	192.168.1.201	192.168.2.4
Dec 3, 2024 13:57:07.567269087 CET	50184	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:07.567298889 CET	445	50185	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:07.567307949 CET	445	50186	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:07.567323923 CET	445	50187	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:07.567332983 CET	445	50175	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:07.567342997 CET	445	50174	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:07.567362070 CET	445	50173	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:07.567365885 CET	50186	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:07.567372084 CET	445	50172	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:07.567380905 CET	445	50171	192.168.1.188	192.168.2.4
Dec 3, 2024 13:57:07.567389965 CET	445	50170	192.168.1.187	192.168.2.4
Dec 3, 2024 13:57:07.567399979 CET	50187	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:07.567409039 CET	445	50169	192.168.1.186	192.168.2.4
Dec 3, 2024 13:57:07.567418098 CET	445	50168	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:07.567428112 CET	445	50167	192.168.1.184	192.168.2.4
Dec 3, 2024 13:57:07.567436934 CET	445	50166	192.168.1.183	192.168.2.4
Dec 3, 2024 13:57:07.567449093 CET	445	50165	192.168.1.182	192.168.2.4
Dec 3, 2024 13:57:07.567457914 CET	445	50164	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:07.567507029 CET	50185	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:07.567564964 CET	445	50159	192.168.1.176	192.168.2.4
Dec 3, 2024 13:57:07.567576885 CET	445	50157	192.168.1.174	192.168.2.4
Dec 3, 2024 13:57:07.567585945 CET	445	50163	192.168.1.180	192.168.2.4
Dec 3, 2024 13:57:07.567595959 CET	445	50162	192.168.1.179	192.168.2.4
Dec 3, 2024 13:57:07.567605019 CET	445	50161	192.168.1.178	192.168.2.4
Dec 3, 2024 13:57:07.567614079 CET	445	50160	192.168.1.177	192.168.2.4
Dec 3, 2024 13:57:07.567622900 CET	445	50158	192.168.1.175	192.168.2.4
Dec 3, 2024 13:57:07.567631960 CET	445	50156	192.168.1.173	192.168.2.4
Dec 3, 2024 13:57:07.567636967 CET	445	50155	192.168.1.172	192.168.2.4
Dec 3, 2024 13:57:07.567640066 CET	445	50154	192.168.1.171	192.168.2.4
Dec 3, 2024 13:57:07.567643881 CET	445	50153	192.168.1.170	192.168.2.4
Dec 3, 2024 13:57:07.567652941 CET	445	50149	192.168.1.166	192.168.2.4
Dec 3, 2024 13:57:07.567662001 CET	445	50145	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:07.567671061 CET	445	50152	192.168.1.169	192.168.2.4
Dec 3, 2024 13:57:07.567679882 CET	445	50151	192.168.1.168	192.168.2.4
Dec 3, 2024 13:57:07.567697048 CET	445	50150	192.168.1.167	192.168.2.4
Dec 3, 2024 13:57:07.567706108 CET	445	50148	192.168.1.165	192.168.2.4
Dec 3, 2024 13:57:07.567713976 CET	445	50147	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:07.567723036 CET	445	50146	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:07.567732096 CET	445	50144	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:07.567740917 CET	445	50143	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:07.567917109 CET	445	50143	192.168.1.160	192.168.2.4
Dec 3, 2024 13:57:07.567949057 CET	50143	445	192.168.2.4	192.168.1.160
Dec 3, 2024 13:57:07.567969084 CET	445	50144	192.168.1.161	192.168.2.4
Dec 3, 2024 13:57:07.568003893 CET	50144	445	192.168.2.4	192.168.1.161
Dec 3, 2024 13:57:07.568099976 CET	445	50146	192.168.1.163	192.168.2.4
Dec 3, 2024 13:57:07.568109035 CET	445	50147	192.168.1.164	192.168.2.4
Dec 3, 2024 13:57:07.568140030 CET	445	50148	192.168.1.165	192.168.2.4
Dec 3, 2024 13:57:07.568141937 CET	50146	445	192.168.2.4	192.168.1.163
Dec 3, 2024 13:57:07.568146944 CET	50147	445	192.168.2.4	192.168.1.164
Dec 3, 2024 13:57:07.568169117 CET	50148	445	192.168.2.4	192.168.1.165
Dec 3, 2024 13:57:07.568172932 CET	445	50150	192.168.1.167	192.168.2.4
Dec 3, 2024 13:57:07.568205118 CET	50150	445	192.168.2.4	192.168.1.167
Dec 3, 2024 13:57:07.568298101 CET	445	50151	192.168.1.168	192.168.2.4
Dec 3, 2024 13:57:07.568306923 CET	445	50152	192.168.1.169	192.168.2.4
Dec 3, 2024 13:57:07.568339109 CET	50151	445	192.168.2.4	192.168.1.168
Dec 3, 2024 13:57:07.568346024 CET	445	50145	192.168.1.162	192.168.2.4
Dec 3, 2024 13:57:07.568346024 CET	50152	445	192.168.2.4	192.168.1.169
Dec 3, 2024 13:57:07.568356037 CET	445	50149	192.168.1.166	192.168.2.4
Dec 3, 2024 13:57:07.568367958 CET	445	50153	192.168.1.170	192.168.2.4
Dec 3, 2024 13:57:07.568409920 CET	50145	445	192.168.2.4	192.168.1.162
Dec 3, 2024 13:57:07.568409920 CET	50149	445	192.168.2.4	192.168.1.166
Dec 3, 2024 13:57:07.568449020 CET	445	50154	192.168.1.171	192.168.2.4
Dec 3, 2024 13:57:07.568458080 CET	445	50155	192.168.1.172	192.168.2.4
Dec 3, 2024 13:57:07.568485022 CET	50154	445	192.168.2.4	192.168.1.171
Dec 3, 2024 13:57:07.568492889 CET	50155	445	192.168.2.4	192.168.1.172
Dec 3, 2024 13:57:07.568564892 CET	50187	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:07.568568945 CET	445	50156	192.168.1.173	192.168.2.4
Dec 3, 2024 13:57:07.568572044 CET	50153	445	192.168.2.4	192.168.1.170
Dec 3, 2024 13:57:07.568639994 CET	50156	445	192.168.2.4	192.168.1.173
Dec 3, 2024 13:57:07.568731070 CET	50186	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:07.568783045 CET	445	50158	192.168.1.175	192.168.2.4
Dec 3, 2024 13:57:07.568828106 CET	50158	445	192.168.2.4	192.168.1.175
Dec 3, 2024 13:57:07.568831921 CET	445	50160	192.168.1.177	192.168.2.4
Dec 3, 2024 13:57:07.568845987 CET	445	50161	192.168.1.178	192.168.2.4
Dec 3, 2024 13:57:07.568855047 CET	445	50162	192.168.1.179	192.168.2.4
Dec 3, 2024 13:57:07.568857908 CET	50185	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:07.568865061 CET	445	50163	192.168.1.180	192.168.2.4
Dec 3, 2024 13:57:07.568872929 CET	445	50157	192.168.1.174	192.168.2.4
Dec 3, 2024 13:57:07.568886995 CET	50160	445	192.168.2.4	192.168.1.177
Dec 3, 2024 13:57:07.568898916 CET	50161	445	192.168.2.4	192.168.1.178
Dec 3, 2024 13:57:07.568902016 CET	50162	445	192.168.2.4	192.168.1.179
Dec 3, 2024 13:57:07.568913937 CET	445	50159	192.168.1.176	192.168.2.4
Dec 3, 2024 13:57:07.568939924 CET	50163	445	192.168.2.4	192.168.1.180
Dec 3, 2024 13:57:07.568975925 CET	50157	445	192.168.2.4	192.168.1.174
Dec 3, 2024 13:57:07.568975925 CET	50159	445	192.168.2.4	192.168.1.176
Dec 3, 2024 13:57:07.568979979 CET	445	50164	192.168.1.181	192.168.2.4
Dec 3, 2024 13:57:07.568989992 CET	445	50165	192.168.1.182	192.168.2.4
Dec 3, 2024 13:57:07.569000006 CET	445	50166	192.168.1.183	192.168.2.4
Dec 3, 2024 13:57:07.569030046 CET	50164	445	192.168.2.4	192.168.1.181
Dec 3, 2024 13:57:07.569032907 CET	50165	445	192.168.2.4	192.168.1.182
Dec 3, 2024 13:57:07.569055080 CET	445	50167	192.168.1.184	192.168.2.4
Dec 3, 2024 13:57:07.569061041 CET	50166	445	192.168.2.4	192.168.1.183
Dec 3, 2024 13:57:07.569065094 CET	445	50168	192.168.1.185	192.168.2.4
Dec 3, 2024 13:57:07.569073915 CET	445	50169	192.168.1.186	192.168.2.4
Dec 3, 2024 13:57:07.569092035 CET	50167	445	192.168.2.4	192.168.1.184
Dec 3, 2024 13:57:07.569102049 CET	50168	445	192.168.2.4	192.168.1.185
Dec 3, 2024 13:57:07.569118977 CET	50169	445	192.168.2.4	192.168.1.186
Dec 3, 2024 13:57:07.569128990 CET	445	50170	192.168.1.187	192.168.2.4
Dec 3, 2024 13:57:07.569169998 CET	50170	445	192.168.2.4	192.168.1.187
Dec 3, 2024 13:57:07.569173098 CET	445	50171	192.168.1.188	192.168.2.4
Dec 3, 2024 13:57:07.569210052 CET	50171	445	192.168.2.4	192.168.1.188
Dec 3, 2024 13:57:07.569257021 CET	445	50172	192.168.1.189	192.168.2.4
Dec 3, 2024 13:57:07.569297075 CET	445	50173	192.168.1.190	192.168.2.4
Dec 3, 2024 13:57:07.569298983 CET	50172	445	192.168.2.4	192.168.1.189
Dec 3, 2024 13:57:07.569370031 CET	445	50174	192.168.1.191	192.168.2.4
Dec 3, 2024 13:57:07.569399118 CET	445	50175	192.168.1.192	192.168.2.4
Dec 3, 2024 13:57:07.569405079 CET	50173	445	192.168.2.4	192.168.1.190
Dec 3, 2024 13:57:07.569415092 CET	50174	445	192.168.2.4	192.168.1.191
Dec 3, 2024 13:57:07.569436073 CET	50175	445	192.168.2.4	192.168.1.192
Dec 3, 2024 13:57:07.569533110 CET	50184	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:07.569603920 CET	50183	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:07.569746971 CET	50182	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:07.569802999 CET	50181	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:07.570029974 CET	50229	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:07.570337057 CET	50230	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:07.570796013 CET	50231	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:07.571369886 CET	50232	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:07.571630955 CET	50233	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:07.571971893 CET	50234	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:07.572170973 CET	50235	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:07.572447062 CET	50236	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:07.573483944 CET	50237	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:07.627016068 CET	445	50176	192.168.1.193	192.168.2.4
Dec 3, 2024 13:57:07.627254963 CET	50176	445	192.168.2.4	192.168.1.193
Dec 3, 2024 13:57:07.627502918 CET	445	50177	192.168.1.194	192.168.2.4
Dec 3, 2024 13:57:07.627532959 CET	445	50178	192.168.1.195	192.168.2.4
Dec 3, 2024 13:57:07.627567053 CET	50177	445	192.168.2.4	192.168.1.194
Dec 3, 2024 13:57:07.627588987 CET	445	50179	192.168.1.196	192.168.2.4
Dec 3, 2024 13:57:07.627593994 CET	50178	445	192.168.2.4	192.168.1.195
Dec 3, 2024 13:57:07.627599955 CET	445	50180	192.168.1.197	192.168.2.4
Dec 3, 2024 13:57:07.627629042 CET	445	50188	192.168.1.205	192.168.2.4
Dec 3, 2024 13:57:07.627643108 CET	50179	445	192.168.2.4	192.168.1.196
Dec 3, 2024 13:57:07.627655983 CET	50180	445	192.168.2.4	192.168.1.197
Dec 3, 2024 13:57:07.627688885 CET	50188	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:07.628030062 CET	50188	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:07.639764071 CET	445	50189	192.168.1.206	192.168.2.4
Dec 3, 2024 13:57:07.639843941 CET	50189	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:07.639977932 CET	445	50190	192.168.1.207	192.168.2.4
Dec 3, 2024 13:57:07.640119076 CET	50190	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:07.640130997 CET	445	50191	192.168.1.208	192.168.2.4
Dec 3, 2024 13:57:07.640191078 CET	50191	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:07.640366077 CET	445	50192	192.168.1.209	192.168.2.4
Dec 3, 2024 13:57:07.640420914 CET	50192	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:07.640470028 CET	445	50193	192.168.1.210	192.168.2.4
Dec 3, 2024 13:57:07.640511036 CET	50190	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:07.640554905 CET	50193	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:07.640697002 CET	50189	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:07.640885115 CET	50191	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:07.640918016 CET	50192	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:07.640995026 CET	50193	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:07.653510094 CET	445	50194	192.168.1.211	192.168.2.4
Dec 3, 2024 13:57:07.653580904 CET	50194	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:07.653655052 CET	50194	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:07.653826952 CET	445	50195	192.168.1.212	192.168.2.4
Dec 3, 2024 13:57:07.653882980 CET	50195	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:07.653989077 CET	50195	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:07.654117107 CET	445	50196	192.168.1.213	192.168.2.4
Dec 3, 2024 13:57:07.654181004 CET	50196	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:07.654274940 CET	445	50197	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:07.654323101 CET	50196	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:07.654349089 CET	445	50198	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:07.654351950 CET	50197	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:07.654391050 CET	50198	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:07.654548883 CET	50197	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:07.654675007 CET	50198	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:07.654685974 CET	445	50199	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:07.654730082 CET	50199	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:07.654863119 CET	50199	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:07.664833069 CET	445	50200	192.168.1.217	192.168.2.4
Dec 3, 2024 13:57:07.664896965 CET	50200	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:07.664937019 CET	445	50201	192.168.1.218	192.168.2.4
Dec 3, 2024 13:57:07.664987087 CET	50201	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:07.665076971 CET	50200	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:07.665162086 CET	445	50202	192.168.1.219	192.168.2.4
Dec 3, 2024 13:57:07.665218115 CET	50202	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:07.667121887 CET	50201	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:07.667232990 CET	50202	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:07.673376083 CET	445	50203	192.168.1.220	192.168.2.4
Dec 3, 2024 13:57:07.673438072 CET	50203	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:07.673511982 CET	445	50204	192.168.1.221	192.168.2.4
Dec 3, 2024 13:57:07.673516989 CET	50203	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:07.673599958 CET	50204	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:07.673723936 CET	50204	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:07.673789978 CET	445	50205	192.168.1.222	192.168.2.4
Dec 3, 2024 13:57:07.674536943 CET	50205	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:07.674618006 CET	50205	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:07.681651115 CET	445	50206	192.168.1.223	192.168.2.4
Dec 3, 2024 13:57:07.681721926 CET	50206	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:07.681757927 CET	445	50207	192.168.1.224	192.168.2.4
Dec 3, 2024 13:57:07.681871891 CET	50207	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:07.682699919 CET	445	50208	192.168.1.225	192.168.2.4
Dec 3, 2024 13:57:07.682792902 CET	50208	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:07.683016062 CET	445	50209	192.168.1.226	192.168.2.4
Dec 3, 2024 13:57:07.683064938 CET	50209	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:07.683809042 CET	445	50210	192.168.1.227	192.168.2.4
Dec 3, 2024 13:57:07.683859110 CET	50210	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:07.684108973 CET	445	50211	192.168.1.228	192.168.2.4
Dec 3, 2024 13:57:07.684149981 CET	50211	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:07.684461117 CET	445	50212	192.168.1.229	192.168.2.4
Dec 3, 2024 13:57:07.684593916 CET	445	50213	192.168.1.230	192.168.2.4
Dec 3, 2024 13:57:07.684681892 CET	50212	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:07.684770107 CET	445	50214	192.168.1.231	192.168.2.4
Dec 3, 2024 13:57:07.684801102 CET	50213	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:07.684823990 CET	50214	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:07.684916019 CET	445	50215	192.168.1.232	192.168.2.4
Dec 3, 2024 13:57:07.685028076 CET	50215	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:07.685030937 CET	50206	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:07.685132027 CET	445	50216	192.168.1.233	192.168.2.4
Dec 3, 2024 13:57:07.685197115 CET	50216	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:07.685273886 CET	50207	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:07.685285091 CET	445	50217	192.168.1.234	192.168.2.4
Dec 3, 2024 13:57:07.685403109 CET	50217	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:07.685741901 CET	445	50218	192.168.1.235	192.168.2.4
Dec 3, 2024 13:57:07.685816050 CET	50218	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:07.685841084 CET	50208	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:07.685987949 CET	445	50219	192.168.1.236	192.168.2.4
Dec 3, 2024 13:57:07.686038971 CET	50219	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:07.686067104 CET	50209	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:07.686167955 CET	50210	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:07.686362982 CET	50211	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:07.686496019 CET	50212	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:07.686604023 CET	445	50220	192.168.1.237	192.168.2.4
Dec 3, 2024 13:57:07.686645031 CET	445	50221	192.168.1.238	192.168.2.4
Dec 3, 2024 13:57:07.686669111 CET	50220	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:07.686697006 CET	50221	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:07.686780930 CET	445	50222	192.168.1.239	192.168.2.4
Dec 3, 2024 13:57:07.686911106 CET	50222	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:07.686935902 CET	445	50223	192.168.1.240	192.168.2.4
Dec 3, 2024 13:57:07.686950922 CET	50213	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:07.687076092 CET	50214	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:07.687097073 CET	50223	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:07.687103987 CET	445	50224	192.168.1.241	192.168.2.4
Dec 3, 2024 13:57:07.687155962 CET	50224	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:07.687278032 CET	445	50225	192.168.1.242	192.168.2.4
Dec 3, 2024 13:57:07.687330961 CET	50225	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:07.687333107 CET	50215	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:07.687439919 CET	445	50226	192.168.1.243	192.168.2.4
Dec 3, 2024 13:57:07.687494040 CET	50226	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:07.687596083 CET	50216	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:07.687725067 CET	50217	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:07.687824011 CET	50218	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:07.687879086 CET	445	50227	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:07.688040972 CET	50227	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:07.688143969 CET	50219	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:07.688246965 CET	50220	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:07.688308954 CET	50221	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:07.688476086 CET	445	50228	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:07.688499928 CET	50222	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:07.688533068 CET	50228	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:07.688716888 CET	50223	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:07.688863039 CET	50224	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:07.688950062 CET	50225	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:07.689141989 CET	50226	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:07.689145088 CET	50227	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:07.689219952 CET	50228	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:07.691262007 CET	445	50185	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:07.691337109 CET	445	50186	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:07.691369057 CET	445	50187	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:07.691675901 CET	445	50186	192.168.1.203	192.168.2.4
Dec 3, 2024 13:57:07.691725016 CET	50186	445	192.168.2.4	192.168.1.203
Dec 3, 2024 13:57:07.692063093 CET	445	50229	192.168.1.246	192.168.2.4
Dec 3, 2024 13:57:07.692085028 CET	445	50230	192.168.1.247	192.168.2.4
Dec 3, 2024 13:57:07.692145109 CET	50229	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:07.692220926 CET	50230	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:07.692235947 CET	445	50231	192.168.1.248	192.168.2.4
Dec 3, 2024 13:57:07.692249060 CET	445	50184	192.168.1.201	192.168.2.4
Dec 3, 2024 13:57:07.692257881 CET	445	50183	192.168.1.200	192.168.2.4
Dec 3, 2024 13:57:07.692276955 CET	445	50182	192.168.1.199	192.168.2.4
Dec 3, 2024 13:57:07.692287922 CET	445	50181	192.168.1.198	192.168.2.4
Dec 3, 2024 13:57:07.692296028 CET	445	50187	192.168.1.204	192.168.2.4
Dec 3, 2024 13:57:07.692297935 CET	50184	445	192.168.2.4	192.168.1.201
Dec 3, 2024 13:57:07.692298889 CET	50231	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:07.692327976 CET	50183	445	192.168.2.4	192.168.1.200
Dec 3, 2024 13:57:07.692337990 CET	50182	445	192.168.2.4	192.168.1.199
Dec 3, 2024 13:57:07.692365885 CET	50181	445	192.168.2.4	192.168.1.198
Dec 3, 2024 13:57:07.692378998 CET	50187	445	192.168.2.4	192.168.1.204
Dec 3, 2024 13:57:07.692517042 CET	50229	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:07.693120003 CET	50230	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:07.693252087 CET	50231	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:07.696147919 CET	445	50185	192.168.1.202	192.168.2.4
Dec 3, 2024 13:57:07.696157932 CET	445	50232	192.168.1.249	192.168.2.4
Dec 3, 2024 13:57:07.696199894 CET	445	50233	192.168.1.250	192.168.2.4
Dec 3, 2024 13:57:07.696209908 CET	445	50234	192.168.1.251	192.168.2.4
Dec 3, 2024 13:57:07.696219921 CET	445	50235	192.168.1.252	192.168.2.4
Dec 3, 2024 13:57:07.696233988 CET	50185	445	192.168.2.4	192.168.1.202
Dec 3, 2024 13:57:07.696243048 CET	445	50236	192.168.1.253	192.168.2.4
Dec 3, 2024 13:57:07.696268082 CET	445	50237	192.168.1.254	192.168.2.4
Dec 3, 2024 13:57:07.696281910 CET	50232	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:07.696299076 CET	50233	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:07.696301937 CET	50234	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:07.696335077 CET	50236	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:07.696340084 CET	50235	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:07.696369886 CET	50237	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:07.696451902 CET	50232	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:07.696631908 CET	50233	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:07.696726084 CET	50234	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:07.697026014 CET	50235	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:07.697110891 CET	50236	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:07.697185993 CET	50237	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:07.748162031 CET	445	50188	192.168.1.205	192.168.2.4
Dec 3, 2024 13:57:07.748245955 CET	50188	445	192.168.2.4	192.168.1.205
Dec 3, 2024 13:57:07.760679960 CET	445	50190	192.168.1.207	192.168.2.4
Dec 3, 2024 13:57:07.760746956 CET	50190	445	192.168.2.4	192.168.1.207
Dec 3, 2024 13:57:07.760962009 CET	445	50189	192.168.1.206	192.168.2.4
Dec 3, 2024 13:57:07.761040926 CET	50189	445	192.168.2.4	192.168.1.206
Dec 3, 2024 13:57:07.761202097 CET	445	50191	192.168.1.208	192.168.2.4
Dec 3, 2024 13:57:07.761212111 CET	445	50192	192.168.1.209	192.168.2.4
Dec 3, 2024 13:57:07.761220932 CET	445	50193	192.168.1.210	192.168.2.4
Dec 3, 2024 13:57:07.761270046 CET	50192	445	192.168.2.4	192.168.1.209
Dec 3, 2024 13:57:07.761279106 CET	50193	445	192.168.2.4	192.168.1.210
Dec 3, 2024 13:57:07.761308908 CET	50191	445	192.168.2.4	192.168.1.208
Dec 3, 2024 13:57:07.774390936 CET	445	50194	192.168.1.211	192.168.2.4
Dec 3, 2024 13:57:07.774739027 CET	445	50195	192.168.1.212	192.168.2.4
Dec 3, 2024 13:57:07.774796963 CET	50194	445	192.168.2.4	192.168.1.211
Dec 3, 2024 13:57:07.774816990 CET	50195	445	192.168.2.4	192.168.1.212
Dec 3, 2024 13:57:07.775007963 CET	445	50196	192.168.1.213	192.168.2.4
Dec 3, 2024 13:57:07.775058985 CET	50196	445	192.168.2.4	192.168.1.213
Dec 3, 2024 13:57:07.775155067 CET	445	50199	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:07.775202036 CET	445	50198	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:07.775211096 CET	445	50197	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:07.775342941 CET	445	50197	192.168.1.214	192.168.2.4
Dec 3, 2024 13:57:07.775604963 CET	445	50198	192.168.1.215	192.168.2.4
Dec 3, 2024 13:57:07.775650978 CET	50197	445	192.168.2.4	192.168.1.214
Dec 3, 2024 13:57:07.775660992 CET	50198	445	192.168.2.4	192.168.1.215
Dec 3, 2024 13:57:07.775724888 CET	445	50199	192.168.1.216	192.168.2.4
Dec 3, 2024 13:57:07.777405977 CET	50199	445	192.168.2.4	192.168.1.216
Dec 3, 2024 13:57:07.785823107 CET	445	50200	192.168.1.217	192.168.2.4
Dec 3, 2024 13:57:07.786403894 CET	50200	445	192.168.2.4	192.168.1.217
Dec 3, 2024 13:57:07.787322998 CET	445	50201	192.168.1.218	192.168.2.4
Dec 3, 2024 13:57:07.787379980 CET	50201	445	192.168.2.4	192.168.1.218
Dec 3, 2024 13:57:07.787437916 CET	445	50202	192.168.1.219	192.168.2.4
Dec 3, 2024 13:57:07.787486076 CET	50202	445	192.168.2.4	192.168.1.219
Dec 3, 2024 13:57:07.794373989 CET	445	50203	192.168.1.220	192.168.2.4
Dec 3, 2024 13:57:07.794781923 CET	445	50204	192.168.1.221	192.168.2.4
Dec 3, 2024 13:57:07.794843912 CET	50203	445	192.168.2.4	192.168.1.220
Dec 3, 2024 13:57:07.794859886 CET	50204	445	192.168.2.4	192.168.1.221
Dec 3, 2024 13:57:07.796282053 CET	445	50205	192.168.1.222	192.168.2.4
Dec 3, 2024 13:57:07.796358109 CET	50205	445	192.168.2.4	192.168.1.222
Dec 3, 2024 13:57:07.805856943 CET	445	50206	192.168.1.223	192.168.2.4
Dec 3, 2024 13:57:07.805917025 CET	50206	445	192.168.2.4	192.168.1.223
Dec 3, 2024 13:57:07.806164980 CET	445	50207	192.168.1.224	192.168.2.4
Dec 3, 2024 13:57:07.806216955 CET	50207	445	192.168.2.4	192.168.1.224
Dec 3, 2024 13:57:07.806416035 CET	445	50208	192.168.1.225	192.168.2.4
Dec 3, 2024 13:57:07.806554079 CET	50208	445	192.168.2.4	192.168.1.225
Dec 3, 2024 13:57:07.806710005 CET	445	50209	192.168.1.226	192.168.2.4
Dec 3, 2024 13:57:07.806757927 CET	50209	445	192.168.2.4	192.168.1.226
Dec 3, 2024 13:57:07.806759119 CET	445	50210	192.168.1.227	192.168.2.4
Dec 3, 2024 13:57:07.806813955 CET	50210	445	192.168.2.4	192.168.1.227
Dec 3, 2024 13:57:07.807187080 CET	445	50212	192.168.1.229	192.168.2.4
Dec 3, 2024 13:57:07.807197094 CET	445	50211	192.168.1.228	192.168.2.4
Dec 3, 2024 13:57:07.807208061 CET	445	50211	192.168.1.228	192.168.2.4
Dec 3, 2024 13:57:07.807260990 CET	445	50212	192.168.1.229	192.168.2.4
Dec 3, 2024 13:57:07.807307005 CET	50211	445	192.168.2.4	192.168.1.228
Dec 3, 2024 13:57:07.807329893 CET	50212	445	192.168.2.4	192.168.1.229
Dec 3, 2024 13:57:07.807663918 CET	445	50213	192.168.1.230	192.168.2.4
Dec 3, 2024 13:57:07.807693958 CET	445	50214	192.168.1.231	192.168.2.4
Dec 3, 2024 13:57:07.807724953 CET	50213	445	192.168.2.4	192.168.1.230
Dec 3, 2024 13:57:07.807755947 CET	50214	445	192.168.2.4	192.168.1.231
Dec 3, 2024 13:57:07.808073044 CET	445	50215	192.168.1.232	192.168.2.4
Dec 3, 2024 13:57:07.808118105 CET	50215	445	192.168.2.4	192.168.1.232
Dec 3, 2024 13:57:07.808144093 CET	445	50216	192.168.1.233	192.168.2.4
Dec 3, 2024 13:57:07.808223009 CET	50216	445	192.168.2.4	192.168.1.233
Dec 3, 2024 13:57:07.808615923 CET	445	50217	192.168.1.234	192.168.2.4
Dec 3, 2024 13:57:07.808625937 CET	445	50218	192.168.1.235	192.168.2.4
Dec 3, 2024 13:57:07.808671951 CET	50217	445	192.168.2.4	192.168.1.234
Dec 3, 2024 13:57:07.808685064 CET	50218	445	192.168.2.4	192.168.1.235
Dec 3, 2024 13:57:07.809084892 CET	445	50219	192.168.1.236	192.168.2.4
Dec 3, 2024 13:57:07.809129000 CET	445	50220	192.168.1.237	192.168.2.4
Dec 3, 2024 13:57:07.809130907 CET	50219	445	192.168.2.4	192.168.1.236
Dec 3, 2024 13:57:07.809247017 CET	445	50221	192.168.1.238	192.168.2.4
Dec 3, 2024 13:57:07.809326887 CET	445	50222	192.168.1.239	192.168.2.4
Dec 3, 2024 13:57:07.809329987 CET	50220	445	192.168.2.4	192.168.1.237
Dec 3, 2024 13:57:07.809335947 CET	50221	445	192.168.2.4	192.168.1.238
Dec 3, 2024 13:57:07.809467077 CET	50222	445	192.168.2.4	192.168.1.239
Dec 3, 2024 13:57:07.809670925 CET	445	50223	192.168.1.240	192.168.2.4
Dec 3, 2024 13:57:07.809716940 CET	50223	445	192.168.2.4	192.168.1.240
Dec 3, 2024 13:57:07.810338020 CET	445	50224	192.168.1.241	192.168.2.4
Dec 3, 2024 13:57:07.810386896 CET	50224	445	192.168.2.4	192.168.1.241
Dec 3, 2024 13:57:07.810606956 CET	445	50225	192.168.1.242	192.168.2.4
Dec 3, 2024 13:57:07.810657978 CET	50225	445	192.168.2.4	192.168.1.242
Dec 3, 2024 13:57:07.810992956 CET	445	50226	192.168.1.243	192.168.2.4
Dec 3, 2024 13:57:07.811041117 CET	50226	445	192.168.2.4	192.168.1.243
Dec 3, 2024 13:57:07.811167955 CET	445	50228	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:07.811186075 CET	445	50227	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:07.811295986 CET	445	50227	192.168.1.244	192.168.2.4
Dec 3, 2024 13:57:07.811395884 CET	50227	445	192.168.2.4	192.168.1.244
Dec 3, 2024 13:57:07.811482906 CET	445	50228	192.168.1.245	192.168.2.4
Dec 3, 2024 13:57:07.811527967 CET	50228	445	192.168.2.4	192.168.1.245
Dec 3, 2024 13:57:07.812819958 CET	445	50229	192.168.1.246	192.168.2.4
Dec 3, 2024 13:57:07.812865973 CET	50229	445	192.168.2.4	192.168.1.246
Dec 3, 2024 13:57:07.813172102 CET	445	50230	192.168.1.247	192.168.2.4
Dec 3, 2024 13:57:07.813225985 CET	50230	445	192.168.2.4	192.168.1.247
Dec 3, 2024 13:57:07.813313961 CET	445	50231	192.168.1.248	192.168.2.4
Dec 3, 2024 13:57:07.813359976 CET	50231	445	192.168.2.4	192.168.1.248
Dec 3, 2024 13:57:07.817018032 CET	445	50232	192.168.1.249	192.168.2.4
Dec 3, 2024 13:57:07.817121029 CET	50232	445	192.168.2.4	192.168.1.249
Dec 3, 2024 13:57:07.817372084 CET	445	50233	192.168.1.250	192.168.2.4
Dec 3, 2024 13:57:07.817419052 CET	50233	445	192.168.2.4	192.168.1.250
Dec 3, 2024 13:57:07.817682981 CET	445	50234	192.168.1.251	192.168.2.4
Dec 3, 2024 13:57:07.817966938 CET	50234	445	192.168.2.4	192.168.1.251
Dec 3, 2024 13:57:07.818018913 CET	445	50236	192.168.1.253	192.168.2.4
Dec 3, 2024 13:57:07.818062067 CET	50236	445	192.168.2.4	192.168.1.253
Dec 3, 2024 13:57:07.818327904 CET	445	50235	192.168.1.252	192.168.2.4
Dec 3, 2024 13:57:07.818372011 CET	50235	445	192.168.2.4	192.168.1.252
Dec 3, 2024 13:57:07.818454027 CET	445	50237	192.168.1.254	192.168.2.4
Dec 3, 2024 13:57:07.818500996 CET	50237	445	192.168.2.4	192.168.1.254
Dec 3, 2024 13:57:08.022732973 CET	50238	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:08.142851114 CET	445	50238	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:08.142966986 CET	50238	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:08.143044949 CET	50238	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:08.262959957 CET	445	50238	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:30.047559023 CET	445	50238	192.168.1.1	192.168.2.4
Dec 3, 2024 13:57:30.050435066 CET	50238	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:30.050483942 CET	50238	445	192.168.2.4	192.168.1.1
Dec 3, 2024 13:57:30.245117903 CET	50245	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:30.365163088 CET	445	50245	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:30.365272999 CET	50245	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:30.383202076 CET	50245	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:30.503190041 CET	445	50245	192.168.1.2	192.168.2.4
Dec 3, 2024 13:57:51.190926075 CET	50245	445	192.168.2.4	192.168.1.2
Dec 3, 2024 13:57:51.784800053 CET	50246	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:51.905961037 CET	445	50246	192.168.1.3	192.168.2.4
Dec 3, 2024 13:57:51.906115055 CET	50246	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:51.906183004 CET	50246	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:57:52.026776075 CET	445	50246	192.168.1.3	192.168.2.4
Dec 3, 2024 13:58:13.854738951 CET	445	50246	192.168.1.3	192.168.2.4
Dec 3, 2024 13:58:13.854856968 CET	50246	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:58:13.854952097 CET	50246	445	192.168.2.4	192.168.1.3
Dec 3, 2024 13:58:14.260318995 CET	50279	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:58:14.383296967 CET	445	50279	192.168.1.4	192.168.2.4
Dec 3, 2024 13:58:14.383433104 CET	50279	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:58:14.383474112 CET	50279	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:58:14.503511906 CET	445	50279	192.168.1.4	192.168.2.4
Dec 3, 2024 13:58:36.339097977 CET	445	50279	192.168.1.4	192.168.2.4
Dec 3, 2024 13:58:36.339165926 CET	50279	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:58:36.339222908 CET	50279	445	192.168.2.4	192.168.1.4
Dec 3, 2024 13:58:37.505820990 CET	50333	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:58:37.625827074 CET	445	50333	192.168.1.5	192.168.2.4
Dec 3, 2024 13:58:37.625956059 CET	50333	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:58:37.626007080 CET	50333	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:58:37.746192932 CET	445	50333	192.168.1.5	192.168.2.4
Dec 3, 2024 13:58:59.573724985 CET	445	50333	192.168.1.5	192.168.2.4
Dec 3, 2024 13:58:59.573798895 CET	50333	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:58:59.573924065 CET	50333	445	192.168.2.4	192.168.1.5
Dec 3, 2024 13:58:59.769057989 CET	50383	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:58:59.893445015 CET	445	50383	192.168.1.6	192.168.2.4
Dec 3, 2024 13:58:59.893520117 CET	50383	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:58:59.893593073 CET	50383	445	192.168.2.4	192.168.1.6
Dec 3, 2024 13:59:00.013675928 CET	445	50383	192.168.1.6	192.168.2.4

Target ID:	0
Start time:	07:57:04
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\uOsIQqfgiT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\uOsIQqfgiT.exe"
Imagebase:	0x7ff601980000
File size:	6'746'220 bytes
MD5 hash:	A12133B2AADD267558975A8952DAAC3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:57:05
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\uOsIQqfgiT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\uOsIQqfgiT.exe"
Imagebase:	0x7ff601980000
File size:	6'746'220 bytes
MD5 hash:	A12133B2AADD267558975A8952DAAC3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:57:07
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.1"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:57:07
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:57:07
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.1
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:57:29
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.2"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:57:29
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:57:29
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.2
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:57:50
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.3"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:57:50
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:57:51
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.3
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:58:13
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.4"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:58:13
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:58:13
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.4
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:58:36
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.5"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:58:36
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:58:36
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.5
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:58:59
Start date:	03/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "net view \\192.168.1.6"
Imagebase:	0x7ff7ecd80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	07:58:59
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	07:58:59
Start date:	03/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net view \\192.168.1.6
Imagebase:	0x7ff6ba170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF601981000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF601983905
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6019836FC
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF601983820
_MEIPASS2, xrefs: 00007FF6019836A2, 00007FF6019836AE, 00007FF6019839AC
Could not create temporary directory!, xrefs: 00007FF601983838
pyi-runtime-tmpdir, xrefs: 00007FF6019835D3
Failed to start splash screen!, xrefs: 00007FF601983933
pyi-disable-windowed-traceback, xrefs: 00007FF60198361D
pyi-contents-directory, xrefs: 00007FF6019835F8
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF601983A31
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF60198391A
MEI, xrefs: 00007FF60198374E
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF601983653
Failed to convert DLL search path!, xrefs: 00007FF6019838A3
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF601983A12
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6019837EF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF60198378C
pkg, xrefs: 00007FF6019837CF

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: a4d2e2bd269dc65f05cba5f8a1d023e47a8b511d1558fc25917fe28a704291c4
Instruction ID: 31d67e0877885e1a208ec70ad9ccd2fe2fd40374663ea2ef36dd29fa620c37df
Opcode Fuzzy Hash: a4d2e2bd269dc65f05cba5f8a1d023e47a8b511d1558fc25917fe28a704291c4
Instruction Fuzzy Hash: C9F17021F08682A2FB19EB21D5552F96351BF54B8CFA44032DA1EC76D7EFACE658C340

Function 00007FF6019A5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A59E9
Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5A67
Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5AB8

CreateFileW.KERNELBASE ref: 00007FF6019A5D7A
CreateFileW.KERNEL32 ref: 00007FF6019A5DCA
GetLastError.KERNEL32 ref: 00007FF6019A5DFA
GetFileType.KERNELBASE ref: 00007FF6019A5E0F
GetLastError.KERNEL32 ref: 00007FF6019A5E19
CloseHandle.KERNEL32 ref: 00007FF6019A5E4C
CloseHandle.KERNEL32 ref: 00007FF6019A5FAF
CreateFileW.KERNEL32 ref: 00007FF6019A5FE4
GetLastError.KERNEL32 ref: 00007FF6019A5FF3

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: fa80f79266c53877c03f04f03bd749ad33a8e4351d2a8f24ff2834dec2693a03
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 8AC1BF36F28A418AEB10CF69C4916AC3761FB49B98B614225DF2E97796CF38E459C340

Function 00007FF6019885A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6019885D3
FindClose.KERNELBASE ref: 00007FF6019885E2

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: c65aefb6f8dd6804c7a43148d0c6b8ddbe92fd8e1ee09a28082e863cc96e086a
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 9FF06822A2D64287F7608B60B4897667350FB4476CF540339D96E826D5DF7CE0598A04

Function 00007FF6019818F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6019876A0: _fread_nolock.LIBCMT ref: 00007FF60198774A

_fread_nolock.LIBCMT ref: 00007FF6019819B4

Part of subcall function 00007FF601982760: MessageBoxW.USER32 ref: 00007FF60198283B

Strings

fread, xrefs: 00007FF6019819C6, 00007FF601981ADB
malloc, xrefs: 00007FF601981AA8
Could not allocate buffer for TOC!, xrefs: 00007FF601981AA1
calloc, xrefs: 00007FF6019819F5
MEI, xrefs: 00007FF601981931
Error on file., xrefs: 00007FF601981B0A
Could not allocate memory for archive structure!, xrefs: 00007FF6019819EE
Failed to seek to cookie position!, xrefs: 00007FF601981989
fseek, xrefs: 00007FF601981990
Could not read full TOC!, xrefs: 00007FF601981AD4
Failed to read cookie!, xrefs: 00007FF6019819BF

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 7995a21b28b680851394af75eb53cd73354e47d861740444e0d3535187b21681
Instruction ID: c3a9e1b68bc027f7f38d962650654a4062ffb247846985f6bbbc2263d23a7ba3
Opcode Fuzzy Hash: 7995a21b28b680851394af75eb53cd73354e47d861740444e0d3535187b21681
Instruction Fuzzy Hash: 6F71A371F1D6868AEB60DB28E4506B923A0FF4478CF644035D98DC779BEEBCE5498B40

Function 00007FF6019815C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF60198165B
fread, xrefs: 00007FF60198178C
malloc, xrefs: 00007FF6019816F6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF601981785
fwrite, xrefs: 00007FF60198177C
fopen, xrefs: 00007FF60198161E
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6019816EF
Failed to create symbolic link %s!, xrefs: 00007FF6019815E2
Failed to extract %s: failed to open target file!, xrefs: 00007FF601981617
fseek, xrefs: 00007FF601981695
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF601981775
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF60198168E

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 83b3f49e488718fcbde5f422175789b2ebcd3d7843a3cf98154fcb537a0ed418
Instruction ID: 47697f187a0985f2d5cd703ccc29ae4a44b23ba95cbe00381693f4531e099d1d
Opcode Fuzzy Hash: 83b3f49e488718fcbde5f422175789b2ebcd3d7843a3cf98154fcb537a0ed418
Instruction Fuzzy Hash: 03519D61B0864397EB10AB15A9101B923A0BF44B9CFA44135EE1EC7A97EFBCE55A8340

Function 00007FF601987FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6019839C0), ref: 00007FF60198800A
GetStartupInfoW.KERNEL32(?,00007FF6019839C0), ref: 00007FF60198802B

Part of subcall function 00007FF60199978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019997A0

Part of subcall function 00007FF601997A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF601997A93

GetCommandLineW.KERNEL32(?,00007FF6019839C0), ref: 00007FF6019880CD
CreateProcessW.KERNELBASE ref: 00007FF60198810F
WaitForSingleObject.KERNEL32(?,00007FF6019839C0), ref: 00007FF601988123
GetExitCodeProcess.KERNEL32 ref: 00007FF601988133

Strings

CreateProcessW, xrefs: 00007FF601988146
Failed to create child process!, xrefs: 00007FF60198813F

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 302e8c6f806e337d4cdeefcf499dc71e80c95ba1319493d188bb966a644487f6
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 05413631A1878186EB209B64F4552AE73A1FFC5368FA00335E6AD877D6DF7CD0458B40

Function 00007FF6019811F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF601981229
malloc, xrefs: 00007FF60198129C, 00007FF6019812CA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6019813EE
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF601981295
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF601981256
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6019812C3

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 9f7725012da1cc34fce5d0bfb3ee6aec36ae4ef04eadb8e7a4371b04415525bd
Instruction ID: 53219271ab31fbcd02294e6e8de787daca4b390f6fa0d5ea727549af7d2fdfd4
Opcode Fuzzy Hash: 9f7725012da1cc34fce5d0bfb3ee6aec36ae4ef04eadb8e7a4371b04415525bd
Instruction Fuzzy Hash: 6A512862B086428AEB609B16E4503BA6291FF8479CF684135ED4EC7BD7EF7CE546C700

Function 00007FF601987C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF601983834), ref: 00007FF601987CE4
CreateDirectoryW.KERNELBASE(?,?,FFFFFFFF,00007FF601983834), ref: 00007FF601987D2C

Part of subcall function 00007FF601987E10: GetEnvironmentVariableW.KERNEL32(00007FF60198365F), ref: 00007FF601987E47
Part of subcall function 00007FF601987E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF601987E69

Part of subcall function 00007FF601997548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF601997561

Part of subcall function 00007FF6019826C0: MessageBoxW.USER32 ref: 00007FF601982736

Strings

_MEI%d, xrefs: 00007FF601987CF2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF601987D5E
TMP, xrefs: 00007FF601987C7C, 00007FF601987D83
LOADER: failed to set the TMP environment variable., xrefs: 00007FF601987CBC
TMP, xrefs: 00007FF601987CA2

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction ID: 770aa677eae2b03ac7db2d86f6faade231267a87c27e3dd3638b0d497637944e
Opcode Fuzzy Hash: e203fb9b2ed022230aea9b70073d79c64569b0fcacf7335b186391ffe1e7d089
Instruction Fuzzy Hash: 3541CF12B0964246EB28EBA599652F92291BF997CCFB00031ED0EC7797EE7CE5058340

Function 00007FF60199AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199B199

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction ID: 1800ea3d61b59c95ebfa28e2cf0f9669eb850a31d0d34cac452d486db1a5c8e4
Opcode Fuzzy Hash: 7e4b6968f21da67f115f2b5899b729ebe27c21aa0167ab1df282e77588440d71
Instruction Fuzzy Hash: EAC1F562A0C78799EB619B1DA4606BD3BA0FB91B88F750131DA5E83793DF7CE855C300

Function 00007FF601987B50 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF601987B70
OpenProcessToken.ADVAPI32 ref: 00007FF601987B83
GetTokenInformation.KERNELBASE ref: 00007FF601987BA8
GetLastError.KERNEL32 ref: 00007FF601987BB2
GetTokenInformation.KERNELBASE ref: 00007FF601987BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF601987C0E
CloseHandle.KERNEL32 ref: 00007FF601987C26

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
Instruction ID: b42ec899733cedb71c00de3f1e27f27b04f2cb3480b593c1dec78ce3d96d1fc7
Opcode Fuzzy Hash: fa100e685baa98e829519164d8c7bae0263b828ebdd9095db38f9558f9492d32
Instruction Fuzzy Hash: D1216531E0CA4242EB649B95E44422AB7A1FF857A8F740235DA6D83BDADFBCD4458740

Function 00007FF6019833E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF601983534), ref: 00007FF601983411

Part of subcall function 00007FF6019829E0: GetLastError.KERNEL32(?,?,?,00007FF60198342E,?,00007FF601983534), ref: 00007FF601982A14
Part of subcall function 00007FF6019829E0: FormatMessageW.KERNEL32(?,?,?,00007FF60198342E), ref: 00007FF601982A7D
Part of subcall function 00007FF6019829E0: MessageBoxW.USER32 ref: 00007FF601982ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6019834B8
\\?\, xrefs: 00007FF601983482
GetModuleFileNameW, xrefs: 00007FF601983422
Failed to obtain executable path., xrefs: 00007FF60198341B
Failed to resolve full path to executable %ls., xrefs: 00007FF601983461

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 238738a7f64b543bd1854d27a4d7db43bdf6576d023029b010963663ee2e269f
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: E3217161F1C54292FB219B34E8513B95250BF48B9CFE00136D65EC65E7EFACE609C740

Function 00007FF601988400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF601987B50: GetCurrentProcess.KERNEL32 ref: 00007FF601987B70
Part of subcall function 00007FF601987B50: OpenProcessToken.ADVAPI32 ref: 00007FF601987B83
Part of subcall function 00007FF601987B50: GetTokenInformation.KERNELBASE ref: 00007FF601987BA8
Part of subcall function 00007FF601987B50: GetLastError.KERNEL32 ref: 00007FF601987BB2
Part of subcall function 00007FF601987B50: GetTokenInformation.KERNELBASE ref: 00007FF601987BF2
Part of subcall function 00007FF601987B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF601987C0E
Part of subcall function 00007FF601987B50: CloseHandle.KERNEL32 ref: 00007FF601987C26

LocalFree.KERNEL32(?,00007FF601983814), ref: 00007FF60198848C
LocalFree.KERNEL32(?,00007FF601983814), ref: 00007FF601988495

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6019884A3
D:(A;;FA;;;%s), xrefs: 00007FF601988477
S-1-3-4, xrefs: 00007FF601988441
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF601988462

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
Instruction ID: 406689799e29da16512c119931ddcdf266d59bad07ea8a947407fd4e8327e2f9
Opcode Fuzzy Hash: 00508f9f8b173662f129ea82402565ecad2bd7bdcd40e7a91b5badc9791cb352
Instruction Fuzzy Hash: 98215E32A0864283F710AB60E5153EA62A5FF88788FA44035EA4E83B97DF7CE445C790

Function 00007FF60199C270 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60199C25B), ref: 00007FF60199C38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60199C25B), ref: 00007FF60199C417

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: dcf723217276f8708f467a911cad3f1a92ae613e89dd1bb58a676614ed188e70
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: CB918062F0865289F760DF6D98602BD2BA0FB54B8CF644139DE4EA7A86DF3CE445C701

Function 00007FF601994938 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601994965
CreateFileW.KERNELBASE ref: 00007FF6019949A4
CloseHandle.KERNEL32 ref: 00007FF6019949D9

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: fa02268210cfd61974545ced4fb4805f4bb47b76f372a724c5078c99da872f44
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 8B41B332D1878287F7558B6496203797360FBA57A8F209334EA9C83AD6DF7CA5E18700

Function 00007FF60198BF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60198C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF60198C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF60198BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF60198BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF60198C041

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: ba515f98196df9f4a0bc2d543ab1270b5116a564fddc4946c96a25abcf42ee7d
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 9C315D11E0D24747FF54AB68D4613F92391AF4278CFB40439EA4ECB6D3DEADB8498261

Function 00007FF60198F45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F597

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction ID: 1cfd8b9022c75d0f6cf2cf534b98af6f1d87ecbf0db28d160876dacbd76eca48
Opcode Fuzzy Hash: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction Fuzzy Hash: 8851DF62B0928247FB289E3A940467A6681FF84BBCF246735DE6DC37D7CE7CE4018610

Function 00007FF60199B444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF60199B5DD), ref: 00007FF60199B490
GetLastError.KERNEL32(?,?,?,?,?,00007FF60199B5DD), ref: 00007FF60199B49A

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 7d73874259a001ccb10885c85f4a5271d343e3893463a01ec352ceee2f80c508
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: A811C162B18A8185DB108B29B8541797361EB44FF8F684331EEBE877EACE7CD0508740

Function 00007FF601999C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C6E
GetLastError.KERNEL32(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C78

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: ead462954c4c73030430ae8a5163420fb59fb94d7e059af78dd8505d8cd57eac
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 2BE0C250F0968246FF196BFAAD650791291DF9874DFA04034DD0EC3253EE2C684A8350

Function 00007FF601999E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF601999CE5,?,?,00000000,00007FF601999D9A), ref: 00007FF601999ED6
GetLastError.KERNEL32(?,?,?,00007FF601999CE5,?,?,00000000,00007FF601999D9A), ref: 00007FF601999EE0

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: d34df2e48efc3452f0e5df32e7b6bf7a658cccf86feb7161fb0fc21d1bd0359f
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 4B21C321F1C64245FF9497E9A5A037D2291DF847ACF284239EA2EC73D3DE6CB4448300

Function 00007FF60199B1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199B1E4

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: a90415d2532884c7145b523cf42cfc14f63ba8942a897a5be1b6beee3e4a20f4
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: D741A0329082418BEB34DB1EB56167D73A0EBA6B88F240135DA9EC7692CF3DE502C751

Function 00007FF6019876A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF60198774A

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 860edb0a98c4a3dcae194fe5c8069401722b6002e6c93bb3a4d90fbb5ce1f995
Instruction ID: f80ca9ffc8ee126aded130388bde5074df4d85c7f05e6b10afbb6aa58b9bb519
Opcode Fuzzy Hash: 860edb0a98c4a3dcae194fe5c8069401722b6002e6c93bb3a4d90fbb5ce1f995
Instruction Fuzzy Hash: 5D218321B0865247FB14AA56A9147BAA651BF45BDCFB85430EE0D87787DEBDE041C700

Function 00007FF60199AC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199ACD2

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: 636483d5a1d679937a3f049ba5c7dd5094a054e089d837697ae213926eaa0186
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 5F31B021E186828AF712AB6D88613BD3650EF50BA9F610135EA1D873D3DFBCE442C710

Function 00007FF6019952A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601995209

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: a943b801aeeec6931d3b5436645e357af64ece70e9cf1be0c2c616aac641825c
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: E411C621A0C2414AFB629F59942117FA260FF55B88F650032FE4CC7A87CF3CD4418740

Function 00007FF6019A5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5687

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: d75ed149ef49bb9f974355263861c38543c63c611e155acc85ad3acbac3cfc51
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: EC21A772B18A8186EB618F19E44037977A0FB94B98F754234E65DC76EADF3CD405CB00

Function 00007FF60198F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F730

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: 15807b7beaf554d2474db0137832f37dd63ba843fc08efb4eb7af1437b55cebb
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: B501D621A0878241FB04EF669901079A695FF95FE8F685635DE6CD3BD7DE7CE5028300

Function 00007FF60199C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF60198FFB0,?,?,?,00007FF60199161A,?,?,?,?,?,00007FF601992E09), ref: 00007FF60199C94A

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 6e86393eb4b9e506eba96923b44f5867c931d4ed34100e6c398da64fa20a8990
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 1AF01C21F192878DFF6467BA5D713791280DF88BA8F694630ED6EC62C3DE2CB5818160

Non-executed Functions

Function 00007FF601986EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF601986EB7
GetProcAddress.KERNEL32 ref: 00007FF601986EFD
GetProcAddress.KERNEL32 ref: 00007FF601986F22
GetProcAddress.KERNEL32 ref: 00007FF601986F47
GetProcAddress.KERNEL32 ref: 00007FF601986F6F
GetProcAddress.KERNEL32 ref: 00007FF601986F97
GetProcAddress.KERNEL32 ref: 00007FF601986FBF
GetProcAddress.KERNEL32 ref: 00007FF601986FE7
GetProcAddress.KERNEL32 ref: 00007FF60198700F

Strings

Tcl_NewByteArrayObj, xrefs: 00007FF60198725D, 00007FF601987279
Tcl_SetVar2Ex, xrefs: 00007FF601987285, 00007FF6019872A1
Tcl_DoOneEvent, xrefs: 00007FF601986F3D, 00007FF601986F59
Tcl_ConditionNotify, xrefs: 00007FF6019870F5, 00007FF601987111
Tcl_GetString, xrefs: 00007FF60198720D, 00007FF601987229
Tcl_EvalObjv, xrefs: 00007FF601987325, 00007FF601987341
Tcl_Free, xrefs: 00007FF601987375, 00007FF601987391
Tcl_JoinThread, xrefs: 00007FF60198702D, 00007FF601987049
Tcl_GetCurrentThread, xrefs: 00007FF601987005, 00007FF601987021
Tcl_Alloc, xrefs: 00007FF60198734D, 00007FF601987369
Tcl_NewStringObj, xrefs: 00007FF601987235, 00007FF601987251
Tcl_ConditionWait, xrefs: 00007FF60198711D, 00007FF601987139
Tk_Init, xrefs: 00007FF60198739D, 00007FF6019873B9
Tcl_ThreadQueueEvent, xrefs: 00007FF601987145, 00007FF601987161
Tcl_CreateObjCommand, xrefs: 00007FF6019871E5, 00007FF601987201
Tcl_EvalEx, xrefs: 00007FF6019872FD, 00007FF601987319
Tcl_ThreadAlert, xrefs: 00007FF60198716D, 00007FF601987189
Tcl_FindExecutable, xrefs: 00007FF601986F18, 00007FF601986F34
Tcl_EvalFile, xrefs: 00007FF6019872D5, 00007FF6019872F1
Tcl_DeleteInterp, xrefs: 00007FF601986FB5, 00007FF601986FD1
Tcl_FinalizeThread, xrefs: 00007FF601986F8D, 00007FF601986FA9
Tk_GetNumMainWindows, xrefs: 00007FF6019873C5, 00007FF6019873E1
Tcl_MutexUnlock, xrefs: 00007FF60198707D, 00007FF601987099
Tcl_CreateInterp, xrefs: 00007FF601986EF3, 00007FF601986F0F
Tcl_SetVar2, xrefs: 00007FF6019871BD, 00007FF6019871D9
Tcl_Init, xrefs: 00007FF601986EB0, 00007FF601986EC9
Failed to get address for %hs, xrefs: 00007FF601986ED0
Tcl_CreateThread, xrefs: 00007FF601986FDD, 00007FF601986FF9
Tcl_Finalize, xrefs: 00007FF601986F65, 00007FF601986F81
Tcl_MutexFinalize, xrefs: 00007FF6019870A5, 00007FF6019870C1
Tcl_MutexLock, xrefs: 00007FF601987055, 00007FF601987071
Tcl_GetVar2, xrefs: 00007FF601987195, 00007FF6019871B1
Tcl_GetObjResult, xrefs: 00007FF6019872AD, 00007FF6019872C9
GetProcAddress, xrefs: 00007FF601986ED7
Tcl_ConditionFinalize, xrefs: 00007FF6019870CD, 00007FF6019870E9

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 2e32f421f49072c085b8fce648449bbf311131a53c922bf46f8893723b1fb276
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 65E19E64E4DB1392FB59DB84E8501B423A5BF0875CFF45436C88E866A6EFBCB55CC280

Function 00007FF6019A33BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6019A340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A3A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A3BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A3EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A40CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A4307
memcpy_s.LIBCPMT ref: 00007FF6019A43E2
memcpy_s.LIBCPMT ref: 00007FF6019A448D
memcpy_s.LIBCPMT ref: 00007FF6019A455C

Strings

1#SNAN, xrefs: 00007FF6019A351A
1#INF, xrefs: 00007FF6019A3533
1#IND, xrefs: 00007FF6019A34F7
1#QNAN, xrefs: 00007FF6019A3523

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: ba7bf1aef913f5b5fc7669acbce8ab1d5cb95dd3120302a6bed9da9571605891
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: 2BB20672F182828BE7648F69D4407FD37A1FB5474CFA45135DA0D97A86DF78AA08CB80

Function 00007FF6019879B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987A1B
RemoveDirectoryW.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987A9E
DeleteFileW.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987ABD
FindNextFileW.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987ACB
FindClose.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987ADC
RemoveDirectoryW.KERNEL32(?,00007FF601987EF9,00007FF6019839E6), ref: 00007FF601987AE5

Strings

%s\*, xrefs: 00007FF6019879E2

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 32433313b16baeb3e96caa2eadd980da9eb30861e2ed203a2a688d2141c9217f
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 8441C521A0C54292EB349BA4E4445B9B3A0FB94758FB40632D59EC3AD6DF7CE64AC740

Function 00007FF601989FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid bit length repeat, xrefs: 00007FF60198A3B9
invalid distances set, xrefs: 00007FF60198A4C0
invalid literal/lengths set, xrefs: 00007FF60198A453
invalid distance code, xrefs: 00007FF60198A8D4
invalid distance too far back, xrefs: 00007FF60198A990
invalid literal/length code, xrefs: 00007FF60198A702
too many length or distance symbols, xrefs: 00007FF60198A166
invalid code lengths set, xrefs: 00007FF60198A14D
invalid code -- missing end-of-block, xrefs: 00007FF60198A3E6

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: 3811d0360df11a704269967debc9267784993c123b3082e3e8a40e4ffa39cfa1
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: AA52E572A186A54BD7A48F14C458B7E3BE9FB84348F25413AE64AC7781DFBDE844CB40

Function 00007FF60198C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF60198C468
RtlCaptureContext.KERNEL32 ref: 00007FF60198C495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF60198C4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF60198C4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF60198C544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF60198C561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF60198C56C

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 5edd0aed1b4ff6ca8e71fad6fb70b648e2791f8f61f08dd63da0187537d9174b
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: 28314F72A09B8186EB609F64E8807FE7364FB94748F54403ADB4E87B96DF78D548C710

Function 00007FF6019829E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF60198342E,?,00007FF601983534), ref: 00007FF601982A14
FormatMessageW.KERNEL32(?,?,?,00007FF60198342E), ref: 00007FF601982A7D
MessageBoxW.USER32 ref: 00007FF601982ACF

Strings

%ls%ls: %ls, xrefs: 00007FF601982A96
Error, xrefs: 00007FF601982ABE
<FormatMessageW failed.>, xrefs: 00007FF601982A83

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: c8bb9e5dc0fb21794e7573175d5c5c24938bb13a6a711241d3c6a76c4ea6aba2
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 8A215872A18B8592E7309B10F4507EA7364FB88788F500136EBCE93A59DF7CD54AC740

Function 00007FF6019A4F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6019A4F55

Part of subcall function 00007FF6019A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A48BC

Part of subcall function 00007FF601999C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C6E
Part of subcall function 00007FF601999C58: GetLastError.KERNEL32(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C78

Part of subcall function 00007FF601999C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF601999BEF,?,?,?,?,?,00007FF601999ADA), ref: 00007FF601999C19
Part of subcall function 00007FF601999C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF601999BEF,?,?,?,?,?,00007FF601999ADA), ref: 00007FF601999C3E

_get_daylight.LIBCMT ref: 00007FF6019A4F44

Part of subcall function 00007FF6019A4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A491C

_get_daylight.LIBCMT ref: 00007FF6019A51BA
_get_daylight.LIBCMT ref: 00007FF6019A51CB
_get_daylight.LIBCMT ref: 00007FF6019A51DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6019A541C), ref: 00007FF6019A5203

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction ID: 0197d4474edc1b8290a7de1f8e48b3e50eaca28e6868b070e952fa1f58a9f227
Opcode Fuzzy Hash: 0d3b627969e88128c8faa99a2c0e5d438b7f33ec3044a67c5b643e0657b8cf50
Instruction Fuzzy Hash: 0CD1BF26F0825286FB20AF25D8501B967A1FF84B8CFA64035EA4DC7A97DF7CE445C780

Function 00007FF601999924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF60199999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6019999B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6019999F0
IsDebuggerPresent.KERNEL32 ref: 00007FF601999A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF601999A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF601999A3E

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 6075b5eddcdfc0c57060bbd7c979c415c9073ab48d7bc90f4264486e89538d81
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: FC315532A18B8186DB60CF29E8502EE77A4FB8475CF640136EA9D87B56DF3CD545C740

Function 00007FF6019A0B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A0BD0
FindFirstFileExW.KERNEL32 ref: 00007FF6019A0CDA

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction ID: 10da81e7b0daac7cfe162da71251ff328c04cf524da1b5b3dd856ea7334565bf
Opcode Fuzzy Hash: fe4d16d24a501c342f9bdefd2dbf7b3c8df5536519bece05b709b84cd6c1ed58
Instruction Fuzzy Hash: 49B1B422F1869281EB609B2594102BD63A0EB44BECFA85135FE5D97BC6DF3CF449C380

Function 00007FF6019A518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6019A51BA

Part of subcall function 00007FF6019A4908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A491C

_get_daylight.LIBCMT ref: 00007FF6019A51CB

Part of subcall function 00007FF6019A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A48BC

_get_daylight.LIBCMT ref: 00007FF6019A51DC

Part of subcall function 00007FF6019A48D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A48EC

Part of subcall function 00007FF601999C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C6E
Part of subcall function 00007FF601999C58: GetLastError.KERNEL32(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6019A541C), ref: 00007FF6019A5203

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction ID: 65b3164e97aba352c286a0588bc67f6328dda0cf26b2e562545496025d4f8ba9
Opcode Fuzzy Hash: ae64d4b013316384daf219013b3406c3cfe35626df30cbdeb691f729cbc9c9de
Instruction Fuzzy Hash: 51516D32F1864286F720DF25E8811A967A1FB8878CFA64535EA4DC7697DF3CE445C780

Function 00007FF60198C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF60198C35C
GetCurrentThreadId.KERNEL32 ref: 00007FF60198C36A
GetCurrentProcessId.KERNEL32 ref: 00007FF60198C376
QueryPerformanceCounter.KERNEL32 ref: 00007FF60198C386

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: fbfb0b69b2aad30f31eb35585059b6f906e5f3aaa97460ce1a35d65c49680c0a
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 27113C22B18F058AEB00CF60E8542B933B4FB59758F541E35DE6E86BA5DF7CD1988380

Function 00007FF6019A2F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6019A2F86
memcpy_s.LIBCPMT ref: 00007FF6019A2FB1

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 556619fee0ce22a4203ab50c23cb9ed2a73964c29e0a0b084ef0064debf1c3bb
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: DBC1E572F1C28687EB24CF59A04466AB7A1F794B88F948135DB4A83745DF3DF905CB80

Function 00007FF60198979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF601989C41
, xrefs: 00007FF60198987B
unknown header flags set, xrefs: 00007FF6019897E5

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: 5c2ce90824fa88fb810dfcc459d019f50707d9d5fcfd7a94bbce998f823ce9d6
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: 89F18172A183D68BE7A58B15C088B3E7AE9FF8474CF254538DA4987792CFB8E540C740

Function 00007FF6019A8A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6019A8C87
RaiseException.KERNEL32 ref: 00007FF6019A8C98

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: 4db772aefa3e220b869eaa3e4c79ba91dfc935863d57034bdc17edb856fc1cc6
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 71B15A73A04B898BEB55CF29C8463683BA0F744B4DF688921DB5D83BA5CF39D855C740

Function 00007FF601992CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF601993074
, xrefs: 00007FF601992E32

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: 8b5f37b0385aaf93c911db543a490f6c2b346b9e718745612b14d0b88ca8b341
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: F2E18032A086469AEB688F2DC1A017D33A0FF45B4CF345235DA4E87796DF3AE952C740

Function 00007FF6019895FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF601989769
incorrect header check, xrefs: 00007FF601989782

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: 01d04282da9bb04fd6e74249b799a6d550d6eb30953070ae92ae9c593ce34306
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: 1F916272A182C68BE7A58F14D498A7E3AA9FB8435CF254139DA4A877C1CF78E540CB40

Function 00007FF60199D200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF60199D38A
e+000, xrefs: 00007FF60199D30D

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: 150962f4c53c4e6fb79349473e698001ceb6c1b34c783caa64b17e73adfc5a13
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: 4D515762B1C2C54AE7248E79986176D6BD1F744B9CF689235CB9887AC2CE3DE444C700

Function 00007FF60199FBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction ID: 65eb6420a11872db8d97d9b4de0a049f18abc825add70edc17001ad9b65efac7
Opcode Fuzzy Hash: a8238ebacfbb29389201daedac3868d1c225100c6328c8ae619a1fe2ce119bc6
Instruction Fuzzy Hash: 8E02C221F1D69748FF61AB1998212B96A90EF51B9CF784639ED6DC73D3EE3CA4018340

Function 00007FF60199CD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF60199D0AE

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: ff0789821ffe4cd8d68436bdae9e26473a24f9272c291995c08d59accb544f36
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: 84A15863B087C58AEB21CF29A4607AD7B90EB64BC8F248132DE4D87786DE3DE505C701

Function 00007FF601997AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF601997ACB

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
Instruction ID: 672200d1bc4d40b5b4df9ec341607d074b161e84fe1c572aafffbb6160f03c84
Opcode Fuzzy Hash: 839a1a806d2b08c8b9ade1ed9786cb9cb8429efd2ac68b7f8e7a62dba0c63b20
Instruction Fuzzy Hash: F851CE11F1C68249FB68ABAA59611BA6291EF94BCCF784434DF0DC77C3EE3CE4468604

Function 00007FF6019A2790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6019A2794

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: 2c0766a57b33d403722e4e0a131c4b239b69a203eb7816de91f43b6e13748a95
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: 87B09220F07A86C2EB082B116C8621423A5BF88704FF58038C44D81321DE2C30A94700

Function 00007FF6019928C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: 8071b26ef6bab7bf48a11c0b6a1b5e41010a7cdb6d76417f38c55909892b71bd
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: 76D1AF36A09642AAEB788F2D956027D27A0FB56B8CF344235CE0D876D6DF3DE845C740

Function 00007FF601988B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: 79a4aaec7419620dda9415dc33baf0cf1de35389f30a11c9b54ca44da6a3fd8a
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: 5FC190722142F14FD289EB29E45957A73D1F79830DBE4402AEB8787B86CA3CE415D7A0

Function 00007FF601991F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: 6dce3c3983418c8330219e184632b47589ce5ec1cbfcb61dc9c53bf7ad0841af
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: 50B14976A08A8699EB698F2DC06423C3BA1F749B4CF384135DB4E87396CF3AE451C754

Function 00007FF60199D880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 1910c4036e263bc231363b489b698058b526a5d744110c848e237c31a7fe6d02
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: 7B81C472A0C7814AEB74CF5D94A137AA6D1FB4A798F244235DA8D87B9ACF3DD5408B00

Function 00007FF6019A5728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
Instruction ID: a78414cd0b0d602510b19b9f43643f17bbf1c52d23f2fc2e1511d6b5ae376113
Opcode Fuzzy Hash: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
Instruction Fuzzy Hash: 09610632F0C28286FB648A2C941067C6681EF81778FF64239DA5DC76D7DE7DE8088781

Function 00007FF601990C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: f1b2ce7802b281d7c7f457979a41d5c729bdedd9b83fd4dac6ba9573bfe958e6
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 5B518E76A187518AEB248B2DC06023C37A4EB55B6CF384131EE5D87796DF3AEC42C780

Function 00007FF601991484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 6a28389f774ae1d5a7b5f36b9fb52af736afec98b129af9ffdd389575a7e318d
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: E9516476A186528AE7248B2DC05423837A0FB59F7CF394135DA4D977A6CF3AE852C780

Function 00007FF601991074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: d8b2b94164af5aa4a63ee1164dc4888c0695ee86b39b8df86a8ba29899165e6e
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 34515076B186528AE7248B2DD06423837A1FB55B7CF344131CE8D97796CF7AE842C740

Function 00007FF601990A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 631a73354a35c07f88a06b28e451880f5ba9e303a99cfde5a53a02c6203eb809
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: C4518136A196518AEB248F2DC06423837A5EB44F5CF384131EE5D97796DF3AE843C780

Function 00007FF601991280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: d98e7c5285b46bde5873fd8df64a5ff0ff752ce8ffaecb37d5c2129db6d1922a
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 80516276A186528AE7258B2DC06023C27A1FB59F6CF744131CE4D9B79ACF3AE843C740

Function 00007FF601990E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: b0b5038b40435791d2f065efe62f27b02a491141e32a6885fd24c0a8c2d1d5a4
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 1F518136A186568AE7248B2DC06023C37A5EB58F6CF384131EE5D97796CF3AE952C740

Function 00007FF601995040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 0293c6141659fea2b9eba838379f938f044c3ff49bc4f92e0702efc6ac36b78a
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 0141B792D4974A0EFB67891C45346B62680FF12BA8D7A52B2DDDDD33C7CD0DA9868140

Function 00007FF6019991B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction ID: 811911fddff670ab5c7d9850043e03533c275283278eea924c3caa2231d0f887
Opcode Fuzzy Hash: 8d7eb27f456b44a91f9c68f162ea9965681a4a0d7ad24d9c24e3bfc258020ebf
Instruction Fuzzy Hash: E541F672718A5586EF04CF2ADA641B973A5FB48FD8B59903ADE0ED7B59DE3CD0418300

Function 00007FF6019973F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
Instruction ID: d0ba285286e8a907d6d1f63bc68243109cd12ad70e090d0c80c0d75c1ccadb61
Opcode Fuzzy Hash: d47bd74fb6a019277da3c6b3819bfc69269ba7720235d09fb044e88388ffaf66
Instruction Fuzzy Hash: 0731E532B18B8245E7289F69699017E7AD5EB84BE4F244238EA4DD3BD7DF3CD0124B04

Function 00007FF6019A8880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: 90d4d9b16a6da79b53e5d3061bc0ea949bb22f37135e364cabcb09bb2f97a7cb
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: 1CF06271B182958EEBA49F6DA80262977D0F758388F908439E6CDC3F04DA7D90608F04

Function 00007FF60198C62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: a49402eee52921ab406ba8d0d7c798f73237c3de9de9f972b427074a14d2a6f0
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: 1FA00221D1CC27E1E7488F04F8501B53330FB6031CBA11032D40EC10A29F7CB404C360

Function 00007FF6019850B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF6019850C0
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF601985101
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF601985126
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF60198514B
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF601985173
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF60198519B
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF6019851C3
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF6019851EB
GetProcAddress.KERNEL32(?,00007FF601985C57,?,00007FF60198308E), ref: 00007FF601985213

Strings

PyStatus_Exception, xrefs: 00007FF601985619, 00007FF601985635
PyConfig_SetBytesString, xrefs: 00007FF601985259, 00007FF601985275
Py_PreInitialize, xrefs: 00007FF6019851B9, 00007FF6019851D5
PyObject_Str, xrefs: 00007FF6019855A1, 00007FF6019855BD
PySys_SetObject, xrefs: 00007FF601985669, 00007FF601985685
PyConfig_SetString, xrefs: 00007FF601985281, 00007FF60198529D
PyConfig_SetWideStringList, xrefs: 00007FF6019852A9, 00007FF6019852C5
Py_DecodeLocale, xrefs: 00007FF6019850F7, 00007FF601985113
PyConfig_InitIsolatedConfig, xrefs: 00007FF601985209, 00007FF601985225
PyUnicode_AsUTF8, xrefs: 00007FF601985691, 00007FF6019856AD
PyUnicode_FromFormat, xrefs: 00007FF601985709, 00007FF601985725
PySys_GetObject, xrefs: 00007FF601985641, 00007FF60198565D
PyUnicode_DecodeFSDefault, xrefs: 00007FF6019856E1, 00007FF6019856FD
PyList_Append, xrefs: 00007FF601985461, 00007FF60198547D
Py_DecRef, xrefs: 00007FF6019850B6, 00007FF6019850D2
PyErr_Restore, xrefs: 00007FF601985399, 00007FF6019853B5
PyConfig_Clear, xrefs: 00007FF6019851E1, 00007FF6019851FD
PyErr_Fetch, xrefs: 00007FF6019852F9, 00007FF601985315
Py_ExitStatusException, xrefs: 00007FF60198511C, 00007FF601985138
PyObject_SetAttrString, xrefs: 00007FF601985579, 00007FF601985595
PyObject_GetAttrString, xrefs: 00007FF601985551, 00007FF60198556D
PyModule_GetDict, xrefs: 00007FF6019854D9, 00007FF6019854F5
Py_InitializeFromConfig, xrefs: 00007FF601985169, 00007FF601985185
PyEval_EvalCode, xrefs: 00007FF6019853C1, 00007FF6019853DD
PyErr_Clear, xrefs: 00007FF6019852D1, 00007FF6019852ED
PyUnicode_Decode, xrefs: 00007FF6019856B9, 00007FF6019856D5
Py_Finalize, xrefs: 00007FF601985141, 00007FF60198515D
PyImport_ImportModule, xrefs: 00007FF601985439, 00007FF601985455
PyErr_NormalizeException, xrefs: 00007FF601985321, 00007FF60198533D
PyConfig_Read, xrefs: 00007FF601985231, 00007FF60198524D
PyUnicode_Join, xrefs: 00007FF601985759, 00007FF601985775
Failed to get address for %hs, xrefs: 00007FF6019850D9
PyImport_ExecCodeModule, xrefs: 00007FF601985411, 00007FF60198542D
PyUnicode_Replace, xrefs: 00007FF601985781, 00007FF60198579D
PyMem_RawFree, xrefs: 00007FF6019854B1, 00007FF6019854CD
PyErr_Print, xrefs: 00007FF601985371, 00007FF60198538D
PyUnicode_FromString, xrefs: 00007FF601985731, 00007FF60198574D
PyRun_SimpleStringFlags, xrefs: 00007FF6019855F1, 00007FF60198560D
PyObject_CallFunction, xrefs: 00007FF601985501, 00007FF60198551D
PyImport_AddModule, xrefs: 00007FF6019853E9, 00007FF601985405
GetProcAddress, xrefs: 00007FF6019850E0
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6019855C9, 00007FF6019855E5
PyMarshal_ReadObjectFromString, xrefs: 00007FF601985489, 00007FF6019854A5
PyErr_Occurred, xrefs: 00007FF601985349, 00007FF601985365
PyObject_CallFunctionObjArgs, xrefs: 00007FF601985529, 00007FF601985545
Py_IsInitialized, xrefs: 00007FF601985191, 00007FF6019851AD

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: ec4eb242ac9abaa0dc2b5972c917c09cff95225049d1edde387e974c37c0bd87
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 1D12A164E4EB0392FB59DB44A8101B427A1BF0875CBF56536C84ED63A6EFBCB54C8381

Function 00007FF6019877D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF601987C97,?,?,FFFFFFFF,00007FF601983834), ref: 00007FF60198782C

Part of subcall function 00007FF6019826C0: MessageBoxW.USER32 ref: 00007FF601982736

Strings

\, xrefs: 00007FF601987861
%.*s, xrefs: 00007FF60198790C
CreateDirectory, xrefs: 00007FF601987974
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF60198789D
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF60198796D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6019878D9
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF601987803
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF601987840

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction ID: b6fd99a6f930dc2fcb10327bce7d0b070ea8baff37fef64b155a9b9b2b15e1e1
Opcode Fuzzy Hash: 9eab8ee9825a9fbd44869a095635737d99e10a8ea38952c2113d32bd4c9397e1
Instruction Fuzzy Hash: D7419121F2C64282FB64AB64E8516BA72A1EF9478CFB45031D64EC2697EEBDE104C740

Function 00007FF6019820F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF60198211B
SelectObject.GDI32 ref: 00007FF601982162
DrawTextW.USER32 ref: 00007FF601982185
SelectObject.GDI32 ref: 00007FF60198219B
ReleaseDC.USER32 ref: 00007FF6019821AB
MoveWindow.USER32 ref: 00007FF6019821FB
MoveWindow.USER32 ref: 00007FF60198223B
MoveWindow.USER32 ref: 00007FF60198228E
MoveWindow.USER32 ref: 00007FF6019822D6

Strings

P%, xrefs: 00007FF60198216F

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: dd595529030df01d5962ab3c711654333251f2b2931d7ff68747fd81ddd360a0
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: C151E426618BA187D7249F22A4181BAB7A1FB98B65F104135EBDF83695DF3CD085CB10

Function 00007FF6019955A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019955E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019959D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601995C6C

Strings

-, xrefs: 00007FF601995679
f, xrefs: 00007FF601995705
p, xrefs: 00007FF601995695
p, xrefs: 00007FF60199570D
:, xrefs: 00007FF60199579C

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 3eb178ad5dbae18677c168d7e35b77942c2351d32c68d4a1f43d7310dd0a0ec0
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: C1129072E082438EFB269B1DE16427B7691FB40758FE54137E689866C6DF3CE980CB04

Function 00007FF6019902E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601990328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019906F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199098F

Strings

f, xrefs: 00007FF6019903C0
f, xrefs: 00007FF60199042A
f, xrefs: 00007FF601990575
p, xrefs: 00007FF601990432
p, xrefs: 00007FF6019903CD

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: 098fbd19f382b4396cbf98957524c58767e87eda1823548b710af2f22e4c4317
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 2C12A322E0C1438AFB209A19E4347BD7659FB9075CFAC4131F6AA866C6DF3DE4809B51

Function 00007FF601981050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF601981097
fread, xrefs: 00007FF6019811D7
malloc, xrefs: 00007FF6019810FC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6019811D0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6019810F5
fseek, xrefs: 00007FF6019810CC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6019810C5

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 21670e8be07f4d3c41a0d27b627399655949914c076fce2691a27ab6a124ec9b
Instruction ID: b54e115f6211c670a4de462fb97b61a31bf4ab84f4ea22c6c9f010401a980634
Opcode Fuzzy Hash: 21670e8be07f4d3c41a0d27b627399655949914c076fce2691a27ab6a124ec9b
Instruction Fuzzy Hash: DF418121B086464BEB249B16A8506BAA791FF44BCCF644431DD4EC7B97EEBCF5468340

Function 00007FF601981440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF60198146F
fread, xrefs: 00007FF6019815A1
malloc, xrefs: 00007FF6019814E0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF60198159A
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6019814D9
fseek, xrefs: 00007FF6019814B0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6019814A9

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: eb6e7e1dd3e24fdb318a3ad910b5f024407936da2ff08f8a020494da6f53a5d2
Instruction ID: 2d8743a836de98e0938188987db3ded58b84fffdd3414772b94c64e5e02808b1
Opcode Fuzzy Hash: eb6e7e1dd3e24fdb318a3ad910b5f024407936da2ff08f8a020494da6f53a5d2
Instruction Fuzzy Hash: 9B417822B0864347EB249B19E4515B56390FF44BDCF684431DE4EC7A97EEBCE5468740

Function 00007FF60198DD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF60198DD85

Part of subcall function 00007FF60198ECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF60198ED1F
Part of subcall function 00007FF60198ECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF60198ED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF60198DE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF60198E0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF60198E1B8

Strings

csm, xrefs: 00007FF60198DE06
csm, xrefs: 00007FF60198DE80
csm, xrefs: 00007FF60198DD9F

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: b87bcbe57589e67d9e493f338ac7eb083ea8fdccfc4484019991af15be802405
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: F3D14932A087418BEB209F65E4503AD77A0FB55B9CF204235EA8D97B9BDF78E491C740

Function 00007FF60199E020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF60199E3BA,?,?,00000206433969F8,00007FF60199A063,?,?,?,00007FF601999F5A,?,?,?,00007FF60199524E), ref: 00007FF60199E19C
GetProcAddress.KERNEL32(?,?,?,00007FF60199E3BA,?,?,00000206433969F8,00007FF60199A063,?,?,?,00007FF601999F5A,?,?,?,00007FF60199524E), ref: 00007FF60199E1A8

Strings

ext-ms-, xrefs: 00007FF60199E0F9
api-ms-, xrefs: 00007FF60199E0E6

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: 5f18059aa2c27b5ecaa338ade4384ab384802792809e39fd7a83fdf381afb397
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: FD413A71B19A0286FB26CB1AAD146B52392FF49B98F684135DD0DC7786EF3CE449C340

Function 00007FF60198CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF60198D29A,?,?,?,00007FF60198CF8C,?,?,?,00007FF60198CB89), ref: 00007FF60198D06D
GetLastError.KERNEL32(?,?,?,00007FF60198D29A,?,?,?,00007FF60198CF8C,?,?,?,00007FF60198CB89), ref: 00007FF60198D07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF60198D29A,?,?,?,00007FF60198CF8C,?,?,?,00007FF60198CB89), ref: 00007FF60198D0A5
FreeLibrary.KERNEL32(?,?,?,00007FF60198D29A,?,?,?,00007FF60198CF8C,?,?,?,00007FF60198CB89), ref: 00007FF60198D113
GetProcAddress.KERNEL32(?,?,?,00007FF60198D29A,?,?,?,00007FF60198CF8C,?,?,?,00007FF60198CB89), ref: 00007FF60198D11F

Strings

api-ms-, xrefs: 00007FF60198D08D

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 2950a266d540ba2964424ff6e38caeaf950997498296a0e355db73a225f122e5
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 2D31A421A1AA4286EF159F96A40067563D4FF04BA8F790635DD1DC73C6EF7CE4478700

Function 00007FF60199A460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF60199A46F
FlsGetValue.KERNEL32 ref: 00007FF60199A484
FlsSetValue.KERNEL32 ref: 00007FF60199A4A5
FlsSetValue.KERNEL32 ref: 00007FF60199A4D2
FlsSetValue.KERNEL32 ref: 00007FF60199A4E3
FlsSetValue.KERNEL32 ref: 00007FF60199A4F4
SetLastError.KERNEL32 ref: 00007FF60199A50F

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction ID: 85ba3a9c978782c9fde33e25a8c2f89b27cc56e626adb3960af9cea226ff765b
Opcode Fuzzy Hash: 67217a7fc91f5e25160bb9a3b2c8204a3bd01eab0ccbfeeabb81ecf6e12f005c
Instruction Fuzzy Hash: E8214C20F0C2424AFB64A33996A617D6286DF48BBCF744734D93E87AD7EE2CB4414701

Function 00007FF6019A707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6019A70AD
GetLastError.KERNEL32 ref: 00007FF6019A70B9
CloseHandle.KERNEL32 ref: 00007FF6019A70D1
CreateFileW.KERNEL32 ref: 00007FF6019A70FC
WriteConsoleW.KERNEL32 ref: 00007FF6019A711B

Strings

CONOUT$, xrefs: 00007FF6019A70DD

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 95437e69f0451336b6b056d25991bf25e63fb5ca79262943d7eb8e18b24e5811
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: 9D11B621F18B4186E7508B52E89532977A4FB98FE8F604234EA1EC7795DF3CE808C780

Function 00007FF6019881F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF60198821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF60198827A

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF601988305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF601988364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF601988375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6019839F2), ref: 00007FF60198838A

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
Instruction ID: 8e2108d428e001d203feb53fc0cbf4b87b0fc775c1545ef2638a40a8e132a74d
Opcode Fuzzy Hash: 9b5c0b85d41d77bb9b541fba6b9840375d9a6616c292d566ae331ce4538faf90
Instruction Fuzzy Hash: C341A262A1968282EB309B12E5102BA73A4FF85BC8F944135DF5D9779BDE7CE501C710

Function 00007FF60199A5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A61D
FlsSetValue.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A64A
FlsSetValue.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A65B
FlsSetValue.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A66C
SetLastError.KERNEL32(?,?,?,00007FF6019943FD,?,?,?,?,00007FF60199979A,?,?,?,?,00007FF60199649F), ref: 00007FF60199A687

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction ID: b952bb6d8d2ba2f1c0346df48f6863fa81e833ee63d01661b57691661c0a4225
Opcode Fuzzy Hash: ef20b32075126869ce53cf62fbcb139ef3f5263cb698c8c2b5617054fce20239
Instruction Fuzzy Hash: 84116D20E0C2424AFB54A7399AA517D2296DF887BCF348734D83ED76D7EE2CB4418741

Function 00007FF601982300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF601982338
DialogBoxIndirectParamW.USER32 ref: 00007FF6019823FE
DeleteObject.GDI32 ref: 00007FF601982431
DestroyIcon.USER32 ref: 00007FF601982443

Strings

Unhandled exception in script, xrefs: 00007FF601982368

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction ID: 3d49d85b9dddff1bbedc4e562ee97ba959eeefcde73b608e61fa106b5198ed60
Opcode Fuzzy Hash: 2f02a126994589ece2bf0b221661227d336c2ada993d2ff489732679099e34b6
Instruction Fuzzy Hash: 95314776A1968289EB20DF65E8652F97360FF8978CFA40135EA4E87B5ADF3CD105C700

Function 00007FF601982760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

MessageBoxW.USER32 ref: 00007FF60198283B
MessageBoxA.USER32 ref: 00007FF60198284F

Strings

Error, xrefs: 00007FF60198282C
Error/warning (ANSI fallback), xrefs: 00007FF601982843
%s%s: %s, xrefs: 00007FF6019827EC

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: c25ea0eba43986d6ec15711f9a595d8ca26a5411ec38f7de9cfb7c81fe8f8152
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 81218372A28AC592E720DB14F4517EA6364FF8478CF900036EA8D8369ADF7CD649C740

Function 00007FF601998DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF601998DC5
GetProcAddress.KERNEL32 ref: 00007FF601998DDB
FreeLibrary.KERNEL32 ref: 00007FF601998E02

Strings

mscoree.dll, xrefs: 00007FF601998DBC
CorExitProcess, xrefs: 00007FF601998DD4

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: 103379985a1f138d5d7ef06a7f997b4d2970367811b0d5422b154a78a040cc07
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 0EF09621B1970681EF108B24E4943796360EF45B69FB40639C96EC61F5CF3CE149C740

Function 00007FF6019A8678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6019A86A0
_set_statfp.LIBCMT ref: 00007FF6019A86BB
_set_statfp.LIBCMT ref: 00007FF6019A86D7
_set_statfp.LIBCMT ref: 00007FF6019A8713

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 6c0df083620e9a70606141be74e5af3b2a5b093033d351fd7ca76744a22d5172
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 3F11C632E6CA0341F7542128D45537515606F5437EFF50634EABEC67E7CE2CA85D81D0

Function 00007FF60199A6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6019998B3,?,?,00000000,00007FF601999B4E,?,?,?,?,?,00007FF601999ADA), ref: 00007FF60199A6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6019998B3,?,?,00000000,00007FF601999B4E,?,?,?,?,?,00007FF601999ADA), ref: 00007FF60199A6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6019998B3,?,?,00000000,00007FF601999B4E,?,?,?,?,?,00007FF601999ADA), ref: 00007FF60199A706
FlsSetValue.KERNEL32(?,?,?,00007FF6019998B3,?,?,00000000,00007FF601999B4E,?,?,?,?,?,00007FF601999ADA), ref: 00007FF60199A717
FlsSetValue.KERNEL32(?,?,?,00007FF6019998B3,?,?,00000000,00007FF601999B4E,?,?,?,?,?,00007FF601999ADA), ref: 00007FF60199A728

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction ID: 5041d9f12d544ba24b5a02c7fa461a4ce97ce9f161993ba85e43c74b3c69aabd
Opcode Fuzzy Hash: f2276611a630934bbdb354ef1537d91ff3ed6de03a5f5a99dae5237b5b9f36a7
Instruction Fuzzy Hash: B6114220E0C2424AFB54932996A21BD2196DF993A8F344334D83E976D7EE2CB4414701

Function 00007FF60199A534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF60199A545
FlsSetValue.KERNEL32 ref: 00007FF60199A564
FlsSetValue.KERNEL32 ref: 00007FF60199A58C
FlsSetValue.KERNEL32 ref: 00007FF60199A59D
FlsSetValue.KERNEL32 ref: 00007FF60199A5AE

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction ID: adcc06274111d30f77488ebb120a19d9598847399740638343d9aeefc6000d3c
Opcode Fuzzy Hash: a5817a23bb51f76ee1afbfff857c957b5c6e4c237a472a6b6273a3da914e048f
Instruction Fuzzy Hash: 6511E820F082074AFB68A23959721BD2285DF4937CE784738D93E9A2D3EE2DB4418202

Function 00007FF6019952B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019952EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF601995416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019954CC

Strings

verbose, xrefs: 00007FF6019952C0

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 25f73bbb7d7cde58761a8578611adb96c5092c3eb0b136e2780448339db71e07
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 1091BE22A09A4689F7629E29D46137E3391EB00B9CFAA4137DA5DC73D7DE3CE4458301

Function 00007FF60199EED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199F1B7

Part of subcall function 00007FF601996D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF601996D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF60199F155
ccs, xrefs: 00007FF60199F0F2
UTF-8, xrefs: 00007FF60199F136

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: faf1363d21a1dc6348e6383bb618bde9a20d6d25a0cf8aacf6dbe635b933b8d0
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 8D818D72E082438DFB748F2DC564278AEA4EB12B4CF758035DA09D729BDF2DE9819741

Function 00007FF60198C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF60198C993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF60198CA2A
RtlUnwindEx.KERNEL32 ref: 00007FF60198CA84

Strings

csm, xrefs: 00007FF60198CA11

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: 8546d3e6c3b30ab2bcab7a6a96e9068c3a7172e6ff5cd6dfe4f9b42ddef6d611
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 2C519132B19A428BDB14CF15E444AB9B791FB44B9CF608131EA4E8778ADFBDE841C710

Function 00007FF60198E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF60198E257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF60198E2A3

Strings

RCC, xrefs: 00007FF60198E273
MOC, xrefs: 00007FF60198E26B

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 4b87cd830410ff25e29bc7e0383be9c1f2800082160d7e58c83927887b3ac580
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: 9F618632908BC586D771DB25E4407AAB7A0FB85B98F144235EB9C47B96DFBCE194CB00

Function 00007FF60198E5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF60198E5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF60198E6B8

Strings

csm, xrefs: 00007FF60198E70A
csm, xrefs: 00007FF60198E5F2

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 1d1309f9f03367df42f5b80cccbf7844525298b11bd625b1b5d362b2cfaf7293
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 02517D36A086868BEB749F21906437877A0EB55B9CF244136DA5D87BD6CFBCE450CB01

Function 00007FF601987530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF60198324C,?,?,00007FF601983964), ref: 00007FF601987642

Strings

%s%c, xrefs: 00007FF6019875B4
\, xrefs: 00007FF6019875A7
%.*s, xrefs: 00007FF6019875FB

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction ID: 32944fc739dbeee09df9bf7165f987d4a540bf3df79ac030fd001fef38afd102
Opcode Fuzzy Hash: 7bb6789f982dd078021ca405e37f28ebc21f271831f10c16ba6710f0d2331ec5
Instruction Fuzzy Hash: D331C821A19AC556EB219B25E4107EA7254FF44BE8F644231EE6E83BCADF6CD2058700

Function 00007FF6019825F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

MessageBoxW.USER32 ref: 00007FF601982686
MessageBoxA.USER32 ref: 00007FF60198269A

Strings

Error, xrefs: 00007FF601982677
Error/warning (ANSI fallback), xrefs: 00007FF60198268E

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: e2922dd0cc00a38b8ce76b232574d6f81208ed2cb33104149179f79a75e3a2a7
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: B8119172A28B8592FB209B10F451BE93364FF44B8CFA05136DA4E97656DF7CD609C740

Function 00007FF601982870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

MessageBoxW.USER32 ref: 00007FF601982906
MessageBoxA.USER32 ref: 00007FF60198291A

Strings

Warning, xrefs: 00007FF6019828F7
Error/warning (ANSI fallback), xrefs: 00007FF60198290E

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 7de5f1758394f51a9c162ad000d7fa3e2a6b8ef88dc4bf4a0625580df8689017
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: EE11BF72A28B8592FB208B10F451BA93364FF44B8CFA01135DA8E87646DF7CD609C740

Function 00007FF60199B8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF60199B92F
WriteFile.KERNEL32 ref: 00007FF60199BBF7
WriteFile.KERNEL32 ref: 00007FF60199BC3D
GetLastError.KERNEL32 ref: 00007FF60199BCF3

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 88f89d0a3e7edde64e89a5e9dfca28ac2c116fef208963f5a27900c330276a8f
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: B6D1CE72B18A818EE711CF69E4506AC3BB1FB4479CB244236CE5E97B9ADE3CD516C300

Function 00007FF60199EC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF60199ED8C
_get_daylight.LIBCMT ref: 00007FF60199ED9D
_get_daylight.LIBCMT ref: 00007FF60199EDAE
_isindst.LIBCMT ref: 00007FF60199EE79

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: 8605f8c8c667c5a79d64d5f3868f4dd8f119f4e9db9c525be3d1b27c7c552527
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: F651E672F042158EFB24DFA899656BC27A5EB1435DF640139EE1E93AE6DF38B402C700

Function 00007FF601994A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF601994ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF601994B21
GetLastError.KERNEL32 ref: 00007FF601994BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6019949C4), ref: 00007FF601994BFE

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 443b014cc74db05ebfed79b6f7045c88c9b3756918f236b434ad86b7cf7142ca
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 95517F22E086418EFB15CFB9D6613BD27E1EB58B5CF248535DE098768ADF38D482C750

Function 00007FF601982030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF601982064
SetWindowLongPtrW.USER32 ref: 00007FF601982086
GetWindowLongPtrW.USER32 ref: 00007FF6019820B0
InvalidateRect.USER32 ref: 00007FF6019820D0

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 7f633e2fbe3b6876c8b62fd5adfb7dc1cb3d26a57b2cb2b4c52cc25d56fed9d2
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 5511CC31E0C14243FB549F69F5442B91692EF88B88FA48031DE4A87B9FCD7DD4C6C600

Function 00007FF6019A4E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019A0A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A0AA3

_get_daylight.LIBCMT ref: 00007FF6019A4F44
_get_daylight.LIBCMT ref: 00007FF6019A4F55

Strings

?, xrefs: 00007FF6019A4ED5

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction ID: cc2775ecf036e5fd0227716d78c0618975272969cd298a910f59ec91396abdf3
Opcode Fuzzy Hash: 90ec7c2969ce35aee26a67d6175707cb0f81e8cc9ba484ad9fb4d69d3ee99291
Instruction Fuzzy Hash: 26410722F0C68246FB249B25A41537A6654EB80BACF784235EF5C87AD7DF7CE445C740

Function 00007FF60199832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199835E

Part of subcall function 00007FF601999C58: RtlFreeHeap.NTDLL(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C6E
Part of subcall function 00007FF601999C58: GetLastError.KERNEL32(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF60198BEC5), ref: 00007FF60199837C

Strings

C:\Users\user\Desktop\uOsIQqfgiT.exe, xrefs: 00007FF60199836A

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\uOsIQqfgiT.exe
API String ID: 3580290477-3360715647
Opcode ID: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction ID: c006cfa74b5f39accedaa87624e293f4220607751156ef7cc94960ee1d040eee
Opcode Fuzzy Hash: ddc46de6380418fe35fca5e4aa859368a8c2113199f78edf785cf6db79d8d493
Instruction Fuzzy Hash: B9418436A08B5689E714DF2998610BC2394EF46B9CB655439EA4E87B97DE3DD4418300

Function 00007FF60199F8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199F916

Part of subcall function 00007FF60199E8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF60199E908

Strings

., xrefs: 00007FF60199F967
:, xrefs: 00007FF60199F956

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
Instruction ID: 654670a7746c0806a6228dfa02914c78b996fcc49123e89250ca22d397f3a165
Opcode Fuzzy Hash: 75108fa0d8fcfebdf0f3dc79d92ab90926721088542d1c76d0744241c3be7838
Instruction Fuzzy Hash: B2412B32F08A529CFB119BB999611BC2AB4EF1475CF640039DE4DE7A8AEF3894468310

Function 00007FF60199BF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF60199C05F
GetLastError.KERNEL32 ref: 00007FF60199C081

Strings

U, xrefs: 00007FF60199C00B

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: 50f097565022363bc8706613551d60d9ee56dec598a10a1e8eff3618cd7a26e8
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: 5F41E522B19A8186EB20DF29E8547A97760FB88798FA44031EE4EC7799DF7CD441C740

Function 00007FF60199E8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF60199E908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF60199E95A

Strings

:, xrefs: 00007FF60199E91E

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction ID: 401107563c87e3a8f1deee53ad8404737c974252ab3d66178afcbe10fe81ef32
Opcode Fuzzy Hash: 07ccd8f192e8e90d69bfd843d23e6c5cb8c086d03a1c4ecf0d47480cab5f9335
Instruction Fuzzy Hash: 9B210232B086858AFB60DB19D46427E73B1FB84B8CFA58035DA8D83286DF7CE945C741

Function 00007FF60198F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF60198F0B8
RaiseException.KERNEL32 ref: 00007FF60198F0F9

Strings

csm, xrefs: 00007FF60198F0E6

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 8818ff87bd84b5f3b82643c7af857fe32f1a221c18c722c58f0e8df34b9999f1
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: 86113D36A18B8582EB618F15F440269B7E4FB88B88F684231DF8D47B69DF7CD551CB00

Function 00007FF60199FA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199FA7C
GetDriveTypeW.KERNEL32 ref: 00007FF60199FABC

Strings

:, xrefs: 00007FF60199FAA5

Memory Dump Source

Source File: 00000000.00000002.2980634298.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000000.00000002.2980596547.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980671708.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980695459.00007FF6019C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2980750170.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: a902577b9971ecc331569d922f0b4b6b210d0761198cd1adb7dfbc3511544206
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: AB01A22291C2438AFB30AF68947227E67A0EF5870CFA40035D54DC2693EF7CE505CA14

Analysis Process: uOsIQqfgiT.exePID: 352, Parent PID: 3468COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	785
Total number of Limit Nodes:	39

Executed Functions

Function 00007FFE13201060 Relevance: 632.7, APIs: 189, Strings: 172, Instructions: 923
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FFE132010A2
Py_AtExit.PYTHON311 ref: 00007FFE132010B7
VerSetConditionMask.KERNEL32 ref: 00007FFE13201102
VerSetConditionMask.KERNEL32 ref: 00007FFE13201111
VerSetConditionMask.KERNEL32 ref: 00007FFE13201121
VerifyVersionInfoW.KERNEL32 ref: 00007FFE13201145
PyModule_Create2.PYTHON311 ref: 00007FFE13201173
PyModule_AddObject.PYTHON311 ref: 00007FFE1320119F
PyErr_NewException.PYTHON311 ref: 00007FFE132011B9
PyModule_AddObject.PYTHON311 ref: 00007FFE132011DF
PyErr_NewException.PYTHON311 ref: 00007FFE132011F9
PyModule_AddObject.PYTHON311 ref: 00007FFE1320121F
PyModule_AddObjectRef.PYTHON311 ref: 00007FFE13201239
PyModule_AddObject.PYTHON311 ref: 00007FFE1320125A
PyModule_AddObject.PYTHON311 ref: 00007FFE1320127C
PyModule_AddObject.PYTHON311 ref: 00007FFE1320129E
PyMem_Malloc.PYTHON311 ref: 00007FFE132012A9
PyCapsule_New.PYTHON311 ref: 00007FFE132012F8
PyModule_AddObject.PYTHON311 ref: 00007FFE13201317
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201332
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201348
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320135E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201374
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320138A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132013A0
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132013B6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132013CC
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132013E2
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132013F8
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320140E
PyModule_AddStringConstant.PYTHON311 ref: 00007FFE13201425
PyModule_AddStringConstant.PYTHON311 ref: 00007FFE1320143C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320144F
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201465
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320147B
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201491
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132014A7
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132014BA
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132014D0
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132014E6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132014FC
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201512
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201528
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320153E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201554
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320156A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201580
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201596
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132015AC
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132015C2
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132015D8
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132015EE
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201604
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320161A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201630
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201646
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201659
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320166F
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201685
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320169B
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132016B1
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132016C7
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132016DD
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132016F3
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201709
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320171F
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201735
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320174B
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201761
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201774
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201787
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320179A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132017B0
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132017C6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132017DC
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132017F2
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201808
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320181E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201834
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320184A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201860
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201876
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320188C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132018A2
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132018B8
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132018CE
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132018E4
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132018FA
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201910
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201926
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320193C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201952
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201968
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320197E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201994
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132019AA
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132019C0
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132019D6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132019EC
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A02
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A18
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A2E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A44
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A57
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A6D
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A83
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201A99
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201AAF
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201AC5
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201ADB
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201AEE
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B04
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B1A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B30
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B46
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B5C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B72
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B88
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201B9E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201BB4
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201BCA
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201BE0
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201BF6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C0C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C22
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C38
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C4E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C64
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C7A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201C90
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201CA6
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201CB9
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201CCF
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201CE5
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201CFB
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D11
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D27
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D3A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D50
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D66
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D7C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201D92
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201DA8
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201DBE
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201DD4
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201DEA
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E00
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E16
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E2C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E42
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E58
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E6E
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E81
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201E97
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201EAD
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201EC3
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201ED9
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201EEF
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F05
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F1B
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F31
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F44
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F5A
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F70
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F86
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201F9C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201FAF
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201FC2
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13201FD8
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE13202039
PyModule_AddObject.PYTHON311 ref: 00007FFE13202051
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13202073
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE13202086
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE1320209C
PyModule_AddIntConstant.PYTHON311 ref: 00007FFE132020B2
PyModule_GetDict.PYTHON311 ref: 00007FFE132020BB
VerSetConditionMask.KERNEL32 ref: 00007FFE13202117
VerSetConditionMask.KERNEL32 ref: 00007FFE13202126
VerSetConditionMask.KERNEL32 ref: 00007FFE13202137
VerifyVersionInfoA.KERNEL32 ref: 00007FFE1320215D
PyErr_Format.PYTHON311 ref: 00007FFE13203130

Strings

IP_RECVDSTADDR, xrefs: 00007FFE13201B52
AI_CANONNAME, xrefs: 00007FFE13201E8D
IPV6_PKTINFO, xrefs: 00007FFE13201CC5
00:00:00:FF:FF:FF, xrefs: 00007FFE1320142B
BTPROTO_RFCOMM, xrefs: 00007FFE13201404
INADDR_BROADCAST, xrefs: 00007FFE13201A63
TCP_MAXSEG, xrefs: 00007FFE13201D46
IPPROTO_UDP, xrefs: 00007FFE13201840
AI_PASSIVE, xrefs: 00007FFE13201E77
IPPROTO_L2TP, xrefs: 00007FFE132019F8
SHUT_RDWR, xrefs: 00007FFE13201FCE
SIO_KEEPALIVE_VALS, xrefs: 00007FFE13201FFD
00:00:00:00:00:00, xrefs: 00007FFE13201414
NI_DGRAM, xrefs: 00007FFE13201F92
MSG_OOB, xrefs: 00007FFE1320164F
INADDR_ANY, xrefs: 00007FFE13201A4D
IP_ADD_MEMBERSHIP, xrefs: 00007FFE13201BAA
IPV6_RECVRTHDR, xrefs: 00007FFE13201CDB
WSAStartup failed: error code %d, xrefs: 00007FFE13203123
SO_DEBUG, xrefs: 00007FFE132014B0
SOL_SOCKET, xrefs: 00007FFE13201715
NI_NUMERICHOST, xrefs: 00007FFE13201F50
SO_USELOOPBACK, xrefs: 00007FFE1320154A
AF_UNSPEC, xrefs: 00007FFE13201328
EAI_NODATA, xrefs: 00007FFE13201E22
SOL_IP, xrefs: 00007FFE1320172B
SOL_UDP, xrefs: 00007FFE13201757
IPPROTO_EGP, xrefs: 00007FFE13201814
MSG_CTRUNC, xrefs: 00007FFE132016A7
IPV6_MULTICAST_HOPS, xrefs: 00007FFE13201C02
IPV6_MULTICAST_LOOP, xrefs: 00007FFE13201C2E
SOCK_RAW, xrefs: 00007FFE13201471
IPPROTO_ST, xrefs: 00007FFE1320198A
EAI_BADFLAGS, xrefs: 00007FFE13201DCA
IPV6_JOIN_GROUP, xrefs: 00007FFE13201BD6
SO_ERROR, xrefs: 00007FFE13201610
TCP_KEEPCNT, xrefs: 00007FFE13201D88
IPPROTO_IP, xrefs: 00007FFE1320176A
IPPORT_USERRESERVED, xrefs: 00007FFE13201A3A
AI_ADDRCONFIG, xrefs: 00007FFE13201EE5
AF_IRDA, xrefs: 00007FFE132013D8
EAI_FAMILY, xrefs: 00007FFE13201DF6
TCP_KEEPIDLE, xrefs: 00007FFE13201D5C
SOCK_RDM, xrefs: 00007FFE1320149D
SO_EXCLUSIVEADDRUSE, xrefs: 00007FFE132014F2
SOMAXCONN, xrefs: 00007FFE1320163C
MSG_PEEK, xrefs: 00007FFE13201665
EAI_SERVICE, xrefs: 00007FFE13201E4E
RCVALL_MAX, xrefs: 00007FFE132020A8
RCVALL_SOCKETLEVELONLY, xrefs: 00007FFE13202092
SHUT_WR, xrefs: 00007FFE13201FB8
IPV6_DONTFRAG, xrefs: 00007FFE13201C86
EAI_MEMORY, xrefs: 00007FFE13201E0C
BDADDR_LOCAL, xrefs: 00007FFE13201435
NI_MAXHOST, xrefs: 00007FFE13201F11
IPV6_UNICAST_HOPS, xrefs: 00007FFE13201C44
SO_REUSEADDR, xrefs: 00007FFE132014DC
AI_ALL, xrefs: 00007FFE13201ECF
AF_INET, xrefs: 00007FFE1320133E
INADDR_UNSPEC_GROUP, xrefs: 00007FFE13201A8F
IPV6_TCLASS, xrefs: 00007FFE13201D1D
IPPORT_RESERVED, xrefs: 00007FFE13201A24
SO_SNDLOWAT, xrefs: 00007FFE132015B8
SO_LINGER, xrefs: 00007FFE13201560
SIO_RCVALL, xrefs: 00007FFE13201FDE
AI_NUMERICHOST, xrefs: 00007FFE13201EA3
TCP_FASTOPEN, xrefs: 00007FFE13201D9E
IPV6_RTHDR, xrefs: 00007FFE13201D07
SO_KEEPALIVE, xrefs: 00007FFE13201508
EAI_SOCKTYPE, xrefs: 00007FFE13201E64
has_ipv6, xrefs: 00007FFE13201291
socket.herror, xrefs: 00007FFE132011AC
SOCK_DGRAM, xrefs: 00007FFE1320145B
herror, xrefs: 00007FFE132011D2
TCP_NODELAY, xrefs: 00007FFE13201D30
IPPROTO_DSTOPTS, xrefs: 00007FFE13201906
SOCK_STREAM, xrefs: 00007FFE13201445
SocketType, xrefs: 00007FFE13201250
BDADDR_ANY, xrefs: 00007FFE1320141E
SOL_TCP, xrefs: 00007FFE13201741
IPPROTO_ROUTING, xrefs: 00007FFE13201882
SO_SNDTIMEO, xrefs: 00007FFE132015E4
NI_NOFQDN, xrefs: 00007FFE13201F3A
IP_MULTICAST_TTL, xrefs: 00007FFE13201B7E
INADDR_MAX_LOCAL_GROUP, xrefs: 00007FFE13201ABB
INADDR_LOOPBACK, xrefs: 00007FFE13201A79
IPPROTO_ICLFXBM, xrefs: 00007FFE13201974
MSG_TRUNC, xrefs: 00007FFE13201691
IP_RECVTOS, xrefs: 00007FFE13201B3C
IP_DROP_MEMBERSHIP, xrefs: 00007FFE13201BC0
IPPROTO_IGMP, xrefs: 00007FFE132017A6
IPPROTO_IGP, xrefs: 00007FFE132019B6
IP_HDRINCL, xrefs: 00007FFE13201AFA
IPPROTO_RAW, xrefs: 00007FFE13201948
SO_RCVLOWAT, xrefs: 00007FFE132015CE
IPV6_HOPOPTS, xrefs: 00007FFE13201CAF
error, xrefs: 00007FFE1320118C
IP_OPTIONS, xrefs: 00007FFE13201AE4
IPPROTO_GGP, xrefs: 00007FFE132017BC
WSAStartup failed: requested version not supported, xrefs: 00007FFE13203145
INADDR_ALLHOSTS_GROUP, xrefs: 00007FFE13201AA5
RCVALL_ON, xrefs: 00007FFE1320207C
NI_NAMEREQD, xrefs: 00007FFE13201F66
MSG_DONTROUTE, xrefs: 00007FFE1320167B
gaierror, xrefs: 00007FFE13201212
SO_ACCEPTCONN, xrefs: 00007FFE132014C6
IPPROTO_MAX, xrefs: 00007FFE1320195E
IPPROTO_FRAGMENT, xrefs: 00007FFE13201898
IPV6_CHECKSUM, xrefs: 00007FFE13201C70
IP_TTL, xrefs: 00007FFE13201B26
EAI_FAIL, xrefs: 00007FFE13201DE0
SO_RCVBUF, xrefs: 00007FFE132015A2
IPPROTO_TCP, xrefs: 00007FFE132017FE
AF_BLUETOOTH, xrefs: 00007FFE132013EE
IPPROTO_AH, xrefs: 00007FFE132018C4
IPPROTO_IPV4, xrefs: 00007FFE132017D2
IPV6_RECVTCLASS, xrefs: 00007FFE13201CF1
IPPROTO_ICMPV6, xrefs: 00007FFE132018DA
AF_SNA, xrefs: 00007FFE132013C2
SO_RCVTIMEO, xrefs: 00007FFE132015FA
SOCK_SEQPACKET, xrefs: 00007FFE13201487
IP_MULTICAST_IF, xrefs: 00007FFE13201B68
TCP_KEEPINTVL, xrefs: 00007FFE13201D72
AF_APPLETALK, xrefs: 00007FFE1320136A
IPPROTO_SCTP, xrefs: 00007FFE13201932, 00007FFE13201A0E
INADDR_NONE, xrefs: 00007FFE13201AD1
IPV6_HOPLIMIT, xrefs: 00007FFE13201C9C
WSAStartup failed: network not ready, xrefs: 00007FFE1320313C
CAPI, xrefs: 00007FFE1320130D
EAI_AGAIN, xrefs: 00007FFE13201DB4
SO_TYPE, xrefs: 00007FFE13201626
IPV6_V6ONLY, xrefs: 00007FFE13201C5A
socket.gaierror, xrefs: 00007FFE132011EC
AF_LINK, xrefs: 00007FFE132013AC
_socket.CAPI, xrefs: 00007FFE132012CC
NI_NUMERICSERV, xrefs: 00007FFE13201F7C
IPPROTO_ESP, xrefs: 00007FFE132018AE
IP_TOS, xrefs: 00007FFE13201B10
IPPROTO_HOPOPTS, xrefs: 00007FFE1320177D
SHUT_RD, xrefs: 00007FFE13201FA5
IP_MULTICAST_LOOP, xrefs: 00007FFE13201B94
AF_DECnet, xrefs: 00007FFE13201396
EAI_NONAME, xrefs: 00007FFE13201E38
AI_NUMERICSERV, xrefs: 00007FFE13201EB9
MSG_MCAST, xrefs: 00007FFE132016FF
IPV6_LEAVE_GROUP, xrefs: 00007FFE13201BEC
AF_INET6, xrefs: 00007FFE13201380
IPPROTO_RDP, xrefs: 00007FFE132019CC
IPPROTO_PUP, xrefs: 00007FFE1320182A
SO_OOBINLINE, xrefs: 00007FFE13201576
MSG_BCAST, xrefs: 00007FFE132016E9
AI_V4MAPPED, xrefs: 00007FFE13201EFB
IPV6_MULTICAST_IF, xrefs: 00007FFE13201C18
SO_DONTROUTE, xrefs: 00007FFE1320151E
RCVALL_OFF, xrefs: 00007FFE13202069
IPPROTO_ND, xrefs: 00007FFE1320186C
IPPROTO_PIM, xrefs: 00007FFE1320191C
IPPROTO_IDP, xrefs: 00007FFE13201856
IPPROTO_PGM, xrefs: 00007FFE132019E2
MSG_WAITALL, xrefs: 00007FFE132016BD
socket, xrefs: 00007FFE1320126F
SO_SNDBUF, xrefs: 00007FFE1320158C
IPPROTO_CBT, xrefs: 00007FFE132019A0
timeout, xrefs: 00007FFE1320122C
SO_BROADCAST, xrefs: 00007FFE13201534
IPPROTO_ICMP, xrefs: 00007FFE13201790
SIO_LOOPBACK_FAST_PATH, xrefs: 00007FFE1320201C
MSG_ERRQUEUE, xrefs: 00007FFE132016D3
AF_IPX, xrefs: 00007FFE13201354
IPPROTO_IPV6, xrefs: 00007FFE132017E8
NI_MAXSERV, xrefs: 00007FFE13201F27
IPPROTO_NONE, xrefs: 00007FFE132018F0

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Module_$Constant$Object$ConditionMask$Err_$ExceptionInfoStringVerifyVersion$Capsule_Create2DictExitFormatFromLongLong_MallocMem_StartupUnsigned
String ID: 00:00:00:00:00:00$00:00:00:FF:FF:FF$AF_APPLETALK$AF_BLUETOOTH$AF_DECnet$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_LINK$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$BDADDR_ANY$BDADDR_LOCAL$BTPROTO_RFCOMM$CAPI$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_DROP_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_RECVDSTADDR$IP_RECVTOS$IP_TOS$IP_TTL$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket$socket.gaierror$socket.herror$timeout
API String ID: 2280847565-1299366327
Opcode ID: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
Instruction ID: 0d093d2f738055a56b329381084ebffcd4f4bdf168f119301dc647ac592e2413
Opcode Fuzzy Hash: de31a07a70c23239d4b04c80589f0f0a269b501d95a9cdd44f27bf4122d5a2ac
Instruction Fuzzy Hash: 78A2FA64B18F0289EA14EF17E85427E2B21BBAABA0F4550B5CD0E27774DEBCE15DC700

Function 00007FF601981000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to convert DLL search path!, xrefs: 00007FF6019838A3
_MEIPASS2, xrefs: 00007FF6019836A2, 00007FF6019836AE, 00007FF6019839AC
pkg, xrefs: 00007FF6019837CF
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF601983A12
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6019837EF
Failed to start splash screen!, xrefs: 00007FF601983933
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF601983820
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF601983A31
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF60198378C
pyi-disable-windowed-traceback, xrefs: 00007FF60198361D
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6019836FC
MEI, xrefs: 00007FF60198374E
pyi-contents-directory, xrefs: 00007FF6019835F8
pyi-runtime-tmpdir, xrefs: 00007FF6019835D3
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF60198391A
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF601983905
Could not create temporary directory!, xrefs: 00007FF601983838
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF601983653

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: b3266ab5b599bac58e49b83a3d96428c259aabf8854c5c280912ab733958fcfb
Instruction ID: 31d67e0877885e1a208ec70ad9ccd2fe2fd40374663ea2ef36dd29fa620c37df
Opcode Fuzzy Hash: b3266ab5b599bac58e49b83a3d96428c259aabf8854c5c280912ab733958fcfb
Instruction Fuzzy Hash: C9F17021F08682A2FB19EB21D5552F96351BF54B8CFA44032DA1EC76D7EFACE658C340

Function 00007FF6019A5C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A59E9
Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5A67
Part of subcall function 00007FF6019A59A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5AB8

CreateFileW.KERNEL32 ref: 00007FF6019A5D7A
CreateFileW.KERNEL32 ref: 00007FF6019A5DCA
GetLastError.KERNEL32 ref: 00007FF6019A5DFA
GetFileType.KERNEL32 ref: 00007FF6019A5E0F
GetLastError.KERNEL32 ref: 00007FF6019A5E19
CloseHandle.KERNEL32 ref: 00007FF6019A5E4C
CloseHandle.KERNEL32 ref: 00007FF6019A5FAF
CreateFileW.KERNEL32 ref: 00007FF6019A5FE4
GetLastError.KERNEL32 ref: 00007FF6019A5FF3

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: fa80f79266c53877c03f04f03bd749ad33a8e4351d2a8f24ff2834dec2693a03
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 8AC1BF36F28A418AEB10CF69C4916AC3761FB49B98B614225DF2E97796CF38E459C340

Function 00007FF6019885A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6019885D3
FindClose.KERNEL32 ref: 00007FF6019885E2

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: c65aefb6f8dd6804c7a43148d0c6b8ddbe92fd8e1ee09a28082e863cc96e086a
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 9FF06822A2D64287F7608B60B4897667350FB4476CF540339D96E826D5DF7CE0598A04

Function 00007FFE1320500C Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 247
threadnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_Audit.PYTHON311 ref: 00007FFE13205071
PyErr_Format.PYTHON311 ref: 00007FFE132050C9
PySys_Audit.PYTHON311 ref: 00007FFE132051C5
PyEval_SaveThread.PYTHON311 ref: 00007FFE132051D3
WSASocketW.WS2_32 ref: 00007FFE132051FC
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13205208
closesocket.WS2_32 ref: 00007FFE13205278
PyLong_AsLongLong.PYTHON311 ref: 00007FFE13205286
PyErr_Occurred.PYTHON311 ref: 00007FFE13205295
PyErr_SetString.PYTHON311 ref: 00007FFE132052B5
memset.VCRUNTIME140 ref: 00007FFE132052D5
getsockname.WS2_32 ref: 00007FFE132052E7
WSAGetLastError.WS2_32 ref: 00007FFE13205306
getsockopt.WS2_32 ref: 00007FFE13205342
PyEval_SaveThread.PYTHON311 ref: 00007FFE13205382
WSASocketW.WS2_32 ref: 00007FFE132053A9
socket.WS2_32 ref: 00007FFE132053C5
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132053D1
SetHandleInformation.KERNEL32 ref: 00007FFE132053FB
closesocket.WS2_32 ref: 00007FFE1320540C
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE13205414

Strings

negative file descriptor, xrefs: 00007FFE132052AB
socket descriptor string has wrong size, should be %zu bytes., xrefs: 00007FFE132050B9
Oiii, xrefs: 00007FFE13205059, 00007FFE13205160
socket.__new__, xrefs: 00007FFE1320506A, 00007FFE132051A0

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_Eval_Thread$AuditLongRestoreSaveSocketSys_closesocket$ErrorFormatFromHandleInformationLastLong_OccurredStringWindowsgetsocknamegetsockoptmemsetsocket
String ID: Oiii$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket.__new__
API String ID: 2694513709-2881308447
Opcode ID: 7924b488af6f99509b9dc87039506b924d131f0bae3dfb7d7f3a034fdeb34a8e
Instruction ID: fec6f99f473ee45508fe384ac0557606ffd1ef44fc61dcf9d1eae341453315b1
Opcode Fuzzy Hash: 7924b488af6f99509b9dc87039506b924d131f0bae3dfb7d7f3a034fdeb34a8e
Instruction Fuzzy Hash: 1BC1A321A0CF818AE620AB2AD54427D77A1FBE9BB4F105375DA5D236B1DF7CE588C700

Function 00007FFE132046BC Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyDeadline_Get.PYTHON311 ref: 00007FFE13204710
_PyDeadline_Init.PYTHON311 ref: 00007FFE13204738
WSAGetLastError.WS2_32 ref: 00007FFE13204763
WSAGetLastError.WS2_32 ref: 00007FFE1320476B
PyErr_CheckSignals.PYTHON311 ref: 00007FFE1320477C
PyEval_SaveThread.PYTHON311 ref: 00007FFE132047A7
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132047C1
WSAGetLastError.WS2_32 ref: 00007FFE132047D0
WSAGetLastError.WS2_32 ref: 00007FFE132047D8
PyErr_CheckSignals.PYTHON311 ref: 00007FFE132047E5

Part of subcall function 00007FFE13203BA8: _PyTime_AsTimeval_clamp.PYTHON311 ref: 00007FFE13203BFD
Part of subcall function 00007FFE13203BA8: PyEval_SaveThread.PYTHON311 ref: 00007FFE13203C3C
Part of subcall function 00007FFE13203BA8: select.WS2_32 ref: 00007FFE13203C70
Part of subcall function 00007FFE13203BA8: PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203C7B

WSAGetLastError.WS2_32 ref: 00007FFE132047F8
WSAGetLastError.WS2_32 ref: 00007FFE1320480D
PyErr_SetString.PYTHON311 ref: 00007FFE13204849

Strings

timed out, xrefs: 00007FFE1320483F

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLast$Eval_Thread$Err_$CheckDeadline_RestoreSaveSignals$InitStringTime_Timeval_clampselect
String ID: timed out
API String ID: 497267021-3163636755
Opcode ID: 38c4f76a7ee197147ac4bfb2bcbfd9314fe9dd1a8714764610627149840ccdaf
Instruction ID: fba2c0798f730893532ae5ffecedc638357a7d66aee35bc64f8ddb47bd900e00
Opcode Fuzzy Hash: 38c4f76a7ee197147ac4bfb2bcbfd9314fe9dd1a8714764610627149840ccdaf
Instruction Fuzzy Hash: 8F417821E08E424EF6647B63A84423D2690BFE4B74F0485B0CE4D726B4DF7CE48DCA10

Function 00007FFE133045B8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 68
threadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE133045DC
PySys_Audit.PYTHON311 ref: 00007FFE133045FD
PyUnicode_AsWideCharString.PYTHON311 ref: 00007FFE1330460E
PyEval_SaveThread.PYTHON311 ref: 00007FFE1330461C
LoadLibraryExW.KERNEL32 ref: 00007FFE1330462F
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13304646
PyMem_Free.PYTHON311 ref: 00007FFE1330464F
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE13304669
GetLastError.KERNEL32 ref: 00007FFE13308E9A
PyErr_Format.PYTHON311 ref: 00007FFE13308EBD
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE13308ECB

Strings

Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax., xrefs: 00007FFE13308EAE
ctypes.dlopen, xrefs: 00007FFE133045F6
U|i:LoadLibrary, xrefs: 00007FFE133045D5

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_Eval_FromThread$Arg_AuditCharErrorFormatFreeLastLibraryLoadLong_Mem_ParseRestoreSaveStringSys_TupleUnicode_VoidWideWindows
String ID: Could not find module '%.500S' (or one of its dependencies). Try using the full path with constructor syntax.$U|i:LoadLibrary$ctypes.dlopen
API String ID: 3805577924-808210370
Opcode ID: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
Instruction ID: f7848eb60575e56ef097a722c5592340ee40c087229b898f2f696bd19a425042
Opcode Fuzzy Hash: 8085d2a71d9d3a5a76fe34bec048b7c14a2e952a150ea8cd1b327b92dda5160e
Instruction Fuzzy Hash: ED215C60B0CF47C9FA449BA3E84407DA760AFA8BB5F0440B1C92E66275EF7CE549C708

Function 00007FF6019818F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6019876A0: _fread_nolock.LIBCMT ref: 00007FF60198774A

_fread_nolock.LIBCMT ref: 00007FF6019819B4

Part of subcall function 00007FF601982760: MessageBoxW.USER32 ref: 00007FF60198283B

Strings

Failed to read cookie!, xrefs: 00007FF6019819BF
Could not allocate memory for archive structure!, xrefs: 00007FF6019819EE
Error on file., xrefs: 00007FF601981B0A
fseek, xrefs: 00007FF601981990
MEI, xrefs: 00007FF601981931
Could not read full TOC!, xrefs: 00007FF601981AD4
calloc, xrefs: 00007FF6019819F5
fread, xrefs: 00007FF6019819C6, 00007FF601981ADB
malloc, xrefs: 00007FF601981AA8
Could not allocate buffer for TOC!, xrefs: 00007FF601981AA1
Failed to seek to cookie position!, xrefs: 00007FF601981989

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: a30161ddcb53f347f25b1f2e6897933f8ffefd05ad1f673dd95f3daa5e00265f
Instruction ID: c3a9e1b68bc027f7f38d962650654a4062ffb247846985f6bbbc2263d23a7ba3
Opcode Fuzzy Hash: a30161ddcb53f347f25b1f2e6897933f8ffefd05ad1f673dd95f3daa5e00265f
Instruction Fuzzy Hash: 6F71A371F1D6868AEB60DB28E4506B923A0FF4478CF644035D98DC779BEEBCE5498B40

Function 00007FF601981440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF60198159A
fseek, xrefs: 00007FF6019814B0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6019814D9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF60198146F
fread, xrefs: 00007FF6019815A1
malloc, xrefs: 00007FF6019814E0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6019814A9

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 51d15d1460699289e77add4f3069a3676c8cf109b6e96b600a9136aabbfff977
Instruction ID: 2d8743a836de98e0938188987db3ded58b84fffdd3414772b94c64e5e02808b1
Opcode Fuzzy Hash: 51d15d1460699289e77add4f3069a3676c8cf109b6e96b600a9136aabbfff977
Instruction Fuzzy Hash: 9B417822B0864347EB249B19E4515B56390FF44BDCF684431DE4EC7A97EEBCE5468740

Function 00007FFE13203A8C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON311 ref: 00007FFE13203AAA
connect.WS2_32 ref: 00007FFE13203ABD
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203AC8
WSAGetLastError.WS2_32 ref: 00007FFE13203AD6
WSAGetLastError.WS2_32 ref: 00007FFE13203AE2
PyErr_CheckSignals.PYTHON311 ref: 00007FFE13203AEF

Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE13204763
Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE1320476B
Part of subcall function 00007FFE132046BC: PyErr_CheckSignals.PYTHON311 ref: 00007FFE1320477C

WSASetLastError.WS2_32 ref: 00007FFE13203B2C

Strings

3', xrefs: 00007FFE13203B10

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLast$CheckErr_Eval_SignalsThread$RestoreSaveconnect
String ID: 3'
API String ID: 1012362816-280543908
Opcode ID: 4c2aaa0c3d8159640696ba06d8d00cbee7b06f13f29e807c9c1db9180f4fbb81
Instruction ID: fe6405dfe62989b72a6413779f435e955a844315a1f62e6f5e528a6675bd8e57
Opcode Fuzzy Hash: 4c2aaa0c3d8159640696ba06d8d00cbee7b06f13f29e807c9c1db9180f4fbb81
Instruction Fuzzy Hash: B7313221B08F428AE7646F67A44417F6691BFA47B8F040176DE4E627B5DE7CE448C640

Function 00007FF6019811F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF601981256
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6019812C3
1.3.1, xrefs: 00007FF601981229
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF601981295
malloc, xrefs: 00007FF60198129C, 00007FF6019812CA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6019813EE

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: ea1ca5e8f3e50544152690d8b8276f8aacb6a5aed49fa9de0bf1ed317fada1aa
Instruction ID: 53219271ab31fbcd02294e6e8de787daca4b390f6fa0d5ea727549af7d2fdfd4
Opcode Fuzzy Hash: ea1ca5e8f3e50544152690d8b8276f8aacb6a5aed49fa9de0bf1ed317fada1aa
Instruction Fuzzy Hash: 6A512862B086428AEB609B16E4503BA6291FF8479CF684135ED4EC7BD7EF7CE546C700

Function 00007FF60199AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199B199

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction ID: 1800ea3d61b59c95ebfa28e2cf0f9669eb850a31d0d34cac452d486db1a5c8e4
Opcode Fuzzy Hash: 61b7c791dd7b4870e419cd94b23561cebff66563b6152af2ba6a1b175460b8f9
Instruction Fuzzy Hash: EAC1F562A0C78799EB619B1DA4606BD3BA0FB91B88F750131DA5E83793DF7CE855C300

Function 00007FFE13204EAC Relevance: 10.6, APIs: 7, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE13204F3C
_PyLong_AsInt.PYTHON311 ref: 00007FFE13204F5B
PyErr_Occurred.PYTHON311 ref: 00007FFE13204F68
_PyLong_AsInt.PYTHON311 ref: 00007FFE13204F82
PyErr_Occurred.PYTHON311 ref: 00007FFE13204F8F
_PyLong_AsInt.PYTHON311 ref: 00007FFE13204FA9
PyErr_Occurred.PYTHON311 ref: 00007FFE13204FB7

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_Long_Occurred$Arg_KeywordsUnpack
String ID:
API String ID: 591546834-0
Opcode ID: a7a7f93d6c09b976a644a8703b6fda579b77e3a5ef28a09bae6b61967c8d869f
Instruction ID: eb4ad592a6999e98ac3a90d04a1228bc86872c2b0bf46d158e9ef9d165ffd9f1
Opcode Fuzzy Hash: a7a7f93d6c09b976a644a8703b6fda579b77e3a5ef28a09bae6b61967c8d869f
Instruction Fuzzy Hash: 5A41A221A09E424AFA60BB27A55877D6290BFA4BB4F144675DE1D737E0DF3CE44CCA00

Function 00007FF6019833E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF601983534), ref: 00007FF601983411

Part of subcall function 00007FF6019829E0: GetLastError.KERNEL32(?,?,?,00007FF60198342E,?,00007FF601983534), ref: 00007FF601982A14
Part of subcall function 00007FF6019829E0: FormatMessageW.KERNEL32(?,?,?,00007FF60198342E), ref: 00007FF601982A7D
Part of subcall function 00007FF6019829E0: MessageBoxW.USER32 ref: 00007FF601982ACF

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF601983461
Failed to obtain executable path., xrefs: 00007FF60198341B
\\?\, xrefs: 00007FF601983482
GetModuleFileNameW, xrefs: 00007FF601983422
Failed to convert executable path to UTF-8., xrefs: 00007FF6019834B8

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: 238738a7f64b543bd1854d27a4d7db43bdf6576d023029b010963663ee2e269f
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: E3217161F1C54292FB219B34E8513B95250BF48B9CFE00136D65EC65E7EFACE609C740

Function 00007FFE13203CC4 Relevance: 9.0, APIs: 6, Instructions: 34threadnetworkCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON311 ref: 00007FFE13203CD8
ioctlsocket.WS2_32 ref: 00007FFE13203CFD
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203D0A
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203D14
WSAGetLastError.WS2_32 ref: 00007FFE13203D1A
PyErr_SetExcFromWindowsErr.PYTHON311 ref: 00007FFE13203D2C

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Restore$Err_ErrorFromLastSaveWindowsioctlsocket
String ID:
API String ID: 863680558-0
Opcode ID: 512bd52ceaf9c0de34ffa74ee59c230cdbc7db2c8c488b05b8fb4fcd4203aa17
Instruction ID: 6d59fa3c1e88a6abb1fa415125d21fc56a7b01216ddb03bf4de44a53d4deae63
Opcode Fuzzy Hash: 512bd52ceaf9c0de34ffa74ee59c230cdbc7db2c8c488b05b8fb4fcd4203aa17
Instruction Fuzzy Hash: 07012121A18E8286E710AB67E44402F6BA0EFD8BA4B504170EA5E53734CE7CD499C710

Function 00007FFE13204984 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203588: PyErr_Format.PYTHON311 ref: 00007FFE132037DF

PySys_Audit.PYTHON311 ref: 00007FFE132049DC

Part of subcall function 00007FFE13203A8C: PyEval_SaveThread.PYTHON311 ref: 00007FFE13203AAA
Part of subcall function 00007FFE13203A8C: connect.WS2_32 ref: 00007FFE13203ABD
Part of subcall function 00007FFE13203A8C: PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203AC8
Part of subcall function 00007FFE13203A8C: WSAGetLastError.WS2_32 ref: 00007FFE13203AD6
Part of subcall function 00007FFE13203A8C: WSAGetLastError.WS2_32 ref: 00007FFE13203AE2
Part of subcall function 00007FFE13203A8C: PyErr_CheckSignals.PYTHON311 ref: 00007FFE13203AEF
Part of subcall function 00007FFE13203A8C: WSASetLastError.WS2_32 ref: 00007FFE13203B2C

PyLong_FromLong.PYTHON311 ref: 00007FFE13204A01

Strings

socket.connect, xrefs: 00007FFE132049D5
connect_ex, xrefs: 00007FFE132049A3

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatFromLongLong_RestoreSaveSignalsSys_connect
String ID: connect_ex$socket.connect
API String ID: 3879675179-935070752
Opcode ID: 7d4dcffa2edb09ece9d6c617b455fe9f262b2331e1b69a2bbe7cc4c60c6c3a53
Instruction ID: c4461f0d3fd9ec3244258765d02200a44dc158f8a93e6347c24560121fefe0a3
Opcode Fuzzy Hash: 7d4dcffa2edb09ece9d6c617b455fe9f262b2331e1b69a2bbe7cc4c60c6c3a53
Instruction Fuzzy Hash: 10118660708F8289E650ABA3F4517AF63A0FFD87D0F444072DA4D77665DE2CE108CB40

Function 00007FF601994938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601994965
CreateFileW.KERNEL32 ref: 00007FF6019949A4
CloseHandle.KERNEL32 ref: 00007FF6019949D9

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: fa02268210cfd61974545ced4fb4805f4bb47b76f372a724c5078c99da872f44
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 8B41B332D1878287F7558B6496203797360FBA57A8F209334EA9C83AD6DF7CA5E18700

Function 00007FFE13203BA8 Relevance: 6.1, APIs: 4, Instructions: 75threadtimeCOMMON

Download Yara Rule

APIs

_PyTime_AsTimeval_clamp.PYTHON311 ref: 00007FFE13203BFD
PyEval_SaveThread.PYTHON311 ref: 00007FFE13203C3C
select.WS2_32 ref: 00007FFE13203C70
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203C7B

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveTime_Timeval_clampselect
String ID:
API String ID: 3905867726-0
Opcode ID: 947ac965c37a758a9fa8a6c53622192885134dfb450c88c4b3ce8717958678c4
Instruction ID: 39d595b8ecc1f2cd55885b72d9b482497ccae592321bb130ca6986de7c53f863
Opcode Fuzzy Hash: 947ac965c37a758a9fa8a6c53622192885134dfb450c88c4b3ce8717958678c4
Instruction Fuzzy Hash: 4F318422B08F828AD7609F26A8446AF63A0FBD97B4F500275DB6D937A4DF3DD449C704

Function 00007FF60198BF5C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60198C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF60198C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF60198BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF60198BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF60198C041

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: ba515f98196df9f4a0bc2d543ab1270b5116a564fddc4946c96a25abcf42ee7d
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 9C315D11E0D24747FF54AB68D4613F92391AF4278CFB40439EA4ECB6D3DEADB8498261

Function 00007FF60198F45C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F597

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction ID: 1cfd8b9022c75d0f6cf2cf534b98af6f1d87ecbf0db28d160876dacbd76eca48
Opcode Fuzzy Hash: 8760811a46c694da2ce7fcb713cb8132a6e7826c56b7b9f56bdeeaa18c726bba
Instruction Fuzzy Hash: 8851DF62B0928247FB289E3A940467A6681FF84BBCF246735DE6DC37D7CE7CE4018610

Function 00007FF60199B444 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF60199B5DD), ref: 00007FF60199B490
GetLastError.KERNEL32(?,?,?,?,?,00007FF60199B5DD), ref: 00007FF60199B49A

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 7d73874259a001ccb10885c85f4a5271d343e3893463a01ec352ceee2f80c508
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: A811C162B18A8185DB108B29B8541797361EB44FF8F684331EEBE877EACE7CD0508740

Function 00007FFE13204A2C Relevance: 3.0, APIs: 2, Instructions: 22networkCOMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FFE13204A56
WSASetLastError.WS2_32 ref: 00007FFE13204A6D

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLastgetsockopt
String ID:
API String ID: 1230475664-0
Opcode ID: 080af4ea2029d23d9151f6a955685a54dcf6792f85f9aebfc89d6658b6cab2d3
Instruction ID: ab3dda4f88e6c558fe84d1167a75a7f8ae08d2ba360077e577381561e5c2b3e8
Opcode Fuzzy Hash: 080af4ea2029d23d9151f6a955685a54dcf6792f85f9aebfc89d6658b6cab2d3
Instruction Fuzzy Hash: 2FF08C31A089828AEB24AB02D82063E6360FFD5720FA00074D68D66AB4DFBCE409CB04

Function 00007FF601999C58 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C6E
GetLastError.KERNEL32(?,?,?,00007FF6019A2032,?,?,?,00007FF6019A206F,?,?,00000000,00007FF6019A2535,?,?,?,00007FF6019A2467), ref: 00007FF601999C78

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction ID: ead462954c4c73030430ae8a5163420fb59fb94d7e059af78dd8505d8cd57eac
Opcode Fuzzy Hash: 9fa0b27d1784483699343fce5d0d8fb71a2fef38db5c10c130c8b92919593777
Instruction Fuzzy Hash: 2BE0C250F0968246FF196BFAAD650791291DF9874DFA04034DD0EC3253EE2C684A8350

Function 00007FF601999E68 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF601999CE5,?,?,00000000,00007FF601999D9A), ref: 00007FF601999ED6
GetLastError.KERNEL32(?,?,?,00007FF601999CE5,?,?,00000000,00007FF601999D9A), ref: 00007FF601999EE0

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: d34df2e48efc3452f0e5df32e7b6bf7a658cccf86feb7161fb0fc21d1bd0359f
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 4B21C321F1C64245FF9497E9A5A037D2291DF847ACF284239EA2EC73D3DE6CB4448300

Function 00007FF60199B1BC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199B1E4

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: a90415d2532884c7145b523cf42cfc14f63ba8942a897a5be1b6beee3e4a20f4
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: D741A0329082418BEB34DB1EB56167D73A0EBA6B88F240135DA9EC7692CF3DE502C751

Function 00007FF6019876A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF60198774A

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 9a396ddbd756f70ef3e191b25ce4394719a0476fb4587d3b2d2fc682a28141be
Instruction ID: f80ca9ffc8ee126aded130388bde5074df4d85c7f05e6b10afbb6aa58b9bb519
Opcode Fuzzy Hash: 9a396ddbd756f70ef3e191b25ce4394719a0476fb4587d3b2d2fc682a28141be
Instruction Fuzzy Hash: 5D218321B0865247FB14AA56A9147BAA651BF45BDCFB85430EE0D87787DEBDE041C700

Function 00007FF60199AC4C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199ACD2

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: 636483d5a1d679937a3f049ba5c7dd5094a054e089d837697ae213926eaa0186
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 5F31B021E186828AF712AB6D88613BD3650EF50BA9F610135EA1D873D3DFBCE442C710

Function 00007FF6019952A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601995209

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: a943b801aeeec6931d3b5436645e357af64ece70e9cf1be0c2c616aac641825c
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: E411C621A0C2414AFB629F59942117FA260FF55B88F650032FE4CC7A87CF3CD4418740

Function 00007FF6019A5664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019A5687

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: d75ed149ef49bb9f974355263861c38543c63c611e155acc85ad3acbac3cfc51
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: EC21A772B18A8186EB618F19E44037977A0FB94B98F754234E65DC76EADF3CD405CB00

Function 00007FF60198F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF60198F730

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: 15807b7beaf554d2474db0137832f37dd63ba843fc08efb4eb7af1437b55cebb
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: B501D621A0878241FB04EF669901079A695FF95FE8F685635DE6CD3BD7DE7CE5028300

Function 00007FF6019881A0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6019886B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF601983FA4,00000000,00007FF601981925), ref: 00007FF6019886E9

LoadLibraryExW.KERNEL32(?,00007FF601985C06,?,00007FF60198308E), ref: 00007FF6019881C2

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 77ae25245f8b45af1157fbb3b937bf879f85066301c944067a0f7c96525a2952
Instruction ID: a8045ab2e35095e12c65f09a3820bd27056b85552d802464a8e185721b12fdb9
Opcode Fuzzy Hash: 77ae25245f8b45af1157fbb3b937bf879f85066301c944067a0f7c96525a2952
Instruction Fuzzy Hash: 1FD0C201F2464181FB54AB7BBA565795551AF89BC8FA88034EE1D43B47DC3CD0810B00

Function 00007FF60199C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF60198FFB0,?,?,?,00007FF60199161A,?,?,?,?,?,00007FF601992E09), ref: 00007FF60199C94A

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 6e86393eb4b9e506eba96923b44f5867c931d4ed34100e6c398da64fa20a8990
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 1AF01C21F192878DFF6467BA5D713791280DF88BA8F694630ED6EC62C3DE2CB5818160

Non-executed Functions

Function 00007FFE1325AAD8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1325AAF4
memset.VCRUNTIME140 ref: 00007FFE1325AB18
RtlCaptureContext.KERNEL32 ref: 00007FFE1325AB21
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE1325AB3B
RtlVirtualUnwind.KERNEL32 ref: 00007FFE1325AB7C
memset.VCRUNTIME140 ref: 00007FFE1325ABAF
IsDebuggerPresent.KERNEL32 ref: 00007FFE1325ABD0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1325ABF1
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE1325ABFC

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: a7a0b375acf53c908aaa84b1677749aa5f730714d3c2174efe7977e719f92665
Instruction ID: 0ce68c2f49e28a49f2f41a659eb91ac922b17f837c66b9ef3b42fb920314e661
Opcode Fuzzy Hash: a7a0b375acf53c908aaa84b1677749aa5f730714d3c2174efe7977e719f92665
Instruction Fuzzy Hash: 633162B2604F8189EB609F65E8403ED3360FB94754F444539DA4E57AA4EF3CD649C710

Function 00007FFE13202BC0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13202BDC
memset.VCRUNTIME140 ref: 00007FFE13202C00
RtlCaptureContext.KERNEL32 ref: 00007FFE13202C09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13202C23
RtlVirtualUnwind.KERNEL32 ref: 00007FFE13202C64
memset.VCRUNTIME140 ref: 00007FFE13202C97
IsDebuggerPresent.KERNEL32 ref: 00007FFE13202CB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13202CD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13202CE4

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: be945e1872453a46079eb03b3ba9076c6fe97ae394edff2aba9fdbd75b39c04d
Instruction ID: 0852c36288efed1d048696d6d48df1265faf287f86b3f2f567fa1e2ba286c968
Opcode Fuzzy Hash: be945e1872453a46079eb03b3ba9076c6fe97ae394edff2aba9fdbd75b39c04d
Instruction Fuzzy Hash: 19318C72608F818AEB60AF61E8803EE7365FB95354F44407ADA4E53BA4DF78C14CC700

Function 00007FFE132752F0 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE1327530C
memset.VCRUNTIME140 ref: 00007FFE13275330
RtlCaptureContext.KERNEL32 ref: 00007FFE13275339
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE13275353
RtlVirtualUnwind.KERNEL32 ref: 00007FFE13275394
memset.VCRUNTIME140 ref: 00007FFE132753C7
IsDebuggerPresent.KERNEL32 ref: 00007FFE132753E8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE13275409
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13275414

Memory Dump Source

Source File: 00000001.00000002.2984079129.00007FFE13271000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true

Associated: 00000001.00000002.2984061552.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984101399.00007FFE13276000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984120218.00007FFE13279000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13270000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 40d573c0dd21a065d9b81eb5e40468c529eab132bf55f054c2ad9a992b3fa41a
Instruction ID: 5f0979b79f21aff314980ebb7e3e8a1dd440fd45f419afa7ac52a8a1d4553e20
Opcode Fuzzy Hash: 40d573c0dd21a065d9b81eb5e40468c529eab132bf55f054c2ad9a992b3fa41a
Instruction Fuzzy Hash: DB314C72609E818AEB60AF62E8503ED7361FBA4764F44443ADA4E57AA4EF3CD548C700

Function 00007FFE130C1B00 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE130C1B1C
memset.VCRUNTIME140 ref: 00007FFE130C1B40
RtlCaptureContext.KERNEL32 ref: 00007FFE130C1B49
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE130C1B63
RtlVirtualUnwind.KERNEL32 ref: 00007FFE130C1BA4
memset.VCRUNTIME140 ref: 00007FFE130C1BD7
IsDebuggerPresent.KERNEL32 ref: 00007FFE130C1BF8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE130C1C19
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE130C1C24

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
Instruction ID: 5c9fa5b3ca02b78fbdec2e7d926b6a2f48967bb0f62326b8ae28baca8814fbcc
Opcode Fuzzy Hash: 491c6c3a996b181e7d4f6ff731a66c8976c72585f48119a1a83f76a26148e78e
Instruction Fuzzy Hash: 4B317072618F818AEB649F61E8903ED33A1FB94754F8444B9DA8D57BA8DF3CD648C700

Function 00007FFE13306254 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFE13306270
memset.VCRUNTIME140 ref: 00007FFE13306294
RtlCaptureContext.KERNEL32 ref: 00007FFE1330629D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFE133062B7
RtlVirtualUnwind.KERNEL32 ref: 00007FFE133062F8
memset.VCRUNTIME140 ref: 00007FFE1330632B
IsDebuggerPresent.KERNEL32 ref: 00007FFE1330634C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFE1330636D
UnhandledExceptionFilter.KERNEL32 ref: 00007FFE13306378

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: ea38b9b02c827df44fb5011cb61d735aee822b3a281d6ad786fd76dbeb1e9228
Instruction ID: 3ac8390263ad603ed948ab1fe9e7d74c07f0fae0b0a12e2a7fd973481d2f738e
Opcode Fuzzy Hash: ea38b9b02c827df44fb5011cb61d735aee822b3a281d6ad786fd76dbeb1e9228
Instruction Fuzzy Hash: 22316A72709F818AEB608F61E8403ED7364FB94764F44407ADA5E57AA9EF3CC648C708

Function 00007FFE132045E8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 48threadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203588: PyErr_Format.PYTHON311 ref: 00007FFE132037DF

PySys_Audit.PYTHON311 ref: 00007FFE13204640
PyEval_SaveThread.PYTHON311 ref: 00007FFE13204652
bind.WS2_32 ref: 00007FFE13204669
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13204674

Strings

bind, xrefs: 00007FFE13204607
socket.bind, xrefs: 00007FFE13204639

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$AuditErr_FormatRestoreSaveSys_bind
String ID: bind$socket.bind
API String ID: 1695574521-187351271
Opcode ID: dc24cef773245b4122254bbfd203ff68aadfac931a17838e96712d49baaaed77
Instruction ID: aa3fe70d3eba803d28a325b8707ee272b39505373e959c5c161fcfb6e66f17dd
Opcode Fuzzy Hash: dc24cef773245b4122254bbfd203ff68aadfac931a17838e96712d49baaaed77
Instruction Fuzzy Hash: BA115E61608F8289E620AB52F4407AE7764FFE4BA0F004176DA4D27B64DF7CE54CCB00

Function 00007FFE13205610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205633
PyEval_SaveThread.PYTHON311 ref: 00007FFE1320564B
listen.WS2_32 ref: 00007FFE13205667
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13205672

Strings

|i:listen, xrefs: 00007FFE1320562C

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveSizeTuple_listen
String ID: |i:listen
API String ID: 3610171639-1087349693
Opcode ID: 2dbeb274d4bae0e2ac5948526fc6aafbd0b7016d98b6296a5ce504e9575d9f50
Instruction ID: 2b5af5a0c7496e28816d906f891c1ad2d8d2cabf6b0f1b31477cf13cf1bb445e
Opcode Fuzzy Hash: 2dbeb274d4bae0e2ac5948526fc6aafbd0b7016d98b6296a5ce504e9575d9f50
Instruction Fuzzy Hash: E5015B21A08E418AD754AB62E88412E67B1FFE8BA0B104071DA4E57B28CF7CE448CB00

Function 00007FFE13272E00 Relevance: 4.5, APIs: 3, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFE1327368D,?,00000001,00000000,00007FFE13272B10), ref: 00007FFE13272E4A
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FFE1327368D,?,00000001,00000000,00007FFE13272B10), ref: 00007FFE13272E94
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,00007FFE1327368D,?,00000001,00000000,00007FFE13272B10), ref: 00007FFE13272EC2

Memory Dump Source

Source File: 00000001.00000002.2984079129.00007FFE13271000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true

Associated: 00000001.00000002.2984061552.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984101399.00007FFE13276000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984120218.00007FFE13279000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13270000_uOsIQqfgiT.jbxd

Similarity

API ID: InfoSleepSystemabort
String ID:
API String ID: 3812989525-0
Opcode ID: 356e883e78af41a95903e3fe84684237f5ddaaae80b9a3ed4a034d8e13ef1f18
Instruction ID: bf4fc993f2af993d156d5870b4c6b164cc3855747e2f99140542ace48f0fb545
Opcode Fuzzy Hash: 356e883e78af41a95903e3fe84684237f5ddaaae80b9a3ed4a034d8e13ef1f18
Instruction Fuzzy Hash: 96211431A19F528EEB61EB52E85533536A0BFB9734F1006BAC25D666B0DFBCB444CB40

Function 00007FFE132057F8 Relevance: 1.5, APIs: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FFE13205828

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 2186b8548a74f713b9d8f013b35e4caa0f80f0123c71c12a71ece9f8242404c6
Instruction ID: 144410edd51ba3e700a6153658fbc7f0c578896f0ea85a46c63529810e46a231
Opcode Fuzzy Hash: 2186b8548a74f713b9d8f013b35e4caa0f80f0123c71c12a71ece9f8242404c6
Instruction Fuzzy Hash: C2E092B1B00A4486DB189B1AE4912382390F718F74F205735DE3D8B3D0CE28D8E1C340

Function 00007FFE13305304 Relevance: 124.6, APIs: 52, Strings: 19, Instructions: 370COMMON

Download Yara Rule

APIs

PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330532F
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305366
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330538B
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053AA
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053CC
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053EB
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330540D
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330542C
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305451
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305470
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305495
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133054B4
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133054D9
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133054F8
PyUnicode_FromString.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330551F
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330553E
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305565
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305584
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133055AB
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133055CA
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133055F1
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305610
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305637
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305656
PyLong_FromVoidPtr.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330567D
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330569C
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133056BE
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133056DD
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133056FF
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330571E
PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305743
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330575E
PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305795
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330921F
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330922E
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330923D
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330924C
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330925B
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330926A
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309279
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309288
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309297
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092A6
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092B5
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092C4
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092D3
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092E2
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133092F1
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309300
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309318
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309327
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13309336

Strings

FUNCFLAG_PYTHONAPI, xrefs: 00007FFE133054EE
_pointer_type_cache, xrefs: 00007FFE1330531A
1.1.0, xrefs: 00007FFE13305518
FUNCFLAG_STDCALL, xrefs: 00007FFE133053E1
FUNCFLAG_CDECL, xrefs: 00007FFE13305422
FUNCFLAG_USE_LASTERROR, xrefs: 00007FFE133054AA
ArgumentError, xrefs: 00007FFE13305785
__version__, xrefs: 00007FFE13305534
RTLD_LOCAL, xrefs: 00007FFE133056D3
_string_at_addr, xrefs: 00007FFE13305606
FUNCFLAG_USE_ERRNO, xrefs: 00007FFE13305466
_wstring_at_addr, xrefs: 00007FFE13305692
COMError, xrefs: 00007FFE13305356
RTLD_GLOBAL, xrefs: 00007FFE13305714
_memset_addr, xrefs: 00007FFE133055C0
FUNCFLAG_HRESULT, xrefs: 00007FFE133053A0
_memmove_addr, xrefs: 00007FFE1330557A
CTYPES_MAX_ARGCOUNT, xrefs: 00007FFE13305754
_cast_addr, xrefs: 00007FFE1330564C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Module_Object$From$Long_$Long$Void$StringUnicode_
String ID: 1.1.0$ArgumentError$COMError$CTYPES_MAX_ARGCOUNT$FUNCFLAG_CDECL$FUNCFLAG_HRESULT$FUNCFLAG_PYTHONAPI$FUNCFLAG_STDCALL$FUNCFLAG_USE_ERRNO$FUNCFLAG_USE_LASTERROR$RTLD_GLOBAL$RTLD_LOCAL$__version__$_cast_addr$_memmove_addr$_memset_addr$_pointer_type_cache$_string_at_addr$_wstring_at_addr
API String ID: 2895207140-772522829
Opcode ID: b7dbbcc8b36d8762ecc7955ef4353bb7629bcf7eedf864b22fa349bc15453bc1
Instruction ID: 1f388460a1c8370223fde7e821c69ac347c0d16c27ecfaeb36579b18fc8d23af
Opcode Fuzzy Hash: b7dbbcc8b36d8762ecc7955ef4353bb7629bcf7eedf864b22fa349bc15453bc1
Instruction Fuzzy Hash: 91E11C24B0EF43C9FE498B67D86427C6364AF69FA5F0451B5CD2E667B6DE2CE0058308

Function 00007FFE1A458EE4 Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 382COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459455
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45948A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4594C3

Strings

volatile, xrefs: 00007FFE1A4592FB
this , xrefs: 00007FFE1A45937F
signed , xrefs: 00007FFE1A459422
volatile, xrefs: 00007FFE1A4592CE
UNKNOWN, xrefs: 00007FFE1A459358
long, xrefs: 00007FFE1A458F7E
long , xrefs: 00007FFE1A458FF3
int, xrefs: 00007FFE1A458F90
double, xrefs: 00007FFE1A45900A
__int32, xrefs: 00007FFE1A45919A
__int128, xrefs: 00007FFE1A45917C
__int8, xrefs: 00007FFE1A4590FE
char, xrefs: 00007FFE1A458FB4
wchar_t, xrefs: 00007FFE1A459376
<unknown>, xrefs: 00007FFE1A4591F6
float, xrefs: 00007FFE1A459036
decltype(auto), xrefs: 00007FFE1A45932C
__w64 , xrefs: 00007FFE1A45910A
const, xrefs: 00007FFE1A4592B3
char8_t, xrefs: 00007FFE1A459205
short, xrefs: 00007FFE1A458FA2
char32_t, xrefs: 00007FFE1A4593D7
void, xrefs: 00007FFE1A459048
char16_t, xrefs: 00007FFE1A4591E4
__int16, xrefs: 00007FFE1A4590EC
auto, xrefs: 00007FFE1A459217
unsigned , xrefs: 00007FFE1A459412
bool, xrefs: 00007FFE1A4591AC
__int64, xrefs: 00007FFE1A45918B

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
Instruction ID: 7dbdcc0aec0229bd67dc74b7a8b344ddb4082a3b9b28ae3fc64f9eee612ad8f4
Opcode Fuzzy Hash: 36e6e2d055789cd29251c4bf9697f6c8a4377c58ea8e1572b96a4f003d2d3a05
Instruction Fuzzy Hash: 8D0281B6F08E1294FB14EB66D8941BC27B0BB0AB64F5441F7DA0D52AB9DF3CA564C340

Function 00007FFE13206660 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 242threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON311 ref: 00007FFE132066F8
PyUnicode_AsEncodedString.PYTHON311 ref: 00007FFE13206732
PyLong_AsLong.PYTHON311 ref: 00007FFE13206775
PyErr_Occurred.PYTHON311 ref: 00007FFE13206782
PyOS_snprintf.PYTHON311 ref: 00007FFE132067A4
PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE132067C7
PySys_Audit.PYTHON311 ref: 00007FFE13206825
PyEval_SaveThread.PYTHON311 ref: 00007FFE1320685B
getaddrinfo.WS2_32 ref: 00007FFE13206872
PyEval_RestoreThread.PYTHON311 ref: 00007FFE1320687D
PyList_New.PYTHON311 ref: 00007FFE13206899
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE13206903
_Py_Dealloc.PYTHON311 ref: 00007FFE13206915
PyList_Append.PYTHON311 ref: 00007FFE13206926
_Py_Dealloc.PYTHON311 ref: 00007FFE13206941
_Py_Dealloc.PYTHON311 ref: 00007FFE13206962
freeaddrinfo.WS2_32 ref: 00007FFE13206971
_Py_Dealloc.PYTHON311 ref: 00007FFE13206984
_Py_Dealloc.PYTHON311 ref: 00007FFE13206993
PyErr_SetString.PYTHON311 ref: 00007FFE132069AC
_Py_Dealloc.PYTHON311 ref: 00007FFE132069C0
freeaddrinfo.WS2_32 ref: 00007FFE132069CF
PyErr_SetString.PYTHON311 ref: 00007FFE132069E8

Strings

getaddrinfo() argument 1 must be string or None, xrefs: 00007FFE132069DE
idna, xrefs: 00007FFE1320672B
Int or String expected, xrefs: 00007FFE132069A2
OOiii, xrefs: 00007FFE13206802
OO|iiii:getaddrinfo, xrefs: 00007FFE132066B4
socket.getaddrinfo, xrefs: 00007FFE13206813
iiisO, xrefs: 00007FFE132068F9
%ld, xrefs: 00007FFE13206794

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Err_String$Eval_List_SizeThreadUnicode_freeaddrinfo$AppendArg_AuditBuildEncodedKeywords_LongLong_OccurredParseRestoreS_snprintfSaveSys_TupleValue_getaddrinfo
String ID: %ld$Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
API String ID: 3700949282-3943835681
Opcode ID: ac0e0005ecee2beaaf5895c6605989e7061b2ddcda715d4e868953f6349ae067
Instruction ID: d372a67ea0236718f4ba877f14602e6ea57b406b346069cacd52d6a67fc8d8a0
Opcode Fuzzy Hash: ac0e0005ecee2beaaf5895c6605989e7061b2ddcda715d4e868953f6349ae067
Instruction Fuzzy Hash: B8B13D72B08E028EEB20EFA2D4405BD67B1EBA8BB4B104575DD4D67B68DE3CE449C300

Function 00007FFE13301B80 Relevance: 54.5, APIs: 17, Strings: 14, Instructions: 246COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13301BC1
PySequence_Tuple.PYTHON311 ref: 00007FFE13301BE4
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13301C15
PySys_Audit.PYTHON311 ref: 00007FFE13301C4B
PyObject_GetAttrString.PYTHON311 ref: 00007FFE13301C64
PyLong_AsVoidPtr.PYTHON311 ref: 00007FFE13301C8D
PyErr_Occurred.PYTHON311 ref: 00007FFE13301CA0
_Py_Dealloc.PYTHON311 ref: 00007FFE13301D7D
_Py_Dealloc.PYTHON311 ref: 00007FFE13306D74
PyErr_SetString.PYTHON311 ref: 00007FFE13306DAA
PyErr_Format.PYTHON311 ref: 00007FFE13306DC3

Part of subcall function 00007FFE13301D8C: PyEval_SaveThread.PYTHON311 ref: 00007FFE13301DA1
Part of subcall function 00007FFE13301D8C: GetProcAddress.KERNEL32 ref: 00007FFE13301DB0
Part of subcall function 00007FFE13301D8C: PyEval_RestoreThread.PYTHON311 ref: 00007FFE13301DBC

PyErr_Format.PYTHON311 ref: 00007FFE13306DFC
PyErr_Format.PYTHON311 ref: 00007FFE13306E0F
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13306E9A
PyErr_SetString.PYTHON311 ref: 00007FFE13306F4C
_Py_Dealloc.PYTHON311 ref: 00007FFE13306F5C
_Py_Dealloc.PYTHON311 ref: 00007FFE13306F6F

Strings

abstract class, xrefs: 00007FFE13306E28
paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FFE13306F1D
paramflag value %d not supported, xrefs: 00007FFE13306DB9
the _handle attribute of the second argument must be an integer, xrefs: 00007FFE13306F42
O&O;illegal func_spec argument, xrefs: 00007FFE13301C0E
i|OO, xrefs: 00007FFE13306E8A
ctypes.dlsym, xrefs: 00007FFE13301C40
paramflags must have the same length as argtypes, xrefs: 00007FFE13306D89
could not convert the _handle attribute to a pointer, xrefs: 00007FFE13306D80
function ordinal %d not found, xrefs: 00007FFE13306E08
paramflags must be a tuple or None, xrefs: 00007FFE13306D99
O|O, xrefs: 00007FFE13301BA9
function '%s' not found, xrefs: 00007FFE13306DF5
_handle, xrefs: 00007FFE13301C5D

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Dealloc$Arg_FormatParseSizeStringTuple_$Eval_Thread$AddressAttrAuditLong_Object_OccurredProcRestoreSaveSequence_Sys_TupleVoid
String ID: O&O;illegal func_spec argument$O|O$_handle$abstract class$could not convert the _handle attribute to a pointer$ctypes.dlsym$function '%s' not found$function ordinal %d not found$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes$the _handle attribute of the second argument must be an integer
API String ID: 1081342661-1557499450
Opcode ID: 81bf86f915efca78798dbd81cfc19dde70ba7face78de59bde1888ce70c5e139
Instruction ID: d532d22d92ac4eb3b5cc5eb456d72f820f58fb43ed434943a8df3dd742d5ee6f
Opcode Fuzzy Hash: 81bf86f915efca78798dbd81cfc19dde70ba7face78de59bde1888ce70c5e139
Instruction Fuzzy Hash: D4C12835B09E02C9EA548B67E8501BC63A0FB64BB4F6441B6D92D276B9DF3CE445D308

Function 00007FFE1330C9D0 Relevance: 54.5, APIs: 23, Strings: 8, Instructions: 244COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON311 ref: 00007FFE1330CA15
PyType_IsSubtype.PYTHON311 ref: 00007FFE1330CAFE
memcpy.VCRUNTIME140 ref: 00007FFE1330CB1E
_PyDict_ContainsId.PYTHON311 ref: 00007FFE1330CB31
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330CBAC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330CBB7
GetLastError.KERNEL32 ref: 00007FFE1330CBC9
SetLastError.KERNEL32 ref: 00007FFE1330CBD5
_Py_Dealloc.PYTHON311 ref: 00007FFE1330CBFA
PyErr_SetString.PYTHON311 ref: 00007FFE1330CC1A
PyObject_Vectorcall.PYTHON311 ref: 00007FFE1330CC3E
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FFE1330CC56
GetLastError.KERNEL32 ref: 00007FFE1330CC66
SetLastError.KERNEL32 ref: 00007FFE1330CC72
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330CC81
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330CC8C
_Py_Dealloc.PYTHON311 ref: 00007FFE1330CCA3

Part of subcall function 00007FFE1330CDA0: _Py_CheckFunctionResult.PYTHON311 ref: 00007FFE1330CDEF

_Py_Dealloc.PYTHON311 ref: 00007FFE1330CCFC
PyErr_WarnEx.PYTHON311 ref: 00007FFE1330CD1B
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FFE1330CD31
_Py_Dealloc.PYTHON311 ref: 00007FFE1330CD40
_Py_Dealloc.PYTHON311 ref: 00007FFE1330CD59
PyGILState_Release.PYTHON311 ref: 00007FFE1330CD6E

Strings

cannot build parameter, xrefs: 00007FFE1330CC10
on calling ctypes callback function, xrefs: 00007FFE1330CC4F
unexpected result of create argument %zd:, xrefs: 00007FFE1330CC00
memory leak in callback function., xrefs: 00007FFE1330CD0B
Parsing argument %zd, xrefs: 00007FFE1330CC20
getting _needs_com_addref_, xrefs: 00007FFE1330CB3D
create argument %zd:, xrefs: 00007FFE1330CBDD
on converting result of ctypes callback function, xrefs: 00007FFE1330CD2A

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Err_ErrorLast_errno$State_UnraisableWrite$CheckContainsDict_EnsureFunctionObject_ReleaseResultStringSubtypeType_VectorcallWarnmemcpy
String ID: Parsing argument %zd$cannot build parameter$create argument %zd:$getting _needs_com_addref_$memory leak in callback function.$on calling ctypes callback function$on converting result of ctypes callback function$unexpected result of create argument %zd:
API String ID: 1331253392-2697724128
Opcode ID: 662eda2fa9ad5fa4c0407cff36c88571a43e939dd8943eeb715751b67e50d2ce
Instruction ID: 3a65a620227f15be783003f74c69a5df0a4cb8808c2bd0afdf893c1e09b5203e
Opcode Fuzzy Hash: 662eda2fa9ad5fa4c0407cff36c88571a43e939dd8943eeb715751b67e50d2ce
Instruction Fuzzy Hash: 08B13922A09F42CAEF50DF26D8542AC67A0FB64BA8F444571DA2D6B7B5DF3CE445C308

Function 00007FFE13303BF0 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 181threadCOMMON

Download Yara Rule

APIs

ffi_prep_cif.LIBFFI-8 ref: 00007FFE13303C54
ffi_call.LIBFFI-8 ref: 00007FFE13303CBF
PyErr_Occurred.PYTHON311 ref: 00007FFE13303D19
PyEval_SaveThread.PYTHON311 ref: 00007FFE13303D41
PyErr_SetString.PYTHON311 ref: 00007FFE13308734
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE1330873F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13308772
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13308781

Strings

No ffi_type for result, xrefs: 00007FFE1330870A
exception: datatype misalignment, xrefs: 00007FFE13308867
exception: breakpoint encountered, xrefs: 00007FFE13308723
ctypes.seh_exception, xrefs: 00007FFE13308818
exception: single step, xrefs: 00007FFE1330885B
ffi_prep_cif failed, xrefs: 00007FFE13308713
exception: access violation reading %p, xrefs: 00007FFE13308890
exception: access violation writing %p, xrefs: 00007FFE133088A2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$_errno$Eval_FromOccurredSaveStringThreadWindowsffi_callffi_prep_cif
String ID: No ffi_type for result$ctypes.seh_exception$exception: access violation reading %p$exception: access violation writing %p$exception: breakpoint encountered$exception: datatype misalignment$exception: single step$ffi_prep_cif failed
API String ID: 1937973484-2749438402
Opcode ID: 430c0edaa122ef19808d40242a936452debd4f228559f93505334d9254383600
Instruction ID: 9abbb828b182f8044b8f15ae67e0c0af70de21f54517d952162034c0c4cd1b5e
Opcode Fuzzy Hash: 430c0edaa122ef19808d40242a936452debd4f228559f93505334d9254383600
Instruction Fuzzy Hash: B8817F76A0CE52CAE6A08F13E84027DA760FB64BB4F1040B5D96E67675DF3CE445C708

Function 00007FFE133041E0 Relevance: 45.7, APIs: 18, Strings: 8, Instructions: 214stringCOMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE13304230
PyUnicode_AsUTF8AndSize.PYTHON311 ref: 00007FFE13304268
strchr.VCRUNTIME140 ref: 00007FFE13304290
PyDict_Update.PYTHON311 ref: 00007FFE13304348
_Py_Dealloc.PYTHON311 ref: 00007FFE1330436B
PyObject_SetAttrString.PYTHON311 ref: 00007FFE13304425
PyObject_SetAttrString.PYTHON311 ref: 00007FFE13304438
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330444B
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330445E
PyErr_Occurred.PYTHON311 ref: 00007FFE1330448C
PyErr_Format.PYTHON311 ref: 00007FFE13308DBE
PyErr_Format.PYTHON311 ref: 00007FFE13308DDD

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

Part of subcall function 00007FFE1330455C: PyMem_Malloc.PYTHON311 ref: 00007FFE13304588

_Py_Dealloc.PYTHON311 ref: 00007FFE13308DEE
_Py_Dealloc.PYTHON311 ref: 00007FFE13308E07
PyErr_SetString.PYTHON311 ref: 00007FFE13308E57
_Py_Dealloc.PYTHON311 ref: 00007FFE13308E70
_Py_Dealloc.PYTHON311 ref: 00007FFE13308E7F

Strings

class must define a '_type_' attribute, xrefs: 00007FFE13308D87
class must define a '_type_' attribute which must be a string of length 1, xrefs: 00007FFE13308D9A
cbBhHiIlLdfuzZqQPXOv?g, xrefs: 00007FFE13304289, 00007FFE13308DAD
class must define a '_type_' string attribute, xrefs: 00007FFE13308E4D
__ctype_le__, xrefs: 00007FFE1330442E, 00007FFE13304441
class must define a '_type_' attribute which must bea single character string containing one of '%s'., xrefs: 00007FFE13308DB4
__ctype_be__, xrefs: 00007FFE13304418, 00007FFE13304454
_type_ '%s' not supported, xrefs: 00007FFE13308DD0

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Object_$AttrDeallocString$Err_$Format$CallDict_LookupMakeMallocMem_OccurredSizeUnicode_Updatestrchr
String ID: __ctype_be__$__ctype_le__$_type_ '%s' not supported$cbBhHiIlLdfuzZqQPXOv?g$class must define a '_type_' attribute$class must define a '_type_' attribute which must bea single character string containing one of '%s'.$class must define a '_type_' attribute which must be a string of length 1$class must define a '_type_' string attribute
API String ID: 692835343-917751260
Opcode ID: 1cbc2b4066554eb2cebf210fbf6479008959c66222fb09b3e1ad465d8608973f
Instruction ID: 45cec3fca596a4426b59d70a163ce787fc4e523a815f0172cf87d8912e8bd127
Opcode Fuzzy Hash: 1cbc2b4066554eb2cebf210fbf6479008959c66222fb09b3e1ad465d8608973f
Instruction Fuzzy Hash: E7A17B31A09F42C9EA508F27E8502BD77A0EF65BA4F0445B1DA6E6A375DF3CE084C308

Function 00007FFE13206D30 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 156threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206D82
PyErr_SetString.PYTHON311 ref: 00007FFE13206DB2
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206DFF
PySys_Audit.PYTHON311 ref: 00007FFE13206E36
PyOS_snprintf.PYTHON311 ref: 00007FFE13206E69
PyEval_SaveThread.PYTHON311 ref: 00007FFE13206E97
getaddrinfo.WS2_32 ref: 00007FFE13206EB3
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13206EBE
PyErr_SetString.PYTHON311 ref: 00007FFE13206EF5
htonl.WS2_32 ref: 00007FFE13206F15
PyEval_SaveThread.PYTHON311 ref: 00007FFE13206F25
getnameinfo.WS2_32 ref: 00007FFE13206F5D
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13206F68
PyUnicode_DecodeMBCS.PYTHON311 ref: 00007FFE13206FB2
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE13206FCB
freeaddrinfo.WS2_32 ref: 00007FFE13206FEE

Strings

socket.getnameinfo, xrefs: 00007FFE13206E2F
Oi:getnameinfo, xrefs: 00007FFE13206D65
(O), xrefs: 00007FFE13206E28
sockaddr resolved to multiple addresses, xrefs: 00007FFE13206EE4
si|II;getnameinfo(): illegal sockaddr argument, xrefs: 00007FFE13206DF8
getnameinfo() argument 1 must be a tuple, xrefs: 00007FFE13206DA8
surrogatepass, xrefs: 00007FFE13206FA7
, xrefs: 00007FFE13206F43
IPv4 sockaddr must be 2 tuple, xrefs: 00007FFE13206F87
getnameinfo(): flowinfo must be 0-1048575., xrefs: 00007FFE13206E1A

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Size$Arg_Err_ParseRestoreSaveStringTuple_$AuditBuildDecodeS_snprintfSys_Unicode_Value_freeaddrinfogetaddrinfogetnameinfohtonl
String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo$surrogatepass
API String ID: 2526741257-243639936
Opcode ID: 32c5094f76eca928cf06a7504f4b0eea5f1d8eabecbe481599927c462cdb4e09
Instruction ID: ed9127dc81116f57aab27a64335cf40e784305b589dce6bebcfb619f61eabcf5
Opcode Fuzzy Hash: 32c5094f76eca928cf06a7504f4b0eea5f1d8eabecbe481599927c462cdb4e09
Instruction Fuzzy Hash: 08815172A08F428AE720AF52E4442AE77B1FBD4BA4F500176DA4D63678DF7CE549CB40

Function 00007FFE133046D4 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE13304715
_PyLong_Sign.PYTHON311 ref: 00007FFE13304744
PyLong_AsSsize_t.PYTHON311 ref: 00007FFE13304757
_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE13304786

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

Part of subcall function 00007FFE13303A70: PyMem_Malloc.PYTHON311 ref: 00007FFE13303AB0

PyMem_Malloc.PYTHON311 ref: 00007FFE13304802
PyDict_Update.PYTHON311 ref: 00007FFE133048A9
_Py_Dealloc.PYTHON311 ref: 00007FFE133048CC
PyErr_SetString.PYTHON311 ref: 00007FFE13308F34
_Py_Dealloc.PYTHON311 ref: 00007FFE13308F45
_Py_Dealloc.PYTHON311 ref: 00007FFE13308F61
_Py_Dealloc.PYTHON311 ref: 00007FFE13308F77
PyErr_Occurred.PYTHON311 ref: 00007FFE13308F83
PyErr_ExceptionMatches.PYTHON311 ref: 00007FFE13308F9C
PyErr_SetString.PYTHON311 ref: 00007FFE13308FCC
_Py_Dealloc.PYTHON311 ref: 00007FFE13308FDB
_Py_Dealloc.PYTHON311 ref: 00007FFE13308FF0
_Py_Dealloc.PYTHON311 ref: 00007FFE13309003
PyErr_NoMemory.PYTHON311 ref: 00007FFE1330900F

Strings

class must define a '_type_' attribute, xrefs: 00007FFE13308F13
class must define a '_length_' attribute, xrefs: 00007FFE13308F0A
The '_length_' attribute must be an integer, xrefs: 00007FFE13308F52
array too large, xrefs: 00007FFE13308FC2
_type_ must have storage info, xrefs: 00007FFE13308FB2
The '_length_' attribute must not be negative, xrefs: 00007FFE13308F6E
The '_length_' attribute is too large, xrefs: 00007FFE13308F2A

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Err_$Object_$AttrLong_LookupMallocMem_String$CallDict_ExceptionMakeMatchesMemoryOccurredSignSsize_tUpdate
String ID: The '_length_' attribute is too large$The '_length_' attribute must be an integer$The '_length_' attribute must not be negative$_type_ must have storage info$array too large$class must define a '_length_' attribute$class must define a '_type_' attribute
API String ID: 4019195241-504660705
Opcode ID: 055b8fc62c60c1bd71026e2f714f2505c56a84889395af57f89967a2e91b601f
Instruction ID: 223270375ccf2d3632946dcdb457c73b96414a3df23ecdffe893e86f3287a901
Opcode Fuzzy Hash: 055b8fc62c60c1bd71026e2f714f2505c56a84889395af57f89967a2e91b601f
Instruction Fuzzy Hash: A3A11E31A09E02C9EA548F36E89027D67A1FF64BB4F0446B1DA7E662B5DF3CE545C308

Function 00007FFE1330A4C0 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FFE1330A4E1
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE1330A4FA
PyErr_Occurred.PYTHON311 ref: 00007FFE1330A509
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE1330A570
PyErr_Occurred.PYTHON311 ref: 00007FFE1330A57F
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE1330A5B7
PyErr_Occurred.PYTHON311 ref: 00007FFE1330A5C6
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE1330A5F5
PyErr_Occurred.PYTHON311 ref: 00007FFE1330A604
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1330A688
PyMem_Malloc.PYTHON311 ref: 00007FFE1330A6A5
PyErr_NoMemory.PYTHON311 ref: 00007FFE1330A6B3
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1330A6D9
PyMem_Free.PYTHON311 ref: 00007FFE1330A6E5
PyUnicode_New.PYTHON311 ref: 00007FFE1330A71D
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFE1330A735
PyList_New.PYTHON311 ref: 00007FFE1330A797
PyErr_SetString.PYTHON311 ref: 00007FFE1330A7DE

Strings

slice step cannot be zero, xrefs: 00007FFE1330A595
slice start is required for step < 0, xrefs: 00007FFE1330A55D
slice stop is required, xrefs: 00007FFE1330A5E2
Pointer indices must be integer, xrefs: 00007FFE1330A7D4

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Number_OccurredSsize_t$FromString$Bytes_Mem_SizeUnicode_$CharCheckFreeIndex_List_MallocMemoryWide
String ID: Pointer indices must be integer$slice start is required for step < 0$slice step cannot be zero$slice stop is required
API String ID: 3053630023-3059441807
Opcode ID: 6979928dfef85d8a828cd9ee037a140b3c1fa3fa22f5c964d232601827984960
Instruction ID: af6879d8550a719c9cde3074a2eb089fa6308092039236231c98b6d9521a62aa
Opcode Fuzzy Hash: 6979928dfef85d8a828cd9ee037a140b3c1fa3fa22f5c964d232601827984960
Instruction Fuzzy Hash: 9B914621B09E028AFA519B67E55413CA2A1BF74FB0F4487B1D93E677F5DE2CE4468308

Function 00007FFE132041C0 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 166threadstringCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON311 ref: 00007FFE13204212
getaddrinfo.WS2_32 ref: 00007FFE1320422E
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13204239
freeaddrinfo.WS2_32 ref: 00007FFE1320425C
PyErr_SetString.PYTHON311 ref: 00007FFE13204273
freeaddrinfo.WS2_32 ref: 00007FFE13204299
memcpy.VCRUNTIME140 ref: 00007FFE132042BB
freeaddrinfo.WS2_32 ref: 00007FFE132042C3
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE132042D7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE132042EE
inet_pton.WS2_32 ref: 00007FFE13204311
strchr.VCRUNTIME140 ref: 00007FFE13204330
inet_pton.WS2_32 ref: 00007FFE13204356
PyEval_SaveThread.PYTHON311 ref: 00007FFE1320437E
getaddrinfo.WS2_32 ref: 00007FFE13204396
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132043A1
memcpy.VCRUNTIME140 ref: 00007FFE132043D6
freeaddrinfo.WS2_32 ref: 00007FFE132043DE

Strings

unknown address family, xrefs: 00007FFE132043F3
unsupported address family, xrefs: 00007FFE13204262
wildcard resolved to multiple address, xrefs: 00007FFE1320429F
255.255.255.255, xrefs: 00007FFE132042D0
address family mismatched, xrefs: 00007FFE13204415
<broadcast>, xrefs: 00007FFE132042E4

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Threadfreeaddrinfo$RestoreSavegetaddrinfoinet_ptonmemcpystrcmp$Err_Stringstrchr
String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
API String ID: 535957624-1715193308
Opcode ID: cdefa8b7dc4e1c9f1d37940d2dd5b1f1bb56c3d4d45ba7a3aa08869bb9be269c
Instruction ID: 19b7fa322d47d6559d1b4d7494f8cbd1492fcd83e2fcbf38dac7b239fbee5e44
Opcode Fuzzy Hash: cdefa8b7dc4e1c9f1d37940d2dd5b1f1bb56c3d4d45ba7a3aa08869bb9be269c
Instruction Fuzzy Hash: 6571A061E08F428AE724AF27A54027D23A0BFE4B64F508276DA4D736B1DF7CE589C700

Function 00007FFE1330C6B4 Relevance: 42.1, APIs: 21, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON311 ref: 00007FFE1330C6E7
PyImport_ImportModule.PYTHON311 ref: 00007FFE1330C6FB
PyObject_GetAttrString.PYTHON311 ref: 00007FFE1330C717
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C729
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE1330C73B
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE1330C747
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE1330C753
PyObject_CallFunctionObjArgs.PYTHON311 ref: 00007FFE1330C789
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C79C
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C7AB
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C7BA
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C7C9
PyLong_AsLong.PYTHON311 ref: 00007FFE1330C7DB
PyErr_Occurred.PYTHON311 ref: 00007FFE1330C7E3
PyErr_WriteUnraisable.PYTHON311 ref: 00007FFE1330C803
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C817
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C82B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C83F
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C853
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C862
PyErr_WriteUnraisable.PYTHON311 ref: 00007FFE1330C87D

Strings

_ctypes.DllGetClassObject, xrefs: 00007FFE1330C6E0
DllGetClassObject, xrefs: 00007FFE1330C70D
ctypes, xrefs: 00007FFE1330C6F4

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$FromLong_$Err_Void$Object_StringUnraisableWrite$ArgsAttrCallFunctionImportImport_InternLongModuleOccurredUnicode_
String ID: DllGetClassObject$_ctypes.DllGetClassObject$ctypes
API String ID: 375360433-177550262
Opcode ID: b5513430baef804698b72f87c032f2232b88aa434da5969d4ce7dec095e12011
Instruction ID: 8be47f3b8dbc8e918be2e98ffb5c6d3dbb5b9cd14d9964a0cbe8566fb758b32d
Opcode Fuzzy Hash: b5513430baef804698b72f87c032f2232b88aa434da5969d4ce7dec095e12011
Instruction Fuzzy Hash: 9E51BB25F09F02C9FE559F23A95823DA3A0BF65FA5F0841B4D96E2A771DF3CA4458308

Function 00007FFE130C2260 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 202timethreadnetworkCOMMON

Download Yara Rule

APIs

_PyTime_FromSecondsObject.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C22BF
PyErr_ExceptionMatches.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C22D3
PyErr_SetString.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C231F

Part of subcall function 00007FFE130C25C8: PySequence_Fast.PYTHON311(00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C25F0

_PyDeadline_Init.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C23DA
PyEval_SaveThread.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C241A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2423
select.WS2_32(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C243D
PyEval_RestoreThread.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2449
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C244F
PyErr_CheckSignals.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C245E
_PyDeadline_Get.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2479
_PyTime_AsTimeval_clamp.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2497
PyErr_Occurred.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C24F2
PyTuple_Pack.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2509
_Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2520
_Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2534
_Py_Dealloc.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C2548
WSAGetLastError.WS2_32(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C25AE
PyErr_SetExcFromWindowsErr.PYTHON311(?,?,?,00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C25C0

Part of subcall function 00007FFE130C25C8: PyObject_AsFileDescriptor.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C265C
Part of subcall function 00007FFE130C25C8: PyErr_SetString.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26CA
Part of subcall function 00007FFE130C25C8: _Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26D9
Part of subcall function 00007FFE130C25C8: _Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26E8

Part of subcall function 00007FFE130C25C8: _Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26FE

Strings

timeout must be non-negative, xrefs: 00007FFE130C2315
timeout must be a float or None, xrefs: 00007FFE130C22E4

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_$Deadline_Eval_FromStringThreadTime__errno$CheckDescriptorErrorExceptionFastFileInitLastMatchesObjectObject_OccurredPackRestoreSaveSecondsSequence_SignalsTimeval_clampTuple_Windowsselect
String ID: timeout must be a float or None$timeout must be non-negative
API String ID: 1581318368-2150404077
Opcode ID: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
Instruction ID: 0d0ccfb523f8f69407f6ea346ff704b20fe0101c510c8ac5c401419013793413
Opcode Fuzzy Hash: af26c906d80cdcaef9b1c7707cf0177dbe53b8e671061a6009a46fe445b3fcbf
Instruction Fuzzy Hash: BF918161A18E838DEA209F26E8541B963E6FF64BA4F8041F1DD0D67AB8DF3CD645C300

Function 00007FFE13302E40 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311 ref: 00007FFE13302E50
PyErr_Occurred.PYTHON311 ref: 00007FFE13302E69
PyMem_Malloc.PYTHON311 ref: 00007FFE13302EAE
PyObject_CallFunction.PYTHON311 ref: 00007FFE13302EFC
PyMem_Free.PYTHON311 ref: 00007FFE13302F08
PyDict_SetItem.PYTHON311 ref: 00007FFE13302F23
PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE13307BAD
PyMem_Malloc.PYTHON311 ref: 00007FFE13307BD3
PyObject_CallFunction.PYTHON311 ref: 00007FFE13307C0B
PyMem_Free.PYTHON311 ref: 00007FFE13307C17
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE13307C29
_Py_Dealloc.PYTHON311 ref: 00007FFE13307C48
PyErr_SetString.PYTHON311 ref: 00007FFE13307CA8

Strings

s(O){sO}, xrefs: 00007FFE13302EF5
must be a ctypes type, xrefs: 00007FFE13307C9E
_type_, xrefs: 00007FFE13302EDA
LP_%s, xrefs: 00007FFE13302EC4, 00007FFE13307BE4
s(O){}, xrefs: 00007FFE13307C04

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_$CallDict_Err_FreeFunctionItemMallocObject_$DeallocErrorFromLong_OccurredStringUnicode_VoidWith
String ID: LP_%s$_type_$must be a ctypes type$s(O){sO}$s(O){}
API String ID: 2461613936-2311978994
Opcode ID: dac97228159b1c0431957491c5f87e729db2124b065f25bc7d08890040e0cdb2
Instruction ID: c0256a0744acaaf55b5d386a0bc8e046d056f331a630a4cf92cfd6975c98151f
Opcode Fuzzy Hash: dac97228159b1c0431957491c5f87e729db2124b065f25bc7d08890040e0cdb2
Instruction Fuzzy Hash: A6513F21E0DE47C9FA558B27A95417CA3A0AF65BF1F0802B1D93E767B6DE3CE4458308

Function 00007FFE13203588 Relevance: 35.2, APIs: 11, Strings: 9, Instructions: 167networkCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFE1320368E
PyErr_Format.PYTHON311 ref: 00007FFE132037DF
_Py_Dealloc.PYTHON311 ref: 00007FFE1320382F
htons.WS2_32 ref: 00007FFE1320384A

Strings

%s(): unknown Bluetooth protocol, xrefs: 00007FFE132035E4
O&i;AF_INET address must be a pair (host, port), xrefs: 00007FFE132037A5
%s(): bad family, xrefs: 00007FFE132035CB
%s(): AF_INET6 address must be tuple, not %.500s, xrefs: 00007FFE13203675
%s(): AF_INET address must be tuple, not %.500s, xrefs: 00007FFE13203782
%s(): flowinfo must be 0-1048575., xrefs: 00007FFE1320372E
O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]]), xrefs: 00007FFE132036BF
%s(): port must be 0-65535., xrefs: 00007FFE132037CA
%s(): wrong format, xrefs: 00007FFE1320361C

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_Format$Deallochtons
String ID: %s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$%s(): unknown Bluetooth protocol$%s(): wrong format$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])
API String ID: 2819711985-3893595010
Opcode ID: 345e012d61b2e8659524b3f56b858863a74126cd3a1e83b1df232dfea0b2f435
Instruction ID: 03d679b6e56c453c60eec30f9306fb0f5afa4b653d12c3d59d9b69b1c84886bc
Opcode Fuzzy Hash: 345e012d61b2e8659524b3f56b858863a74126cd3a1e83b1df232dfea0b2f435
Instruction Fuzzy Hash: 6D812DB6A08F4689EB10AF62D8402BE37A0FBE4B68F504172DA0D676B4DF7CD448C740

Function 00007FFE13309798 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FFE133097B3
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE133097CC
PyErr_Occurred.PYTHON311 ref: 00007FFE133097DB
PySlice_Unpack.PYTHON311 ref: 00007FFE13309825
PySlice_AdjustIndices.PYTHON311 ref: 00007FFE13309843
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1330988C
PyMem_Malloc.PYTHON311 ref: 00007FFE133098AD
PyErr_NoMemory.PYTHON311 ref: 00007FFE133098BB
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE133098E3
PyMem_Free.PYTHON311 ref: 00007FFE133098EF
PyUnicode_New.PYTHON311 ref: 00007FFE13309924
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFE13309941
PyList_New.PYTHON311 ref: 00007FFE133099A2

Strings

indices must be integers, xrefs: 00007FFE133099FD

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: From$Bytes_Err_Mem_SizeSlice_StringUnicode_$AdjustCharCheckFreeIndex_IndicesList_MallocMemoryNumber_OccurredSsize_tUnpackWide
String ID: indices must be integers
API String ID: 4188490530-2024404580
Opcode ID: e570ecff3f3fa346b7648cae94d04275b3108b85bd0816525fe5c5b16466f0b5
Instruction ID: f87a6755c914ab0425020c4ad3fadac34fca0c14ccde29e4162404794eafa865
Opcode Fuzzy Hash: e570ecff3f3fa346b7648cae94d04275b3108b85bd0816525fe5c5b16466f0b5
Instruction Fuzzy Hash: 11717F22B09E42CAEA549B27995407CA361FFA4BF4B0445B1ED3E67BF5DE3CE4458308

Function 00007FFE1330D4A0 Relevance: 33.3, APIs: 18, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PyUnicode_FromFormatV.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D4C5
PyErr_Fetch.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D4E4
PyErr_NormalizeException.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D4F6
PyType_GetName.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D50D
PyObject_Str.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D515
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D527
PyUnicode_FromString.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D534
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D541
PyErr_Clear.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D550
PyObject_Str.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D55A
PyErr_Clear.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D565
PyUnicode_FromString.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D572
PyUnicode_AppendAndDel.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D57F
PyErr_SetObject.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D594
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D5A9
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D5BE
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D5D3
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,00000000,?,00007FFE13307997), ref: 00007FFE1330D5E8

Strings

???, xrefs: 00007FFE1330D56B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Unicode_$Err_$Dealloc$AppendFrom$ClearObject_String$ExceptionFetchFormatNameNormalizeObjectType_
String ID: ???
API String ID: 979652146-1053719742
Opcode ID: a0277b81e7bf4beead51eb80468770295d906e45afe09c37c0bcdcee4447fb49
Instruction ID: 439e8ae1135cfa9c904d73ad39802124806421b5d995c8caceb2982bfc0dd194
Opcode Fuzzy Hash: a0277b81e7bf4beead51eb80468770295d906e45afe09c37c0bcdcee4447fb49
Instruction Fuzzy Hash: F041E862B09E02CDFF459BA6D8582BC63B0AF64B68F044475DD2E62675DF3CA485C318

Function 00007FFE13309E68 Relevance: 33.3, APIs: 13, Strings: 6, Instructions: 78threadlibraryloaderCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13309E90
PySys_Audit.PYTHON311 ref: 00007FFE13309EAB
PyObject_GetAttrString.PYTHON311 ref: 00007FFE13309EC1
PyErr_SetString.PYTHON311 ref: 00007FFE13309EF0
_Py_Dealloc.PYTHON311 ref: 00007FFE13309EFF
PyLong_AsVoidPtr.PYTHON311 ref: 00007FFE13309F1A
_Py_Dealloc.PYTHON311 ref: 00007FFE13309F2C
PyErr_Occurred.PYTHON311 ref: 00007FFE13309F32
PyErr_SetString.PYTHON311 ref: 00007FFE13309F4E
PyEval_SaveThread.PYTHON311 ref: 00007FFE13309F56
GetProcAddress.KERNEL32 ref: 00007FFE13309F67
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13309F73
PyErr_Format.PYTHON311 ref: 00007FFE13309F94

Strings

ctypes.dlsym, xrefs: 00007FFE13309EA4
Os:in_dll, xrefs: 00007FFE13309E89
could not convert the _handle attribute to a pointer, xrefs: 00007FFE13309F44
the _handle attribute of the second argument must be an integer, xrefs: 00007FFE13309EE6
symbol '%s' not found, xrefs: 00007FFE13309F85
_handle, xrefs: 00007FFE13309EBA

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$String$DeallocEval_Thread$AddressArg_AttrAuditFormatLong_Object_OccurredParseProcRestoreSaveSizeSys_Tuple_Void
String ID: Os:in_dll$_handle$could not convert the _handle attribute to a pointer$ctypes.dlsym$symbol '%s' not found$the _handle attribute of the second argument must be an integer
API String ID: 1915345233-3856192562
Opcode ID: 7ca03c74892ce7554a02cb8c30f6c35098380688a7c70d2a3342523bcc2a4215
Instruction ID: 1f5b6d6a4a22c2fa21b2674069a0eb2e943ff9f244838c997cb99404871710aa
Opcode Fuzzy Hash: 7ca03c74892ce7554a02cb8c30f6c35098380688a7c70d2a3342523bcc2a4215
Instruction Fuzzy Hash: AE310A21B08E42C9EA449F27E844178A3A0FFA4FE5F0541B6E92E67775DF6CE449C708

Function 00007FFE132032E8 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 173networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FFE13203313

Part of subcall function 00007FFE13204088: _Py_BuildValue_SizeT.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE1320409E
Part of subcall function 00007FFE13204088: PyErr_SetObject.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE132040B6
Part of subcall function 00007FFE13204088: _Py_Dealloc.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE132040C5

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13203330
PyErr_SetFromErrno.PYTHON311 ref: 00007FFE13203346

Strings

NOO, xrefs: 00007FFE132034FD
unsupported address family, xrefs: 00007FFE1320351C
surrogatepass, xrefs: 00007FFE132034E8

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$BuildDeallocErrnoErrorFromLastObjectSizeValue__errno
String ID: NOO$surrogatepass$unsupported address family
API String ID: 316901363-472101058
Opcode ID: dcd42529ef49c9ac7a46733f8ddf47eaf21d2d38896ab5ee38034c2f4b85ccb4
Instruction ID: 23fcdfb28733bde5e7f2b71a4ab45375d3fb666bde52cd0ebf1e113d35fa1433
Opcode Fuzzy Hash: dcd42529ef49c9ac7a46733f8ddf47eaf21d2d38896ab5ee38034c2f4b85ccb4
Instruction Fuzzy Hash: 00716722A18F8289EA55AB26E44417E67A0FFE4BA4F044575DB4E67774EF3CE449C300

Function 00007FFE1330F724 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F756
PySequence_Fast.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F772
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F784
PyArg_ParseTuple.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F7E8
PyObject_GetAttr.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F802
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F854
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F8D0
PyObject_SetAttr.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F8E4
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F8F8
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F917
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F931
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F940
PyErr_SetString.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F972
_Py_Dealloc.PYTHON311(?,?,?,?,?,00000018,00000000,00000018,00000000,?,?,00007FFE13308C2F), ref: 00007FFE1330F983

Strings

_fields_, xrefs: 00007FFE1330F748
_fields_ must be a sequence, xrefs: 00007FFE1330F768
unexpected type, xrefs: 00007FFE1330F968
OO|O, xrefs: 00007FFE1330F7E1

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$AttrObject_$String$Arg_Err_FastParseSequence_Tuple
String ID: OO|O$_fields_$_fields_ must be a sequence$unexpected type
API String ID: 1182381414-2418103425
Opcode ID: 9a21982e818a441de51ee13329167cb0591f09edfc229330b12a1e4341a6436c
Instruction ID: 61f6ebe62f71975031af7b284b3e461677afcee4c305de32e8164eef0709a802
Opcode Fuzzy Hash: 9a21982e818a441de51ee13329167cb0591f09edfc229330b12a1e4341a6436c
Instruction Fuzzy Hash: 3C615E72A08F469AEA548B27E94417DB3A0FB65BB0F044175DAAD23B74DF3CE459C308

Function 00007FFE13305028 Relevance: 30.1, APIs: 20, Instructions: 148COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330504E
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305065
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330507D
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050A0
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050C6
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050EC
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305112
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305138
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330515E
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305181
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051A7
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051CD
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051F3
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305219
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330523F
PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330526C
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305281
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133052A0
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133052B1
PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133052D3

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: ReadyType_$Module_Type
String ID:
API String ID: 2298540608-0
Opcode ID: 54f91af859aac5329c47ad103bf883f4ecd078e41e036d01a27fff442e20b039
Instruction ID: 544d0cf561773f0b8b2989b2dc439c2dbebda3759f157ea5b3d9fe8da2be7baa
Opcode Fuzzy Hash: 54f91af859aac5329c47ad103bf883f4ecd078e41e036d01a27fff442e20b039
Instruction Fuzzy Hash: 6771C320B0CE03DAF6018B13BD44169B7A8BF20BA4F4440B5E86DA7276DF3CE046831C

Function 00007FFE1A45C78C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C81D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C856
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C92A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C93B
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C9A3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C9B3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C9FF
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CA11
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CB83

Part of subcall function 00007FFE1A45E72C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45E786

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CC05
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CC14

Strings

`anonymous namespace', xrefs: 00007FFE1A45CAE3

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID: `anonymous namespace'
API String ID: 3863519203-3062148218
Opcode ID: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
Instruction ID: 6a758915081d58248ca3c32c78a191dc0b8c5a9bcc3ca2fce3e8a3b1add8117b
Opcode Fuzzy Hash: 29843075ff213e4678463bd9e4c4852a4219599ce3764149382065ef125c3596
Instruction Fuzzy Hash: 89E15AB2B08F8295EB10EF26E4801BC7BA0FB45BA4F5041B6EA5D57B65DF38E564C700

Function 00007FFE133026C0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 191COMMON

Download Yara Rule

Strings

this function takes %d argument%s (%d given), xrefs: 00007FFE133074F4
COM method call without VTable, xrefs: 00007FFE133073EB
this function takes at least %d argument%s (%d given), xrefs: 00007FFE13307414
NULL COM pointer access, xrefs: 00007FFE133074C3
Expected a COM this pointer as first argument, xrefs: 00007FFE13307469
native com method call without 'this' parameter, xrefs: 00007FFE133073E2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: COM method call without VTable$Expected a COM this pointer as first argument$NULL COM pointer access$native com method call without 'this' parameter$this function takes %d argument%s (%d given)$this function takes at least %d argument%s (%d given)
API String ID: 0-1981512665
Opcode ID: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
Instruction ID: e20fc0e3e0c10f50cb0623592af98fa4fa4a5d844827a0d181eef163f3f54a7c
Opcode Fuzzy Hash: f07b7bceabcce526c4a62d906a5ec0dd6d9bc262e596e910abc21d3a49bdda52
Instruction Fuzzy Hash: C2914A26A08F42C9EA61CB27E44027EA7A0FB64BA4F0440B1DEAD67775DF3CE445C708

Function 00007FFE13302C90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13302D68
PyLong_AsUnsignedLong.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A1F
PyErr_Occurred.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A31
PyErr_Clear.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A40
PyLong_AsLong.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A49
PyErr_Occurred.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A5B
PyErr_SetString.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A7B
PyUnicode_AsWideCharString.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307A98
PyCapsule_New.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307ABC
PyMem_Free.PYTHON311(?,?,00000001,00007FFE13302C87), ref: 00007FFE13307AD3

Strings

_ctypes pymem, xrefs: 00007FFE13307AB5
Don't know how to convert parameter %d, xrefs: 00007FFE13307B27
int too long to convert, xrefs: 00007FFE13307A71

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$String$LongLong_Occurred$Bytes_Capsule_CharClearFreeMem_Unicode_UnsignedWide
String ID: Don't know how to convert parameter %d$_ctypes pymem$int too long to convert
API String ID: 3969321993-4137960972
Opcode ID: 84a72b6a64f7e58ef7106ff91161727bef33725574b0370cedf856625ec34b12
Instruction ID: ecb341416fa6edc03293b05184f78b650cb4963097775a5711aee0ce6f345dfa
Opcode Fuzzy Hash: 84a72b6a64f7e58ef7106ff91161727bef33725574b0370cedf856625ec34b12
Instruction Fuzzy Hash: 19511832B09F42CAEB458F26E88413C63A0FB68BA4B1445B5DA7DA3775DF3CE4558348

Function 00007FFE13301404 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFE13301458
PyTuple_Pack.PYTHON311 ref: 00007FFE13301475
_Py_Dealloc.PYTHON311 ref: 00007FFE133014AD
PyErr_Occurred.PYTHON311 ref: 00007FFE133014D9
_PyObject_CallFunction_SizeT.PYTHON311 ref: 00007FFE1330154D
PyDict_New.PYTHON311 ref: 00007FFE13301584
_Py_Dealloc.PYTHON311 ref: 00007FFE13306A03

Part of subcall function 00007FFE133015A4: PyDict_GetItemWithError.PYTHON311(?,?,?,?,00007FFE13301499), ref: 00007FFE133015AF

Strings

%.200s_Array_%Id, xrefs: 00007FFE133014FD
_length_, xrefs: 00007FFE13301529
s(O){s:n,s:O}, xrefs: 00007FFE1330153F
_type_, xrefs: 00007FFE13301516
Expected a type object, xrefs: 00007FFE13306A16
Array length must be >= 0, not %zd, xrefs: 00007FFE133069EE

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocDict_$CallErr_ErrorFromFunction_ItemLong_Object_OccurredPackSizeSsize_tTuple_With
String ID: %.200s_Array_%Id$Array length must be >= 0, not %zd$Expected a type object$_length_$_type_$s(O){s:n,s:O}
API String ID: 2975079148-1488966637
Opcode ID: 4b9e39d2e5c219fd7f77c84992df2d80c2fda8daf9d237960527683bdad92fae
Instruction ID: f8c9830053603b16ba94878c3041a55d0eef9c31ed1bb8cb4eaf9397d37b4a99
Opcode Fuzzy Hash: 4b9e39d2e5c219fd7f77c84992df2d80c2fda8daf9d237960527683bdad92fae
Instruction Fuzzy Hash: D2515D25E09F42C9FA519B57E9502B9A3A0EF68BB4F1444B1D92E2A375EE3CE0458348

Function 00007FFE13309A88 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE13309ABE
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13309AE7
PyMemoryView_FromObject.PYTHON311 ref: 00007FFE13309AF6
PyBuffer_IsContiguous.PYTHON311 ref: 00007FFE13309B1C
PyErr_SetString.PYTHON311 ref: 00007FFE13309B51
PyErr_Format.PYTHON311 ref: 00007FFE13309B84
PySys_Audit.PYTHON311 ref: 00007FFE13309BA5
_Py_Dealloc.PYTHON311 ref: 00007FFE13309BD4

Strings

ctypes.cdata/buffer, xrefs: 00007FFE13309B9E
underlying buffer is not writable, xrefs: 00007FFE13309B0E
abstract class, xrefs: 00007FFE13309AB4
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FFE13309B7A
offset cannot be negative, xrefs: 00007FFE13309B47
O|n:from_buffer, xrefs: 00007FFE13309AE0
nnn, xrefs: 00007FFE13309B97
underlying buffer is not C contiguous, xrefs: 00007FFE13309B26

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$String$Arg_AuditBuffer_ContiguousDeallocFormatFromMemoryObjectParseSizeSys_Tuple_View_
String ID: Buffer size too small (%zd instead of at least %zd bytes)$O|n:from_buffer$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$underlying buffer is not C contiguous$underlying buffer is not writable
API String ID: 3947696715-3790261066
Opcode ID: 6f91a64f5329831d1cdf7c4b25470fb5dbaa7ad2f9e3551f3ba25eea1f825ae0
Instruction ID: e2f927dfa2007ae2b50283f17dd8118b8cec94099bb47179128c5b748fa4ccf5
Opcode Fuzzy Hash: 6f91a64f5329831d1cdf7c4b25470fb5dbaa7ad2f9e3551f3ba25eea1f825ae0
Instruction Fuzzy Hash: 5A415C61B09E42C9EA14CB27E8501BD63A1AFA8BF4F0441B1D93D676B5DF6CE544C308

Function 00007FFE1330D5F8 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 79threadCOMMON

Download Yara Rule

APIs

PyThreadState_GetDict.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D610
PyErr_SetString.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D62F
PyUnicode_InternFromString.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D660
PyDict_GetItemWithError.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D678
PyCapsule_IsValid.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D690
PyCapsule_GetPointer.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D6B0
PyErr_Occurred.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D6C1
PyMem_Calloc.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D6D6
PyCapsule_New.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D6F9
PyMem_Free.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D70A
PyDict_SetItem.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D722
_Py_Dealloc.PYTHON311(?,?,?,00007FFE13308759), ref: 00007FFE1330D73E

Strings

ctypes.error_object is an invalid capsule, xrefs: 00007FFE1330D69A
_ctypes pymem, xrefs: 00007FFE1330D686, 00007FFE1330D6A6, 00007FFE1330D6F2
cannot get thread state, xrefs: 00007FFE1330D61E
ctypes.error_object, xrefs: 00007FFE1330D659

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Capsule_$Dict_Err_ItemMem_String$CallocDeallocDictErrorFreeFromInternOccurredPointerState_ThreadUnicode_ValidWith
String ID: _ctypes pymem$cannot get thread state$ctypes.error_object$ctypes.error_object is an invalid capsule
API String ID: 2323834031-3474121714
Opcode ID: accf9b440147d9a92cb32684a6abaa720b59604840fdd08eebf715022aa40aa7
Instruction ID: 2746d1ab0b1a6da271bd43b0a3123dae39644e27240775214a939425a0924ecf
Opcode Fuzzy Hash: accf9b440147d9a92cb32684a6abaa720b59604840fdd08eebf715022aa40aa7
Instruction Fuzzy Hash: F5314860B0AF46C9FA549B17E85813C63E0AF68BB5B8444B4D82E63775EF3CE4458308

Function 00007FFE13304118 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

PySequence_Tuple.PYTHON311 ref: 00007FFE13304130
PyTuple_New.PYTHON311 ref: 00007FFE13304157
_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE1330418A
PyErr_SetString.PYTHON311 ref: 00007FFE13308CDD
PyErr_Format.PYTHON311 ref: 00007FFE13308CFA
_Py_Dealloc.PYTHON311 ref: 00007FFE13308D10
PyErr_Format.PYTHON311 ref: 00007FFE13308D2A
_Py_Dealloc.PYTHON311 ref: 00007FFE13308D3B
_Py_Dealloc.PYTHON311 ref: 00007FFE13308D4C
_Py_Dealloc.PYTHON311 ref: 00007FFE13308D5B
PyErr_Occurred.PYTHON311 ref: 00007FFE13308D61
_Py_Dealloc.PYTHON311 ref: 00007FFE13308D74

Strings

item %zd in _argtypes_ has no from_param method, xrefs: 00007FFE13308CF0
_argtypes_ must be a sequence of types, xrefs: 00007FFE13308CD3
_argtypes_ has too many arguments (%zi), maximum is %i, xrefs: 00007FFE13308D1D

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Err_$Format$AttrLookupObject_OccurredSequence_StringTupleTuple_
String ID: _argtypes_ has too many arguments (%zi), maximum is %i$_argtypes_ must be a sequence of types$item %zd in _argtypes_ has no from_param method
API String ID: 4102822968-1150265712
Opcode ID: b465a1dad8b079f441bebe69d373bb45d8456e0132b52fc939e0217758a31e23
Instruction ID: aca1c0e890f3d3d8d180834f10bc3e673cbfeca3a79e505dd6876c451c5d7d84
Opcode Fuzzy Hash: b465a1dad8b079f441bebe69d373bb45d8456e0132b52fc939e0217758a31e23
Instruction Fuzzy Hash: 55411B22B09E03C9EA558F27E84417CA7A0AFB5FB4F0401B1D93E6A775DE3CE5468708

Function 00007FFE132038E4 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON311 ref: 00007FFE13203923
PyBytes_Size.PYTHON311 ref: 00007FFE13203930
PyErr_SetString.PYTHON311 ref: 00007FFE132039E5
_Py_Dealloc.PYTHON311 ref: 00007FFE13203A67

Strings

host name must not contain null character, xrefs: 00007FFE13203A6D
idna, xrefs: 00007FFE132039BC
str, bytes or bytearray expected, not %s, xrefs: 00007FFE13203A0A
encoding of hostname failed, xrefs: 00007FFE132039D4

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Bytes_String$DeallocErr_Size
String ID: encoding of hostname failed$host name must not contain null character$idna$str, bytes or bytearray expected, not %s
API String ID: 2522550923-2120988924
Opcode ID: 3f218649045629f6069e9841134a8ddc55994a625152d29d63930f96b81b775f
Instruction ID: 1a18dfdc74f71736e6dcb3b4e97800e721d11117a3712abc008195b3d88795b7
Opcode Fuzzy Hash: 3f218649045629f6069e9841134a8ddc55994a625152d29d63930f96b81b775f
Instruction Fuzzy Hash: 54414261A08F0689EB54AB57E49033E2760AFE5BB4F1445B5CB5E672B0DF7CE459C300

Function 00007FFE1330D2E0 Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 104COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330D350
PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330D3F1
PyFloat_FromDouble.PYTHON311 ref: 00007FFE1330D431
PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330D44D
_Py_Dealloc.PYTHON311 ref: 00007FFE1330D45F

Strings

<cparam '%c' (%ld)>, xrefs: 00007FFE1330D3FD
<cparam '%c' (%lld)>, xrefs: 00007FFE1330D3E3
<cparam '%c' at %p>, xrefs: 00007FFE1330D3C8
<cparam '%c' ('\x%02x')>, xrefs: 00007FFE1330D37E
<cparam '%c' (%R)>, xrefs: 00007FFE1330D443
<cparam '%c' (%d)>, xrefs: 00007FFE1330D346
<cparam '%c' ('%c')>, xrefs: 00007FFE1330D370
<cparam '%c' (%p)>, xrefs: 00007FFE1330D3DA
<cparam 0x%02x at %p>, xrefs: 00007FFE1330D3D1

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: From$FormatUnicode_$DeallocDoubleFloat_
String ID: <cparam '%c' (%R)>$<cparam '%c' (%d)>$<cparam '%c' (%ld)>$<cparam '%c' (%lld)>$<cparam '%c' (%p)>$<cparam '%c' ('%c')>$<cparam '%c' ('\x%02x')>$<cparam '%c' at %p>$<cparam 0x%02x at %p>
API String ID: 1798191970-1075073485
Opcode ID: e630b7be73e712d3a37526d796ee4f4f39b16323d62473f23fa0d0fb00351437
Instruction ID: d331ff3eaaabff9b745cb65fdf491ac65fffc49a9a2019ce485f5b4e1e6da1f5
Opcode Fuzzy Hash: e630b7be73e712d3a37526d796ee4f4f39b16323d62473f23fa0d0fb00351437
Instruction Fuzzy Hash: 49416F21A0CD438DE6698B3B945C03C6AE1EF76B74F1801F0C56E265BADE2CF945C748

Function 00007FFE13206200 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206230
setsockopt.WS2_32 ref: 00007FFE1320625A
PyErr_Clear.PYTHON311 ref: 00007FFE13206267
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132062AB
PyErr_Clear.PYTHON311 ref: 00007FFE132062C2
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132062EC
PyBuffer_Release.PYTHON311 ref: 00007FFE13206308
PyErr_Format.PYTHON311 ref: 00007FFE13206325
setsockopt.WS2_32 ref: 00007FFE1320634B
PyBuffer_Release.PYTHON311 ref: 00007FFE13206358

Strings

iii:setsockopt, xrefs: 00007FFE13206229
iiy*:setsockopt, xrefs: 00007FFE132062E5
iiO!I:setsockopt, xrefs: 00007FFE13206284
socket option is larger than %i bytes, xrefs: 00007FFE13206315

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$Buffer_ClearReleasesetsockopt$Format
String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
API String ID: 418579395-1608436615
Opcode ID: 038f49541202c8c9e344ee84141582b914636cdd657cab73a632a64df90ac60f
Instruction ID: 8253bb9efe1b22da5d25b6aa07c36b6ce7f2842316b75d79b2e57b4cce3d5ab1
Opcode Fuzzy Hash: 038f49541202c8c9e344ee84141582b914636cdd657cab73a632a64df90ac60f
Instruction Fuzzy Hash: 4D410D72608E869ADB209F62E8406AE7770FBD8BA4F500271DA9D53674DF7CD50CCB40

Function 00007FFE13309C0C Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE13309C49
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13309C6D
PyErr_SetString.PYTHON311 ref: 00007FFE13309C95
PyBuffer_Release.PYTHON311 ref: 00007FFE13309CA0
PyErr_Format.PYTHON311 ref: 00007FFE13309CD4
PySys_Audit.PYTHON311 ref: 00007FFE13309CF7
memcpy.VCRUNTIME140 ref: 00007FFE13309D2B
PyBuffer_Release.PYTHON311 ref: 00007FFE13309D38

Strings

ctypes.cdata/buffer, xrefs: 00007FFE13309CF0
abstract class, xrefs: 00007FFE13309C3F
y*|n:from_buffer_copy, xrefs: 00007FFE13309C66
Buffer size too small (%zd instead of at least %zd bytes), xrefs: 00007FFE13309CCA
offset cannot be negative, xrefs: 00007FFE13309C8B
nnn, xrefs: 00007FFE13309CE9

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Buffer_ReleaseString$Arg_AuditFormatParseSizeSys_Tuple_memcpy
String ID: Buffer size too small (%zd instead of at least %zd bytes)$abstract class$ctypes.cdata/buffer$nnn$offset cannot be negative$y*|n:from_buffer_copy
API String ID: 2374319793-1742308441
Opcode ID: 2d8fddc9779f14f0481d8ddfd406fb15762d92becc72ec0614fe25a827832394
Instruction ID: e0a1c59dbce8be94849c2666aec59e14745a531f7f075425afe2b02e00910208
Opcode Fuzzy Hash: 2d8fddc9779f14f0481d8ddfd406fb15762d92becc72ec0614fe25a827832394
Instruction Fuzzy Hash: A3311B61B18F46C9EA54CB17E8402A9A360FFA9BE0F4040B2DA6E67775DE3CE445C708

Function 00007FFE1330C224 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_PyArg_NoKeywords.PYTHON311 ref: 00007FFE1330C246
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1330C272
PySequence_GetSlice.PYTHON311 ref: 00007FFE1330C28C
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330C2AB
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C2BC
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330C2D5
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330C2EE
PyObject_SetAttrString.PYTHON311 ref: 00007FFE1330C307
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C322

Strings

OOO:COMError, xrefs: 00007FFE1330C26B
details, xrefs: 00007FFE1330C2FD
args, xrefs: 00007FFE1330C2A1
hresult, xrefs: 00007FFE1330C2CB
text, xrefs: 00007FFE1330C2E4

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AttrObject_String$Arg_Dealloc$KeywordsParseSequence_SizeSliceTuple_
String ID: OOO:COMError$args$details$hresult$text
API String ID: 4238450639-2065934886
Opcode ID: 7b88bc987767ef29d30f6af4a34bd6ec754f27a2cd5e2595f319dc9faf46bccc
Instruction ID: 9c6e6aa6e2786b8f8de3ad89fde33631c2df5d316a648d6196aae1e302e95df2
Opcode Fuzzy Hash: 7b88bc987767ef29d30f6af4a34bd6ec754f27a2cd5e2595f319dc9faf46bccc
Instruction Fuzzy Hash: FB312971B18F4289FE108F77E8401AD63A0FFA5BE4F4450B1DA2E6A675DE2CE445C348

Function 00007FFE132021B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE132021CC
GetComputerNameExW.KERNEL32 ref: 00007FFE132021ED
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFE13202204
GetLastError.KERNEL32 ref: 00007FFE1320323A
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE13203249

Strings

socket.gethostname, xrefs: 00007FFE132021C5

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: From$AuditCharComputerErr_ErrorLastNameSys_Unicode_WideWindows
String ID: socket.gethostname
API String ID: 1075394898-2650736202
Opcode ID: 7298ead834648a7f4bc6c3e3640df6640e6ed5735f611ada6b462331e5912f76
Instruction ID: 1f399b7c8878fb8e10fd88b1b8802e97d83148f080b5610571ca48146fce95f1
Opcode Fuzzy Hash: 7298ead834648a7f4bc6c3e3640df6640e6ed5735f611ada6b462331e5912f76
Instruction Fuzzy Hash: 67313021A0CF468EE724AB62A85417F67A1FFE9BA4F404075DA4E62674DF7CE40CC600

Function 00007FFE132076AC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132076D9
PyErr_SetString.PYTHON311 ref: 00007FFE13207705
PyBuffer_Release.PYTHON311 ref: 00007FFE13207710
PyErr_SetString.PYTHON311 ref: 00007FFE1320773F
PyBuffer_Release.PYTHON311 ref: 00007FFE1320774A
inet_ntop.WS2_32 ref: 00007FFE13207771
PyBuffer_Release.PYTHON311 ref: 00007FFE1320777F
PyErr_SetFromErrno.PYTHON311 ref: 00007FFE13207794
PyUnicode_FromString.PYTHON311 ref: 00007FFE132077BF
PyErr_Format.PYTHON311 ref: 00007FFE132077DB
PyBuffer_Release.PYTHON311 ref: 00007FFE132077E6

Strings

unknown address family %d, xrefs: 00007FFE132077CE
invalid length of packed IP address string, xrefs: 00007FFE132076FB, 00007FFE13207735
iy*:inet_ntop, xrefs: 00007FFE132076CD

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_Err_Release$String$From$Arg_ErrnoFormatParseSizeTuple_Unicode_inet_ntop
String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
API String ID: 418764794-2822559286
Opcode ID: cf4bd7ae1774b7dacff3fff39d392359017d4e22f2b23853f2c82bc2b4d813ba
Instruction ID: 3f2d9ee3abc16787d511ec6560ee72ba89ad9e676ee88cdd09673e5b1c5e4e37
Opcode Fuzzy Hash: cf4bd7ae1774b7dacff3fff39d392359017d4e22f2b23853f2c82bc2b4d813ba
Instruction Fuzzy Hash: DB31F021A18D8399EF50AB26E85467E23A0FFE4BA4F4044B2D54EA7574DF7CD40CC700

Function 00007FFE1330C5B0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

PyUnicode_InternFromString.PYTHON311 ref: 00007FFE1330C5CB
PyImport_ImportModule.PYTHON311 ref: 00007FFE1330C5DF
PyErr_Clear.PYTHON311 ref: 00007FFE1330C5ED
PyObject_GetAttrString.PYTHON311 ref: 00007FFE1330C607
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C619
PyErr_WriteUnraisable.PYTHON311 ref: 00007FFE1330C639
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C655
PyLong_AsLong.PYTHON311 ref: 00007FFE1330C663
PyErr_Occurred.PYTHON311 ref: 00007FFE1330C66B
PyErr_WriteUnraisable.PYTHON311 ref: 00007FFE1330C68B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C69F

Strings

DllCanUnloadNow, xrefs: 00007FFE1330C5FD
ctypes, xrefs: 00007FFE1330C5D8
_ctypes.DllCanUnloadNow, xrefs: 00007FFE1330C5C4

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Dealloc$StringUnraisableWrite$AttrClearFromImportImport_InternLongLong_ModuleObject_OccurredUnicode_
String ID: DllCanUnloadNow$_ctypes.DllCanUnloadNow$ctypes
API String ID: 3419117993-4136862661
Opcode ID: 6480632f02bad077a56764e5c1bb2d947567b6f8de28b8c217792b4108e53cfe
Instruction ID: 1764c96660e1645c80371851389f3e43a26389749a07da1ff963b9ad566cec3d
Opcode Fuzzy Hash: 6480632f02bad077a56764e5c1bb2d947567b6f8de28b8c217792b4108e53cfe
Instruction Fuzzy Hash: 89210165F09F06C9FE549B23EA9423C63A0AF74BB5F0810B4D92E66372DF3CA4459308

Function 00007FFE13207380 Relevance: 24.1, APIs: 16, Instructions: 99COMMON

Download Yara Rule

APIs

PyList_New.PYTHON311 ref: 00007FFE1320739D
GetIfTable2Ex.IPHLPAPI ref: 00007FFE132073C1
_Py_Dealloc.PYTHON311 ref: 00007FFE132073D6
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE132073DE
memcpy.VCRUNTIME140 ref: 00007FFE1320741C
ConvertInterfaceLuidToNameW.IPHLPAPI ref: 00007FFE13207434
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE13207457
PyList_Append.PYTHON311 ref: 00007FFE1320746F
_Py_Dealloc.PYTHON311 ref: 00007FFE13207489
FreeMibTable.IPHLPAPI ref: 00007FFE132074A2
_Py_Dealloc.PYTHON311 ref: 00007FFE132074E3
_Py_Dealloc.PYTHON311 ref: 00007FFE132074F2
FreeMibTable.IPHLPAPI ref: 00007FFE132074FD
_Py_Dealloc.PYTHON311 ref: 00007FFE13207510
FreeMibTable.IPHLPAPI ref: 00007FFE1320751B
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE13207523

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$FreeTable$Err_FromList_Windows$AppendBuildConvertInterfaceLuidNameSizeTable2Value_memcpy
String ID:
API String ID: 1684791173-0
Opcode ID: ec0ff591f7a44de46b97f53e6c011e55b3b54e9b216352143d0cf6e100584644
Instruction ID: c32e63791ddff4842f7ccbf5a216c2f04228744a2e301fef2605b2e401fbc540
Opcode Fuzzy Hash: ec0ff591f7a44de46b97f53e6c011e55b3b54e9b216352143d0cf6e100584644
Instruction Fuzzy Hash: 87413431A08F4289EA64AB26E85427E67A1FFE9B65F040071C98E677A4DF7CE40DC741

Function 00007FFE1A45D5B0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFE1A458B34), ref: 00007FFE1A45DA16
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45DA55
swprintf_s.PGOCR ref: 00007FFE1A45DA75
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45DA85
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45DAD5

Strings

NULL, xrefs: 00007FFE1A45D67D
`template-type-parameter-, xrefs: 00007FFE1A45DAF6
`generic-method-parameter-, xrefs: 00007FFE1A45DAA2
nullptr, xrefs: 00007FFE1A45D799
lambda, xrefs: 00007FFE1A45D974
`generic-class-parameter-, xrefs: 00007FFE1A45DAE6

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
Instruction ID: a0640689a17bf5f943b04cc540ad424429349c19d9146e0dc1704bca9f803f80
Opcode Fuzzy Hash: 9797e925e62f8d7d60f646e305733279f9163504f8593401decf67f28b7cb35e
Instruction Fuzzy Hash: 0DF19FA2F0CE4294FB14FB6685541BC27B1AF44F64F0401F7C98D26AB5DE3CA96AC340

Function 00007FFE13307FCF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE1330354C
PyMem_Malloc.PYTHON311 ref: 00007FFE13303585
PyMem_Free.PYTHON311 ref: 00007FFE133035D8
PyMem_Free.PYTHON311 ref: 00007FFE133035E1
PyObject_SetAttr.PYTHON311 ref: 00007FFE1330366A
PyMem_Free.PYTHON311 ref: 00007FFE133036DA
PyErr_NoMemory.PYTHON311 ref: 00007FFE13307F82
PyErr_SetString.PYTHON311 ref: 00007FFE1330802E
_Py_Dealloc.PYTHON311 ref: 00007FFE13308042
PyErr_Format.PYTHON311 ref: 00007FFE133080ED
_Py_Dealloc.PYTHON311 ref: 00007FFE13308101
_Py_Dealloc.PYTHON311 ref: 00007FFE1330811A

Strings

number of bits invalid for bit field, xrefs: 00007FFE13308024
%s:%s:, xrefs: 00007FFE1330359A
bit fields not allowed for type %s, xrefs: 00007FFE133080D8

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_$DeallocErr_Free$AttrFormatMallocMemoryObject_StringUnicode_
String ID: %s:%s:$bit fields not allowed for type %s$number of bits invalid for bit field
API String ID: 2455365098-3576608231
Opcode ID: 2c8a630497d9b26071984d54006c75933da3e15f2b28fdb68437a92c613d873a
Instruction ID: e5ddf4aa29f93fc9cea3e2872105824a062b466274afc93257b997728968b03c
Opcode Fuzzy Hash: 2c8a630497d9b26071984d54006c75933da3e15f2b28fdb68437a92c613d873a
Instruction Fuzzy Hash: BC817A32B08F4289EB50CB66E5482AD73A5FB65BB8F4002B6DA2D677A5DF3CD445C304

Function 00007FFE13253634 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE1325368B
_PyArg_UnpackKeywords.PYTHON311 ref: 00007FFE132536D4
PyObject_GetBuffer.PYTHON311 ref: 00007FFE132536ED
PyBuffer_IsContiguous.PYTHON311 ref: 00007FFE132536FE
_PyNumber_Index.PYTHON311 ref: 00007FFE13253718
PyLong_AsSsize_t.PYTHON311 ref: 00007FFE1325372D
PyBuffer_Release.PYTHON311 ref: 00007FFE1325376B

Strings

argument 'data', xrefs: 00007FFE1325B6FC
contiguous buffer, xrefs: 00007FFE1325B6F5
decompress, xrefs: 00007FFE1325B703

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_$Arg_BufferContiguousIndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID: argument 'data'$contiguous buffer$decompress
API String ID: 2593461735-2667845042
Opcode ID: 3b05843de0e9ce16ff05c83b1e5ddb82a75458333f409d7b11fcb9ec86cb24ae
Instruction ID: 8b27eadde886a9769a42d999684ff1f876a6c3596227befa0e9573d362e109db
Opcode Fuzzy Hash: 3b05843de0e9ce16ff05c83b1e5ddb82a75458333f409d7b11fcb9ec86cb24ae
Instruction Fuzzy Hash: 854162A2A18F428AEA10AF13D4447F963A4FBA4BA4F445271DE5D637A4FF3CE645C700

Function 00007FFE13205428 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 113networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1320546A
PyErr_Format.PYTHON311 ref: 00007FFE132054AC
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132054E7
WSAIoctl.WS2_32 ref: 00007FFE1320551E
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205552
WSAIoctl.WS2_32 ref: 00007FFE1320558D
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE1320559B
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132055BF
WSAIoctl.WS2_32 ref: 00007FFE132055FA

Strings

k(kkk):ioctl, xrefs: 00007FFE1320554B
invalid ioctl command %lu, xrefs: 00007FFE132054A2
kI:ioctl, xrefs: 00007FFE132054E0, 00007FFE132055B8
kO:ioctl, xrefs: 00007FFE13205463

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Ioctl$Err_FormatFromLongLong_Unsigned
String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
API String ID: 1148432870-4238462244
Opcode ID: 6af88f0f7ab4189eaa2f3f439bcd14503b5b66fadfc05a0468ddcdd5e31740c8
Instruction ID: 26bbb47f0949e5a659fc0648cb1921fade3e1ce9ee0640c1450c383eb1f84cb1
Opcode Fuzzy Hash: 6af88f0f7ab4189eaa2f3f439bcd14503b5b66fadfc05a0468ddcdd5e31740c8
Instruction Fuzzy Hash: 09514D32A18E029DEB50DF62E8405ED37B0FB98764F544172DA4DA3A68DF3CD598CB40

Function 00007FFE13205F88 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

PyTuple_Size.PYTHON311 ref: 00007FFE13205FBE
PyErr_Format.PYTHON311 ref: 00007FFE13205FE7
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1320600F
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206032
PySys_Audit.PYTHON311 ref: 00007FFE13206080
PyBuffer_Release.PYTHON311 ref: 00007FFE132060F4
PyLong_FromSsize_t.PYTHON311 ref: 00007FFE132060FF
PyBuffer_Release.PYTHON311 ref: 00007FFE1320610B

Strings

sendto, xrefs: 00007FFE13206045
socket.sendto, xrefs: 00007FFE13206079
y*iO:sendto, xrefs: 00007FFE13206008
sendto() takes 2 or 3 arguments (%zd given), xrefs: 00007FFE13205FDA
y*O:sendto, xrefs: 00007FFE1320602B

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: SizeTuple_$Arg_Buffer_ParseRelease$AuditErr_FormatFromLong_Ssize_tSys_
String ID: sendto$sendto() takes 2 or 3 arguments (%zd given)$socket.sendto$y*O:sendto$y*iO:sendto
API String ID: 3528750861-2448770124
Opcode ID: 6ef297011c41e40e00d0fec8183777252a493334b46fd21cb5a027fe8353a864
Instruction ID: df7cc8bd54c60a93f1c9ca1a31a75fe61a513a00992b87e37dc1635a20435cd2
Opcode Fuzzy Hash: 6ef297011c41e40e00d0fec8183777252a493334b46fd21cb5a027fe8353a864
Instruction Fuzzy Hash: 78410B71608F4699EB10DB66E8402AE77B0FBD8BA4F500176DA8D67B64DF7CD548C700

Function 00007FFE13207148 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 50threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13207169
PySys_Audit.PYTHON311 ref: 00007FFE1320719C
PyEval_SaveThread.PYTHON311 ref: 00007FFE132071B4
htons.WS2_32 ref: 00007FFE132071C2
getservbyport.WS2_32 ref: 00007FFE132071D0
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132071DC
PyErr_SetString.PYTHON311 ref: 00007FFE132071FD
PyUnicode_FromString.PYTHON311 ref: 00007FFE13207212
PyErr_SetString.PYTHON311 ref: 00007FFE1320722B

Strings

socket.getservbyport, xrefs: 00007FFE13207195
i|s:getservbyport, xrefs: 00007FFE13207158
getservbyport: port must be 0-65535., xrefs: 00007FFE13207221
port/proto not found, xrefs: 00007FFE132071F3

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: String$Err_Eval_Thread$Arg_AuditFromParseRestoreSaveSizeSys_Tuple_Unicode_getservbyporthtons
String ID: getservbyport: port must be 0-65535.$i|s:getservbyport$port/proto not found$socket.getservbyport
API String ID: 3420281234-2618607128
Opcode ID: 684d64edd5c1e662378f9cafadfeac506a1a90c000d0be84bc84ad99a05fdcb9
Instruction ID: f9ed70a084407014a0c31274766af395d80b9c16447a6269639740971fc1e12e
Opcode Fuzzy Hash: 684d64edd5c1e662378f9cafadfeac506a1a90c000d0be84bc84ad99a05fdcb9
Instruction Fuzzy Hash: E7210E61A08E4789EA00AB17E88417E6770FFE9BA5F504071EA4D67678DF7DE04CC700

Function 00007FFE1330BA14 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE1330BA90
PyErr_Occurred.PYTHON311 ref: 00007FFE1330BAA3

Part of subcall function 00007FFE1330BA14: PySequence_GetItem.PYTHON311 ref: 00007FFE1330BAE8
Part of subcall function 00007FFE1330BA14: PySequence_GetItem.PYTHON311 ref: 00007FFE1330BAFF
Part of subcall function 00007FFE1330BA14: PyDict_Contains.PYTHON311 ref: 00007FFE1330BB27
Part of subcall function 00007FFE1330BA14: PyObject_SetAttr.PYTHON311 ref: 00007FFE1330BB3C
Part of subcall function 00007FFE1330BA14: _Py_Dealloc.PYTHON311 ref: 00007FFE1330BB4D
Part of subcall function 00007FFE1330BA14: _Py_Dealloc.PYTHON311 ref: 00007FFE1330BB5C
Part of subcall function 00007FFE1330BA14: PyErr_Format.PYTHON311 ref: 00007FFE1330BB97
Part of subcall function 00007FFE1330BA14: _Py_Dealloc.PYTHON311 ref: 00007FFE1330BBA6
Part of subcall function 00007FFE1330BA14: _Py_Dealloc.PYTHON311 ref: 00007FFE1330BBC0

Strings

duplicate values for field %R, xrefs: 00007FFE1330BB8A

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Item$Dict_Err_Sequence_$AttrContainsErrorFormatObject_OccurredWith
String ID: duplicate values for field %R
API String ID: 1919794741-1910533534
Opcode ID: f71277947be2d2287fba46fe0b915e6ba484f6932f6352b1fb4de12eb2f3b1be
Instruction ID: a1de8b584f09ab9ec9fccc277eae174e53fd49bb6733708afb8883336b94b565
Opcode Fuzzy Hash: f71277947be2d2287fba46fe0b915e6ba484f6932f6352b1fb4de12eb2f3b1be
Instruction Fuzzy Hash: 8D517021B09E428AEE599F27A95457DA7A0BF64BF4F0445B1DD3E273B5EE7CE0018308

Function 00007FFE1330D0A8 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 123threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D0EE
GetErrorInfo.OLEAUT32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D133
PyEval_RestoreThread.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D190
ProgIDFromCLSID.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D1A3
Py_BuildValue.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D1E5
PyErr_SetObject.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D1FD
_Py_Dealloc.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D20C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330D215
SysFreeString.OLEAUT32 ref: 00007FFE1330D224
SysFreeString.OLEAUT32 ref: 00007FFE1330D233
SysFreeString.OLEAUT32 ref: 00007FFE1330D242

Strings

iu(uuuiu), xrefs: 00007FFE1330D1DE

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Free$String$Eval_Thread$BuildDeallocErr_ErrorFromInfoLocalObjectProgRestoreSaveValue
String ID: iu(uuuiu)
API String ID: 2817777535-1877708109
Opcode ID: f3fff332be11df24bb43f445367687364f99778bf223ac6a64006d9486d4d9c8
Instruction ID: ee4a670b1e50bfb84c2f7f7d4de432d7f12117d873385315ee0e46fcc6fd28e2
Opcode Fuzzy Hash: f3fff332be11df24bb43f445367687364f99778bf223ac6a64006d9486d4d9c8
Instruction Fuzzy Hash: B151E466B05E06DAEB00DF66D4943AC63B0FB98BA8F004576DE1E67B69DE3CD509C304

Function 00007FFE133094A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

PyIndex_Check.PYTHON311 ref: 00007FFE133094D4
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE133094EB
PyErr_Occurred.PYTHON311 ref: 00007FFE133094FA
PyErr_SetString.PYTHON311 ref: 00007FFE13309617

Strings

Array does not support item deletion, xrefs: 00007FFE133094C5
indices must be integer, xrefs: 00007FFE13309606
Can only assign sequence of same size, xrefs: 00007FFE133095A8

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$CheckIndex_Number_OccurredSsize_tString
String ID: Array does not support item deletion$Can only assign sequence of same size$indices must be integer
API String ID: 428023279-3643249925
Opcode ID: 67ecbcca89311aff2d866ea192ce1f612227fb21c186869f9d79deb68ba184de
Instruction ID: ce80c319a527939f5423192c1ef29a87edb4a6bdfae9663938ac839ca22bba62
Opcode Fuzzy Hash: 67ecbcca89311aff2d866ea192ce1f612227fb21c186869f9d79deb68ba184de
Instruction Fuzzy Hash: FF415D62B08E46C9EA548F67D8500BD6361FF64BF8B0445B1ED3D676B6EE3CE4858308

Function 00007FFE133040BC Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311(00000000,00000000,00000001,00007FFE1330373F), ref: 00007FFE133040E1
PySequence_Fast.PYTHON311 ref: 00007FFE13308B99
_Py_Dealloc.PYTHON311 ref: 00007FFE13308BAD
PyObject_GetAttr.PYTHON311 ref: 00007FFE13308BFA
_Py_Dealloc.PYTHON311 ref: 00007FFE13308C45
_Py_Dealloc.PYTHON311 ref: 00007FFE13308C5B
_Py_Dealloc.PYTHON311 ref: 00007FFE13308C6E

Strings

_anonymous_ must be a sequence, xrefs: 00007FFE13308B92
'%U' is specified in _anonymous_ but not in _fields_, xrefs: 00007FFE13308C81

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$AttrObject_$FastLookupSequence_
String ID: '%U' is specified in _anonymous_ but not in _fields_$_anonymous_ must be a sequence
API String ID: 1391743325-2678605723
Opcode ID: 7250101b7d384b3603d10181ac32ac0acd4c5aaae793a49ebea8f6d5bde9a43b
Instruction ID: fd9070352f287bfb9c591c086a0f5fba67618f7a7438f7a6e3ee8ac4b7556e3a
Opcode Fuzzy Hash: 7250101b7d384b3603d10181ac32ac0acd4c5aaae793a49ebea8f6d5bde9a43b
Instruction Fuzzy Hash: CD414A72A09E02C9EA588F67E95017CA7A0FF65BB0F0441B1DE2E276B1CF3CE4558308

Function 00007FFE133020E8 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311 ref: 00007FFE13302106
PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE1330212E

Part of subcall function 00007FFE13303DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FFE133046A2,?,?,?,00007FFE13301959), ref: 00007FFE13303DCB

PyErr_Clear.PYTHON311 ref: 00007FFE13307143
_Py_Dealloc.PYTHON311 ref: 00007FFE13307152
_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE13307167
_Py_CheckRecursiveCall.PYTHON311 ref: 00007FFE133071A3
_Py_Dealloc.PYTHON311 ref: 00007FFE133071BC
PyErr_SetString.PYTHON311 ref: 00007FFE13307215

Strings

abstract class, xrefs: 00007FFE13307137
wrong type, xrefs: 00007FFE13307204
while processing _as_parameter_, xrefs: 00007FFE1330719C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Object_$DeallocErr_$AttrCallCheckClearInstanceLookupRecursiveStringUnicode_
String ID: abstract class$while processing _as_parameter_$wrong type
API String ID: 4206935778-1173273510
Opcode ID: 961a10382abbd73e4d2a667dfe19ccb16767b9e8d8b3bad4ce0000eff4bf0ebe
Instruction ID: 9e9ed5540fb0ba364519a4e11eaa955e849353606220052134b765e590cf8c2e
Opcode Fuzzy Hash: 961a10382abbd73e4d2a667dfe19ccb16767b9e8d8b3bad4ce0000eff4bf0ebe
Instruction Fuzzy Hash: 34415C21A08E42CAEA559B27E84017DA360FFA9BB0F0441B1DE2DA77B1DF3CE445C348

Function 00007FFE13302320 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE13302381
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FFE133023A7
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE133023C1
PyErr_Occurred.PYTHON311 ref: 00007FFE1330245D

Part of subcall function 00007FFE13304118: PySequence_Tuple.PYTHON311 ref: 00007FFE13304130
Part of subcall function 00007FFE13304118: PyTuple_New.PYTHON311 ref: 00007FFE13304157
Part of subcall function 00007FFE13304118: _PyObject_LookupAttrId.PYTHON311 ref: 00007FFE1330418A

_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE133023FF
_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE13302446
PyCallable_Check.PYTHON311 ref: 00007FFE13307295
PyErr_Occurred.PYTHON311 ref: 00007FFE133072AC
PyErr_Occurred.PYTHON311 ref: 00007FFE133072C0
PyErr_SetString.PYTHON311 ref: 00007FFE133072E0

Strings

class must define _flags_ which must be an integer, xrefs: 00007FFE133072CF
_restype_ must be a type, a callable, or None, xrefs: 00007FFE133072A3

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Dict_ErrorItemOccurredWith$AttrLookupObject_$Callable_CheckLongLong_MaskSequence_StringTupleTuple_Unsigned
String ID: _restype_ must be a type, a callable, or None$class must define _flags_ which must be an integer
API String ID: 3087875697-2538317290
Opcode ID: c02ca58e13a46a6ce0520458656b58573f0571ee4510cffb2fc4fd828f69ccf3
Instruction ID: 99f2f7b227ed0465062f1f9253e90080d0b28a73435832325955f600032f4b8a
Opcode Fuzzy Hash: c02ca58e13a46a6ce0520458656b58573f0571ee4510cffb2fc4fd828f69ccf3
Instruction Fuzzy Hash: 74414D21B09F02DAEA458B26E94437863A0FF69B64F445575DA2D673B2DF3CE498C308

Function 00007FFE13203EA0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE13203EF2

Strings

OiII, xrefs: 00007FFE13203F96
Unknown Bluetooth protocol, xrefs: 00007FFE13203F0A
iy#, xrefs: 00007FFE13203EEB

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: BuildSizeValue_
String ID: OiII$Unknown Bluetooth protocol$iy#
API String ID: 1740464280-1931379703
Opcode ID: 811c50eada70b53de2986ccdbf135792e8a7c51667e22f96ce3885f6766bbc49
Instruction ID: 6a54bae1ba83f88ff14a42debd7d328781f0d2194463f779e9ae446e9d06c276
Opcode Fuzzy Hash: 811c50eada70b53de2986ccdbf135792e8a7c51667e22f96ce3885f6766bbc49
Instruction Fuzzy Hash: 2D313161A08E5289EA64AB57E54903EA6B0BFE4BA4B4440B5CB0E67770EF7CE45DC300

Function 00007FFE1330DEDC Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DEF6
PyErr_SetString.PYTHON311 ref: 00007FFE1330DF2A
PyErr_Format.PYTHON311 ref: 00007FFE1330DF51
PyErr_Format.PYTHON311 ref: 00007FFE1330DF70
PyMem_Calloc.PYTHON311 ref: 00007FFE1330DF99
PyErr_NoMemory.PYTHON311 ref: 00007FFE1330DFA7
memcpy.VCRUNTIME140 ref: 00007FFE1330DFBF
PyMem_Realloc.PYTHON311 ref: 00007FFE1330DFD2

Strings

Memory cannot be resized because this object doesn't own it, xrefs: 00007FFE1330DF66
On:resize, xrefs: 00007FFE1330DEEA
excepted ctypes instance, xrefs: 00007FFE1330DF20
minimum size is %zd, xrefs: 00007FFE1330DF47

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$FormatMem_$Arg_CallocMemoryParseReallocStringTuplememcpy
String ID: Memory cannot be resized because this object doesn't own it$On:resize$excepted ctypes instance$minimum size is %zd
API String ID: 2473355626-828838525
Opcode ID: f25097e4f29e0a836fc8ce735c340e9b52c9a2e89e2e7b96c33704ef34719194
Instruction ID: 4ed9abd8cf70128c92e9fe805b8d646446f74d3d7c18ddaec1b3a16ca5f683fc
Opcode Fuzzy Hash: f25097e4f29e0a836fc8ce735c340e9b52c9a2e89e2e7b96c33704ef34719194
Instruction Fuzzy Hash: 21313C61B09F42C9EA548B57E45417D63B0FFA8BA4F1041B2DA2E67775DF2CE484C708

Function 00007FFE1A45AC40 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AC91
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45AD5A
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ADA3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45ADB4

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
Instruction ID: a7aa80316a2878be015e071105aea082f55ffaeb5075f6b9b9b5806ce88fa842
Opcode Fuzzy Hash: b0c5aa40c95afe9820d08c2b3a0b3f0a0bd29e174dcc6565612d28bd398cd5cc
Instruction Fuzzy Hash: 7CF16DB6B08B829AE711EF66D4901FC37B0EB04B5CB4044B6EA4D57BA9DF38D569C340

Function 00007FFE133028F0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 197COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON311 ref: 00007FFE133076A3
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FFE13307709

Strings

call takes exactly %d arguments (%zd given), xrefs: 00007FFE133078DF
paramflag %u not yet implemented, xrefs: 00007FFE13307861
NULL stgdict unexpected, xrefs: 00007FFE1330789E
%s 'out' parameter must be passed as default value, xrefs: 00007FFE13307881

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: LongLong_MaskTuple_Unsigned
String ID: %s 'out' parameter must be passed as default value$NULL stgdict unexpected$call takes exactly %d arguments (%zd given)$paramflag %u not yet implemented
API String ID: 1136903700-2588965191
Opcode ID: 91dd6e13f2742febeda4ec11071149d11ba9fea3fb7657fd2f121691aebacfe3
Instruction ID: c5b260d3820350dfa1d74c0cd35bf04799c6cd0ff09955a60c9543ee8fdbbc1e
Opcode Fuzzy Hash: 91dd6e13f2742febeda4ec11071149d11ba9fea3fb7657fd2f121691aebacfe3
Instruction Fuzzy Hash: 3E815A72A09F42CAEA628F17D44067DA3A4FBA8BA4F104072DA6DA3765DF3CE441C704

Function 00007FFE1330AA7C Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 165COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,?,00007FFE1330947D,?), ref: 00007FFE1330AABD

Strings

(%s) , xrefs: 00007FFE1330AB4E
not a ctype instance, xrefs: 00007FFE1330AAB3
incompatible types, %s instance instead of %s instance, xrefs: 00007FFE1330ACE1
expected %s instance, got %s, xrefs: 00007FFE1330ABDE

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance$not a ctype instance
API String ID: 1450464846-2159251832
Opcode ID: 07203d23819d05828f358a56c03890258eda92ffb1c002cf2859f9f66371a8e9
Instruction ID: 1eddb75ea578aaef2d3a8524712a31f3db0a32a8a4b1cdd5d54163ec3b0ffdf1
Opcode Fuzzy Hash: 07203d23819d05828f358a56c03890258eda92ffb1c002cf2859f9f66371a8e9
Instruction Fuzzy Hash: 3A713C61A08F428AFA049B17E5502BD6361FFA5FE0F0841B2DE2D677B6DF2CE4418348

Function 00007FFE1330AEA0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 145COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1330AF08
PyErr_SetString.PYTHON311 ref: 00007FFE1330AF46
_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1330AFE9
PyErr_Format.PYTHON311 ref: 00007FFE1330B04C

Strings

abstract class, xrefs: 00007FFE1330AF35
paramflags must be a sequence of (int [,string [,value]]) tuples, xrefs: 00007FFE1330B0D7
paramflags must have the same length as argtypes, xrefs: 00007FFE1330AFAD
paramflag value %d not supported, xrefs: 00007FFE1330B03E
paramflags must be a tuple or None, xrefs: 00007FFE1330B0E3
is|Oz#, xrefs: 00007FFE1330AEE3
i|OO, xrefs: 00007FFE1330AFE2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_Err_ParseSizeTuple_$FormatString
String ID: abstract class$is|Oz#$i|OO$paramflag value %d not supported$paramflags must be a sequence of (int [,string [,value]]) tuples$paramflags must be a tuple or None$paramflags must have the same length as argtypes
API String ID: 2189051491-1121734848
Opcode ID: 3d6b330cc5c9dd7f19e068a29130591e5b204b1fdfc58b1c50816dd1f366be30
Instruction ID: f1c8fbb514968765254c304f0c658eb1e4a146c2c7ad7009873660356db14bf5
Opcode Fuzzy Hash: 3d6b330cc5c9dd7f19e068a29130591e5b204b1fdfc58b1c50816dd1f366be30
Instruction Fuzzy Hash: 80613A72B08E02C9EB48CF16E9802AC63A4FB54BA4F1441B6DE2D67B64DF3DE485C304

Function 00007FFE13206A48 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206A82
PySys_Audit.PYTHON311 ref: 00007FFE13206AA4
PyErr_SetString.PYTHON311 ref: 00007FFE13206B02
PyMem_Free.PYTHON311 ref: 00007FFE13206B6B

Strings

et:gethostbyaddr, xrefs: 00007FFE13206A79
idna, xrefs: 00007FFE13206A72
unsupported address family, xrefs: 00007FFE13206AF8
socket.gethostbyaddr, xrefs: 00007FFE13206A9D

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditErr_FreeMem_ParseSizeStringSys_Tuple_
String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
API String ID: 1738687268-1751716127
Opcode ID: 21981c606748fb82564060e3f010e4e740aac59376a10161e0d402e5c7a175be
Instruction ID: 6860c9df991aa402b55c65f8942f4fdc5485dff4ca0d31e0c4726bec6c3e8ab3
Opcode Fuzzy Hash: 21981c606748fb82564060e3f010e4e740aac59376a10161e0d402e5c7a175be
Instruction Fuzzy Hash: 8F314161B18E8289EA60AB17F9503BE6760FBD4BE4F440072DA4E27665DE7CE50CC700

Function 00007FFE13205BA4 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON311 ref: 00007FFE13205BF3
PyBuffer_Release.PYTHON311 ref: 00007FFE13205C0C
PyErr_SetString.PYTHON311 ref: 00007FFE13205C23
PyBuffer_Release.PYTHON311 ref: 00007FFE13205C6C
_Py_Dealloc.PYTHON311 ref: 00007FFE13205C82
PyBuffer_Release.PYTHON311 ref: 00007FFE13205C96
PyBuffer_Release.PYTHON311 ref: 00007FFE13205CA8
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE13205CBD

Strings

nbytes is greater than the length of the buffer, xrefs: 00007FFE13205C9C
w*|ni:recvfrom_into, xrefs: 00007FFE13205BC2
negative buffersize in recvfrom_into, xrefs: 00007FFE13205C12

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_Release$Size$Arg_BuildDeallocErr_Keywords_ParseStringTupleValue_
String ID: nbytes is greater than the length of the buffer$negative buffersize in recvfrom_into$w*|ni:recvfrom_into
API String ID: 252658603-4033050226
Opcode ID: 9779a835a3d373f1e00e4f9253419f8f93039c6076db6d831e5c5cfbf06e46d8
Instruction ID: 7fbf9b9af8599078ade26c67b5354cdc1525dd3242c6441a4f08a39ae287567f
Opcode Fuzzy Hash: 9779a835a3d373f1e00e4f9253419f8f93039c6076db6d831e5c5cfbf06e46d8
Instruction Fuzzy Hash: AC314672A0CF46C9EA10AB52E8442BE6760FBE9BA4F500176DA8D67660DF7DE54CC700

Function 00007FFE13207080 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132070A1
PySys_Audit.PYTHON311 ref: 00007FFE132070C7
PyEval_SaveThread.PYTHON311 ref: 00007FFE132070DB
getservbyname.WS2_32 ref: 00007FFE132070EE
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132070FA
PyErr_SetString.PYTHON311 ref: 00007FFE1320711B
htons.WS2_32 ref: 00007FFE13207131
PyLong_FromLong.PYTHON311 ref: 00007FFE1320713A

Strings

s|s:getservbyname, xrefs: 00007FFE13207090
socket.getservbyname, xrefs: 00007FFE132070C0
service/proto not found, xrefs: 00007FFE13207111

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditErr_FromLongLong_ParseRestoreSaveSizeStringSys_Tuple_getservbynamehtons
String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
API String ID: 1135235387-1257235949
Opcode ID: 50c410380efebb145164b2a6ee2d31ff3aa59654f6791e367b31230d43ed6af4
Instruction ID: 42528dd23e1cedbc20f178b56a92d5dad11ff80d8827e7b23f5311e4ccede0ef
Opcode Fuzzy Hash: 50c410380efebb145164b2a6ee2d31ff3aa59654f6791e367b31230d43ed6af4
Instruction Fuzzy Hash: F3112C61A08E4286DA00AB17E84027EA770FBE5FE5F400071EA8E67674DF7CE04DC700

Function 00007FFE1A452F14 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE1A452F71

Part of subcall function 00007FFE1A4552D0: __GetUnwindTryBlock.LIBCMT ref: 00007FFE1A455313
Part of subcall function 00007FFE1A4552D0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE1A455338

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A453049
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453056
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE1A4532A0
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4532CE

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453394
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4533C9

Strings

csm, xrefs: 00007FFE1A452F8B
csm, xrefs: 00007FFE1A452FF2
csm, xrefs: 00007FFE1A45306E

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
Instruction ID: e8cc468c752573ce801f211601fbd0435f1f4d5e40cf52f815ae5a79b57f6e2d
Opcode Fuzzy Hash: 1fea5c564d133bdba3aecb898f1e2b7bc476544beebca211cb7a23793dbe9004
Instruction Fuzzy Hash: DEE150B2B08F4186EB10AB66D4502BD77A4FB45FA8F1401B6EA4D57B69CF38E5A4C700

Function 00007FFE13302980 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE13302A27
PyObject_CallOneArg.PYTHON311 ref: 00007FFE13302A7E
_Py_Dealloc.PYTHON311 ref: 00007FFE13302C36
PyErr_Format.PYTHON311 ref: 00007FFE1330793D

Strings

too many arguments (%zi), maximum is %i, xrefs: 00007FFE1330792D
argument %zd: , xrefs: 00007FFE1330798B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CallDeallocErr_FormatObject_memset
String ID: argument %zd: $too many arguments (%zi), maximum is %i
API String ID: 1791410686-4072972272
Opcode ID: 4740f729d07df1b72c89f8ee573bc102a3c799c06bb822e8bf3e008f4163d2c1
Instruction ID: 3bc9d7978121afc41723f9e2fb87533c532f56c7c972b191337e4c07529dc566
Opcode Fuzzy Hash: 4740f729d07df1b72c89f8ee573bc102a3c799c06bb822e8bf3e008f4163d2c1
Instruction Fuzzy Hash: 78B17F62A08E8289EA619F2784402BD6360FF25BF8F544671DE7DA77E5DF3CE5418308

Function 00007FFE1A45E72C Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45E786

Strings

`generic-type-, xrefs: 00007FFE1A45E862
`template-parameter-, xrefs: 00007FFE1A45E81B
template-parameter-, xrefs: 00007FFE1A45E7E8
generic-type-, xrefs: 00007FFE1A45E82F

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Replicator::operator[]
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3207858774
Opcode ID: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
Instruction ID: 643e62bf24f5c2b9b99468e577bec5373a6d064ef5e31ed0111f09d99902349a
Opcode Fuzzy Hash: ecd4a8ae6d7230611fff1dd4e64a59f99909a897cce7822f33257ee1ddf9a1a8
Instruction Fuzzy Hash: 5F91ACA2B08E8695FB24EF26D4412B877B1AB44B68F4481F3DA5D036B5DF3CE565C340

Function 00007FFE13204D64 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13204D98
getsockopt.WS2_32 ref: 00007FFE13204DD3
PyLong_FromLong.PYTHON311 ref: 00007FFE13204DE1
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE13204DFB
getsockopt.WS2_32 ref: 00007FFE13204E26
_Py_Dealloc.PYTHON311 ref: 00007FFE13204E3B
_PyBytes_Resize.PYTHON311 ref: 00007FFE13204E50

Strings

ii|i:getsockopt, xrefs: 00007FFE13204D84
getsockopt buflen out of range, xrefs: 00007FFE13204E64

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Bytes_FromSizegetsockopt$Arg_DeallocLongLong_ParseResizeStringTuple_
String ID: getsockopt buflen out of range$ii|i:getsockopt
API String ID: 3532181676-2750947780
Opcode ID: 15b8bcdde415823467fdb4a0ed8eec2ce9c2fd89354c765c19f8db92f5921497
Instruction ID: 8952d45a2cd662d63d620c2c3c4f3c859e01bddbfdd94b56cc7034186df2d303
Opcode Fuzzy Hash: 15b8bcdde415823467fdb4a0ed8eec2ce9c2fd89354c765c19f8db92f5921497
Instruction Fuzzy Hash: B6311872A18E428BEB14EB26E44446E77A0FBD4B64B504175EB4E67A78DF3CD409CF40

Function 00007FFE1330AD18 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1330AD4F
memcpy.VCRUNTIME140 ref: 00007FFE1330AD75
PyObject_GetAttrString.PYTHON311 ref: 00007FFE1330AD84
PyErr_Format.PYTHON311 ref: 00007FFE1330ADC0
_Py_Dealloc.PYTHON311 ref: 00007FFE1330ADCF
PyDict_Update.PYTHON311 ref: 00007FFE1330ADEA
_Py_Dealloc.PYTHON311 ref: 00007FFE1330ADFB

Strings

O!s#, xrefs: 00007FFE1330AD3D
__dict__, xrefs: 00007FFE1330AD7A
%.200s.__dict__ must be a dictionary, not %.200s, xrefs: 00007FFE1330ADA7

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Arg_AttrDict_Err_FormatObject_ParseSizeStringTuple_Updatememcpy
String ID: %.200s.__dict__ must be a dictionary, not %.200s$O!s#$__dict__
API String ID: 111561578-4068157617
Opcode ID: df2c1ae6872be876c0abca8e9306c520b908d31e559ab2d333eeb8cb4e17a471
Instruction ID: f8779fc8039d7e0df572b6ae8383f47ce12db070aea38b87450ef24d371f6340
Opcode Fuzzy Hash: df2c1ae6872be876c0abca8e9306c520b908d31e559ab2d333eeb8cb4e17a471
Instruction Fuzzy Hash: 22313862B08F46C9EA408F66E8541BCB3A0FB69BB0B544172DA2D23765CF3CE495C304

Function 00007FFE13205844 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON311 ref: 00007FFE1320588F
PyBuffer_Release.PYTHON311 ref: 00007FFE132058A8
PyErr_SetString.PYTHON311 ref: 00007FFE132058BF
PyBuffer_Release.PYTHON311 ref: 00007FFE132058F7
PyBuffer_Release.PYTHON311 ref: 00007FFE1320590B
PyBuffer_Release.PYTHON311 ref: 00007FFE1320591A
PyLong_FromSsize_t.PYTHON311 ref: 00007FFE13205923

Strings

negative buffersize in recv_into, xrefs: 00007FFE132058AE
buffer too small for requested bytes, xrefs: 00007FFE13205911
w*|ni:recv_into, xrefs: 00007FFE13205862

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_Release$Arg_Err_FromKeywords_Long_ParseSizeSsize_tStringTuple
String ID: buffer too small for requested bytes$negative buffersize in recv_into$w*|ni:recv_into
API String ID: 1544103690-1758107600
Opcode ID: 4cd52dd9801ced5f390c235a0164f2c18d4f816f4ec9513556e453f9d8d8963f
Instruction ID: 0f010dbb643d6a131a926ebe56970a2535af7a8edae9204853330ce03184b610
Opcode Fuzzy Hash: 4cd52dd9801ced5f390c235a0164f2c18d4f816f4ec9513556e453f9d8d8963f
Instruction Fuzzy Hash: DF212671A0CF46C9EA10AB52F4842BE6760FBE97A4F900176CA5E63660DF7CE54CC700

Function 00007FFE1325A32C Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE1325A354
__scrt_initialize_crt.LIBCMT ref: 00007FFE1325A399
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1325A3A6
_RTC_Initialize.LIBCMT ref: 00007FFE1325A3D4
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1325A3FA
__scrt_release_startup_lock.LIBCMT ref: 00007FFE1325A425

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 94e1b7c85106b5dcadd5bf74e1c1f6267d6a35972fcb64925ed8eb6f2d0728e2
Instruction ID: e53e947a3de8701929a36d7848c80451776e9284cbd4d9ce91e358e8b4705fd3
Opcode Fuzzy Hash: 94e1b7c85106b5dcadd5bf74e1c1f6267d6a35972fcb64925ed8eb6f2d0728e2
Instruction Fuzzy Hash: 4E8194A0E19F434DFA52BB5794422F926A0AFF57A0F5442B5D90D637B2FE3CE642C600

Function 00007FFE132022A0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE132022C8
__scrt_initialize_crt.LIBCMT ref: 00007FFE1320230D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE1320231A
_RTC_Initialize.LIBCMT ref: 00007FFE13202348
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE1320236E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13202399

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 9bbd730a66e4cbb51c460212e6bb78fa7447f27bb902fb331a2f3e6d0f89718b
Instruction ID: 17ef51dafcfe176f23aebfdb0cc8e5e5fea51db81a6825e025179f2bb11f89df
Opcode Fuzzy Hash: 9bbd730a66e4cbb51c460212e6bb78fa7447f27bb902fb331a2f3e6d0f89718b
Instruction Fuzzy Hash: C881AE21E08F078EFA54BB67945127D2690AFE67A0F1440B7DA0D637B6EE3CE84DC600

Function 00007FFE132749C0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE132749E8
__scrt_initialize_crt.LIBCMT ref: 00007FFE13274A2D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE13274A3A
_RTC_Initialize.LIBCMT ref: 00007FFE13274A68
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE13274A8E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13274AB9

Memory Dump Source

Source File: 00000001.00000002.2984079129.00007FFE13271000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true

Associated: 00000001.00000002.2984061552.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984101399.00007FFE13276000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.2984120218.00007FFE13279000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13270000_uOsIQqfgiT.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 41c1564c9b53542f78ee4fe0cba140d0622bb491acb40784f16a44f8e3da4176
Instruction ID: 4e8347594dddf321f60daeb9b438f8a4032d0bde15e37d4e5886bd4ed446f8d1
Opcode Fuzzy Hash: 41c1564c9b53542f78ee4fe0cba140d0622bb491acb40784f16a44f8e3da4176
Instruction Fuzzy Hash: 2B817A21E08A438EFA60BB6794422796690BFF57A0F5441B5DA4D737B6DF3CE842C601

Function 00007FFE130C11D0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE130C11F8
__scrt_initialize_crt.LIBCMT ref: 00007FFE130C123D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE130C124A
_RTC_Initialize.LIBCMT ref: 00007FFE130C1278
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE130C129E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE130C12C9

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
Instruction ID: ab34759b4aa24c2423623864389a62f7f9a8fa0c1ae0b42b4c73f15bfe66fa42
Opcode Fuzzy Hash: 49741281be2100ec61cea02429068dcdc2aa4a812f9568a561c19d79723e8765
Instruction Fuzzy Hash: 3081C021E1CE438EFB58AB6794412B966D3AF657A0FD441F5DA0DA77B2DF3CE4058200

Function 00007FFE1330B680 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

PyObject_CallObject.PYTHON311 ref: 00007FFE1330B6F7

Strings

(%s) , xrefs: 00007FFE1330B70C
incompatible types, %s instance instead of %s instance, xrefs: 00007FFE1330B883
expected %s instance, got %s, xrefs: 00007FFE1330B79B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CallObjectObject_
String ID: (%s) $expected %s instance, got %s$incompatible types, %s instance instead of %s instance
API String ID: 3040866976-3177377183
Opcode ID: d8d30b96da88cef245048956aa11174a0505f3ed0a0a37e68dc2437735cc2005
Instruction ID: 78e07834fc6012b273adb67e4d95faa072150809aca44e7a31c00d4abfe8348e
Opcode Fuzzy Hash: d8d30b96da88cef245048956aa11174a0505f3ed0a0a37e68dc2437735cc2005
Instruction Fuzzy Hash: 71512765A08F46C9EE589F17D98027D6361AFA5FE4F0840B2ED2D677B6DF2CE4408308

Function 00007FFE1A45A4E8 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A542
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A678

Strings

struct , xrefs: 00007FFE1A45A69C
cointerface , xrefs: 00007FFE1A45A61F
union , xrefs: 00007FFE1A45A6A5
coclass , xrefs: 00007FFE1A45A631
`unknown ecsu', xrefs: 00007FFE1A45A50E
enum , xrefs: 00007FFE1A45A63A
class , xrefs: 00007FFE1A45A68D

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
Instruction ID: 90fb06028247f6d77425227131e51550878adda126d9450814a8a4ab99568be3
Opcode Fuzzy Hash: f2c82fd6e231fdf3051f437846c0782e2719a4821ee929760b6b2afc08469b6e
Instruction Fuzzy Hash: F6518CB2F08F5699F700EB66E8844BC37B0BB14BA4F5441B6DA4D53A64DF39E565C300

Function 00007FFE133016B4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON311 ref: 00007FFE133016E8
PyUnicode_Concat.PYTHON311 ref: 00007FFE13301710
_Py_Dealloc.PYTHON311 ref: 00007FFE1330176D
PyDict_Update.PYTHON311 ref: 00007FFE133017EC
_Py_Dealloc.PYTHON311 ref: 00007FFE1330180E
PyUnicode_InternFromString.PYTHON311 ref: 00007FFE1330183D
_Py_Dealloc.PYTHON311 ref: 00007FFE13306ABB

Strings

_be, xrefs: 00007FFE13301836

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Unicode_$ConcatDict_FromInternStringTuple_Update
String ID: _be
API String ID: 1858819020-4071763053
Opcode ID: 10cbbb94ffeeef5047c8331b99db0bdcf7c3f3ec2fb3fe09a0319070b4712324
Instruction ID: 393589d894ec9c8a3b46765bb145c81351478614e39984c239e7811290ef5fba
Opcode Fuzzy Hash: 10cbbb94ffeeef5047c8331b99db0bdcf7c3f3ec2fb3fe09a0319070b4712324
Instruction Fuzzy Hash: D9513976A09F4689EB549F26D88023C73A4FB68FA0B184175DA6D23365DF3CE4A1C348

Function 00007FFE1330CE1C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1330C4D0: _PyObject_GC_NewVar.PYTHON311(?,?,?,00007FFE1330CE4C,?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330C4E7
Part of subcall function 00007FFE1330C4D0: memset.VCRUNTIME140(?,?,?,00007FFE1330CE4C,?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330C534
Part of subcall function 00007FFE1330C4D0: PyObject_GC_Track.PYTHON311(?,?,?,00007FFE1330CE4C,?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330C53C

PyErr_NoMemory.PYTHON311(?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330CE8C
_Py_Dealloc.PYTHON311 ref: 00007FFE1330CFCD

Part of subcall function 00007FFE1330F698: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1330CE69,?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330F6AD
Part of subcall function 00007FFE1330F698: VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FFE1330CE69,?,?,?,?,?,00007FFE13306CC2), ref: 00007FFE1330F6ED

ffi_prep_cif.LIBFFI-8 ref: 00007FFE1330CF4E
PyErr_Format.PYTHON311 ref: 00007FFE1330CF6C
ffi_prep_closure.LIBFFI-8 ref: 00007FFE1330CF86
PyErr_SetString.PYTHON311 ref: 00007FFE1330CFBE

Strings

ffi_prep_cif failed with %d, xrefs: 00007FFE1330CF58
invalid result type for callback function, xrefs: 00007FFE1330CFB4
ffi_prep_closure failed with %d, xrefs: 00007FFE1330CF90

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Object_$AllocDeallocFormatInfoMemoryStringSystemTrackVirtualffi_prep_cifffi_prep_closurememset
String ID: ffi_prep_cif failed with %d$ffi_prep_closure failed with %d$invalid result type for callback function
API String ID: 262837356-3338905684
Opcode ID: d5e79a3c8a6f2ae5980b289ff7b9deb079edb7f79e81270934b3751b0593511a
Instruction ID: 7615e6bcaefc756dcf03c9eaed563334c177df4f32ba9eea240e080a6d89092f
Opcode Fuzzy Hash: d5e79a3c8a6f2ae5980b289ff7b9deb079edb7f79e81270934b3751b0593511a
Instruction Fuzzy Hash: C1510A72A09F42C9EB548F26E84067D63A0FB64BA4F1401B6DE2D6B679CF3CD455C388

Function 00007FFE13205E1C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205E5E
_PyDeadline_Get.PYTHON311 ref: 00007FFE13205E96
PyErr_CheckSignals.PYTHON311 ref: 00007FFE13205F06
PyBuffer_Release.PYTHON311 ref: 00007FFE13205F1E
PyBuffer_Release.PYTHON311 ref: 00007FFE13205F3A
PyErr_SetString.PYTHON311 ref: 00007FFE13205F7D

Strings

timed out, xrefs: 00007FFE13205F73
y*|i:sendall, xrefs: 00007FFE13205E44

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_Err_Release$Arg_CheckDeadline_ParseSignalsSizeStringTuple_
String ID: timed out$y*|i:sendall
API String ID: 1463051379-3431350491
Opcode ID: 0233282a2e0e5b505cd3ce4dbfb0ae80f2fea130364450412f972856bf191ae2
Instruction ID: 87f04f6d099c9cca1cf66a3b086bbe0d4dfa449452bec871a4d142891f37d267
Opcode Fuzzy Hash: 0233282a2e0e5b505cd3ce4dbfb0ae80f2fea130364450412f972856bf191ae2
Instruction Fuzzy Hash: D9411A31A0CE8289E710AF12E84426E7760FBD4BA4F544076DE8E63B64DF7CE449C740

Function 00007FFE13205934 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205963
PyErr_SetString.PYTHON311 ref: 00007FFE13205988
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1320599D
_PyBytes_Resize.PYTHON311 ref: 00007FFE132059E6
PyTuple_Pack.PYTHON311 ref: 00007FFE132059FD
_Py_Dealloc.PYTHON311 ref: 00007FFE13205A16
_Py_Dealloc.PYTHON311 ref: 00007FFE13205A2A

Strings

negative buffersize in recvfrom, xrefs: 00007FFE1320597E
n|i:recvfrom, xrefs: 00007FFE13205950

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Bytes_DeallocSizeStringTuple_$Arg_Err_FromPackParseResize
String ID: negative buffersize in recvfrom$n|i:recvfrom
API String ID: 3092067012-1867657612
Opcode ID: 1109addb0000dc4976cb9f45841f30f465119ce44644b453f1eae205618acd3f
Instruction ID: 375ffd05078628b046a98beefb2449cee3cb2b9a4c784b1a6cb33572cc3f8b4c
Opcode Fuzzy Hash: 1109addb0000dc4976cb9f45841f30f465119ce44644b453f1eae205618acd3f
Instruction Fuzzy Hash: 21315C72A1DF4689EE44AB12E49417E67A0FFE4BE4F544075EA8E67768DE3CE008C740

Function 00007FFE1330E0F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330E120
_PyUnicode_FromId.PYTHON311 ref: 00007FFE1330E144
PyObject_VectorcallMethod.PYTHON311 ref: 00007FFE1330E168
_PyObject_GetAttrId.PYTHON311 ref: 00007FFE1330E180
PyObject_Call.PYTHON311 ref: 00007FFE1330E199
_Py_Dealloc.PYTHON311 ref: 00007FFE1330E1AB
_Py_Dealloc.PYTHON311 ref: 00007FFE1330E1BF
_Py_Dealloc.PYTHON311 ref: 00007FFE1330E1D3

Strings

OO!, xrefs: 00007FFE1330E119

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocObject_$Arg_AttrCallFromMethodParseTupleUnicode_Vectorcall
String ID: OO!
API String ID: 3012979734-3205451899
Opcode ID: b86a9e6aec3d04f9dfe7387ee9b59cc105e28f1fb880d666b22fe7cdd29bfbaf
Instruction ID: dae5c028f66e8284a32fb9d86f9af210c76b63ade4681fea1e9e022e956469fa
Opcode Fuzzy Hash: b86a9e6aec3d04f9dfe7387ee9b59cc105e28f1fb880d666b22fe7cdd29bfbaf
Instruction Fuzzy Hash: 0C212A71B0DF46C9EE488B63E854678A3A0AF68BA0F0440B5DD6E67775EE7CE4458308

Function 00007FFE1330E224 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFE1330E26C
PyUnicode_AsWideCharString.PYTHON311 ref: 00007FFE1330E27E
PyErr_SetString.PYTHON311 ref: 00007FFE1330E2A9
PyMem_Free.PYTHON311 ref: 00007FFE1330E2B2
SysAllocStringLen.OLEAUT32 ref: 00007FFE1330E2BF
PyMem_Free.PYTHON311 ref: 00007FFE1330E2CB
SysFreeString.OLEAUT32 ref: 00007FFE1330E2DD

Strings

unicode string expected instead of %s instance, xrefs: 00007FFE1330E25E
String too long for BSTR, xrefs: 00007FFE1330E29F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: String$Free$Err_Mem_$AllocCharFormatUnicode_Wide
String ID: String too long for BSTR$unicode string expected instead of %s instance
API String ID: 920172908-178309214
Opcode ID: cf6aaef1cfa7e26ad3eb861eb924d9a3e9377ee2f3586ae237e535f2c803a6dc
Instruction ID: 46dd7cb431599e55c65e945c01a5df915f93b970ab5652e5eff641bb45468603
Opcode Fuzzy Hash: cf6aaef1cfa7e26ad3eb861eb924d9a3e9377ee2f3586ae237e535f2c803a6dc
Instruction Fuzzy Hash: D9213861B09F42C9EA44DB53E840179A364FFA8FE0F1440B2EA6E63735DE3CE4858318

Function 00007FFE1330A080 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330A0AB
PyErr_Format.PYTHON311 ref: 00007FFE1330A0DF
PyErr_SetString.PYTHON311 ref: 00007FFE1330A105
_Py_Dealloc.PYTHON311 ref: 00007FFE1330A114
memcpy.VCRUNTIME140 ref: 00007FFE1330A127
_Py_Dealloc.PYTHON311 ref: 00007FFE1330A143

Strings

can't delete attribute, xrefs: 00007FFE1330A0A1
bytes expected instead of %s instance, xrefs: 00007FFE1330A0D1
byte string too long, xrefs: 00007FFE1330A0FB

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$DeallocString$Formatmemcpy
String ID: byte string too long$bytes expected instead of %s instance$can't delete attribute
API String ID: 1948958528-1866040848
Opcode ID: fa96def4341ef930101010d25cc26409db7019c647d688fb077c539500109b12
Instruction ID: c7a83d555d5c71d1886241eaabd11c21cc8678994cd5f2090f01e880cda3dd46
Opcode Fuzzy Hash: fa96def4341ef930101010d25cc26409db7019c647d688fb077c539500109b12
Instruction Fuzzy Hash: 62214F71A08E42C9FB548B1BE94017C63A0FB64BB4F145272DA2E67676CF2CE4868309

Function 00007FFE13206C48 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206C82
PySys_Audit.PYTHON311 ref: 00007FFE13206CA1
PyEval_SaveThread.PYTHON311 ref: 00007FFE13206CC8
gethostbyname.WS2_32 ref: 00007FFE13206CD6
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13206CE2
PyMem_Free.PYTHON311 ref: 00007FFE13206D03

Strings

idna, xrefs: 00007FFE13206C72
socket.gethostbyname, xrefs: 00007FFE13206C9A
et:gethostbyname_ex, xrefs: 00007FFE13206C79

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_AuditFreeMem_ParseRestoreSaveSizeSys_Tuple_gethostbyname
String ID: et:gethostbyname_ex$idna$socket.gethostbyname
API String ID: 646687969-574663143
Opcode ID: 91a3a09bb96c3ec567ad4bee7220103acfbdc48aa8aae966a13cdd727d66b018
Instruction ID: 3968eadf10d801195fbdd514d162c6628253a6c100bdfe593b6768975c85a0de
Opcode Fuzzy Hash: 91a3a09bb96c3ec567ad4bee7220103acfbdc48aa8aae966a13cdd727d66b018
Instruction Fuzzy Hash: 40212C61B19F8299EA20AB63F9447AE6760FBD8BE4F400171DE4E67675DE3CE148C700

Function 00007FFE132077F0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13207817
inet_pton.WS2_32 ref: 00007FFE1320782F
PyErr_SetFromErrno.PYTHON311 ref: 00007FFE13207843
PyErr_SetString.PYTHON311 ref: 00007FFE13207895

Strings

illegal IP address string passed to inet_pton, xrefs: 00007FFE1320784D
unknown address family, xrefs: 00007FFE13207884
is:inet_pton, xrefs: 00007FFE1320780B

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Arg_ErrnoFromParseSizeStringTuple_inet_pton
String ID: illegal IP address string passed to inet_pton$is:inet_pton$unknown address family
API String ID: 907464-903159468
Opcode ID: 76e364a5825f36d5229760115179826e02bb58eaa43d797573741c5185630340
Instruction ID: b928cd52e8662afa59680668419e30a025081a51e1ea749b08bde2072ac27d07
Opcode Fuzzy Hash: 76e364a5825f36d5229760115179826e02bb58eaa43d797573741c5185630340
Instruction Fuzzy Hash: 56214961A18E43CAEA54EB16E89007E3771FBE4B64F8000B2E64E66674DF7CE50DD700

Function 00007FFE13204AD4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyErr_Fetch.PYTHON311 ref: 00007FFE13204AEC
PyErr_ResourceWarning.PYTHON311 ref: 00007FFE13204B10
PyErr_ExceptionMatches.PYTHON311 ref: 00007FFE13204B24
PyErr_WriteUnraisable.PYTHON311 ref: 00007FFE13204B31
PyEval_SaveThread.PYTHON311 ref: 00007FFE13204B43
closesocket.WS2_32 ref: 00007FFE13204B4F
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13204B58
PyErr_Restore.PYTHON311 ref: 00007FFE13204B72

Strings

unclosed %R, xrefs: 00007FFE13204B01

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Eval_RestoreThread$ExceptionFetchMatchesResourceSaveUnraisableWarningWriteclosesocket
String ID: unclosed %R
API String ID: 1289403202-2306019038
Opcode ID: 6ca4684e6c490ddef4b79f5831110087eb726c1f75fd13c900abb8b822a24d75
Instruction ID: 1d4f7ab15117b9c731e5b18f5afc718d91a2ce978ea92529ca37091366182da4
Opcode Fuzzy Hash: 6ca4684e6c490ddef4b79f5831110087eb726c1f75fd13c900abb8b822a24d75
Instruction Fuzzy Hash: 6C11E361A08F8286EA04AB62E84416E6760FBD5BB5F045271DE6A636F4CE7CD449C700

Function 00007FFE1A458BA4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458C6E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458C7E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458CCA
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458CDA
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458CEA
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458D5D
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458D6E
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458D80
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458DAC
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A458DBB

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
Instruction ID: 56f909d69b1f1cf20fb15c748fcca14e974003353800fc56cc72e71922b216bb
Opcode Fuzzy Hash: ea53d01b8add9f065da6da89440d1b5514e5cb284af6834d09ce1e9fb4639f71
Instruction Fuzzy Hash: 326170A2F14B5698FB01EBA2D8400FC37B1BB04BA8F5044B6DE0D6BA69DF78D555C740

Function 00007FFE13253360 Relevance: 15.1, APIs: 10, Instructions: 146COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FFE132533DE
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE13253466
PyMem_Malloc.PYTHON311 ref: 00007FFE132534AF
memmove.VCRUNTIME140 ref: 00007FFE132534DD
PyMem_Realloc.PYTHON311 ref: 00007FFE132534FA
_Py_Dealloc.PYTHON311 ref: 00007FFE1325B6C4

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_memmove$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 1285943476-0
Opcode ID: b1532046c9828cc468a7a84711bf2d79d67f1a2fff2fc6f6c5e67236e34e6897
Instruction ID: 706c13f8c980a088bf53dfe9a550876972e717ec955584ee33f8ecbc8084d03a
Opcode Fuzzy Hash: b1532046c9828cc468a7a84711bf2d79d67f1a2fff2fc6f6c5e67236e34e6897
Instruction Fuzzy Hash: E75181A2A09F4289EB11AF2794042B923A4FBA4FA4F145675CF4D67774EF3CE552C300

Function 00007FFE13206568 Relevance: 15.1, APIs: 10, Instructions: 59networkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON311 ref: 00007FFE13206586
PyErr_Occurred.PYTHON311 ref: 00007FFE13206595
GetCurrentProcessId.KERNEL32 ref: 00007FFE132065A0
WSADuplicateSocketW.WS2_32 ref: 00007FFE132065B0
WSASocketW.WS2_32 ref: 00007FFE132065E3
SetHandleInformation.KERNEL32 ref: 00007FFE132065FC
closesocket.WS2_32 ref: 00007FFE13206609
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE13206611
PyLong_FromLongLong.PYTHON311 ref: 00007FFE13206623
closesocket.WS2_32 ref: 00007FFE13206634

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Long$Err_FromLong_Socketclosesocket$CurrentDuplicateHandleInformationOccurredProcessWindows
String ID:
API String ID: 3394293678-0
Opcode ID: 0edd20fb7986b937f362815becdc3353667b1d2dbe2f27d78ce67fe63332d1ae
Instruction ID: c9283c0eab9d269261c7400ca5700c690885b11612ffba76b7763d179136beaa
Opcode Fuzzy Hash: 0edd20fb7986b937f362815becdc3353667b1d2dbe2f27d78ce67fe63332d1ae
Instruction Fuzzy Hash: 7B217720A19F428AEA647B62A85437E6791EFE8BB4F140775C86E167F4DF7CE00CC600

Function 00007FF6019902E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF601990328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6019906F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF60199098F

Strings

f, xrefs: 00007FF6019903C0
f, xrefs: 00007FF601990575
f, xrefs: 00007FF60199042A
p, xrefs: 00007FF601990432
p, xrefs: 00007FF6019903CD

Memory Dump Source

Source File: 00000001.00000002.2982288513.00007FF601981000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF601980000, based on PE: true

Associated: 00000001.00000002.2982272737.00007FF601980000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982311973.00007FF6019AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982333894.00007FF6019C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2982368015.00007FF6019C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff601980000_uOsIQqfgiT.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction ID: 098fbd19f382b4396cbf98957524c58767e87eda1823548b710af2f22e4c4317
Opcode Fuzzy Hash: 47a7a6303f50c331757a7ed503f6ccc132970c05c2223996d06c8e5714df85c4
Instruction Fuzzy Hash: 2C12A322E0C1438AFB209A19E4347BD7659FB9075CFAC4131F6AA866C6DF3DE4809B51

Function 00007FFE1A4533E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE1A45357E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45358B

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453839
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453884
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE1A4538B9

Strings

csm, xrefs: 00007FFE1A453527
csm, xrefs: 00007FFE1A4535A7
csm, xrefs: 00007FFE1A4534C5

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
Instruction ID: 20cd599cd6a96cf8b22c4d9fa5763be91f5c11988486441bffc663a94f426c4f
Opcode Fuzzy Hash: 688fb15556d862c72de40c94a9225dad620afe04ad3ce9f2b8c9a53cb021efd3
Instruction Fuzzy Hash: 68E1A2B3A08A818AE714AF36D4903BD77A0FB45F68F1441B6DA8D47766CF38E595CB00

Function 00007FFE1330BBE8 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE1330BCE5

Strings

wrong type, xrefs: 00007FFE1330BE60
P, xrefs: 00007FFE1330BD47

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc
String ID: P$wrong type
API String ID: 3617616757-281217272
Opcode ID: e3327ad88a9a446218fbdf097499024a9865fdc2e91cfe0628b0646d4787f104
Instruction ID: b481b5e2506ce6448c3b95e56308023425a0c44fe6d9c3b7263820f9ee56f9e9
Opcode Fuzzy Hash: e3327ad88a9a446218fbdf097499024a9865fdc2e91cfe0628b0646d4787f104
Instruction Fuzzy Hash: 56713F21B09E46C9FA589F17E85017E67A1AF65BA0F0444B1DA3E673B2DF3CE441C348

Function 00007FFE13301ABC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

PyLong_AsVoidPtr.PYTHON311 ref: 00007FFE13301B4D

Part of subcall function 00007FFE13301B80: _PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13301BC1
Part of subcall function 00007FFE13301B80: PySequence_Tuple.PYTHON311 ref: 00007FFE13301BE4
Part of subcall function 00007FFE13301B80: _PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13301C15
Part of subcall function 00007FFE13301B80: PySys_Audit.PYTHON311 ref: 00007FFE13301C4B
Part of subcall function 00007FFE13301B80: PyObject_GetAttrString.PYTHON311 ref: 00007FFE13301C64
Part of subcall function 00007FFE13301B80: PyLong_AsVoidPtr.PYTHON311 ref: 00007FFE13301C8D
Part of subcall function 00007FFE13301B80: PyErr_Occurred.PYTHON311 ref: 00007FFE13301CA0

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13306C60
PyCallable_Check.PYTHON311 ref: 00007FFE13306C73
PyErr_SetString.PYTHON311 ref: 00007FFE13306D5C

Strings

argument must be callable or integer function address, xrefs: 00007FFE13306C7D
cannot construct instance of this class: no argtypes, xrefs: 00007FFE13306D4B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_ParseSizeTuple_$Err_Long_StringVoid$AttrAuditCallable_CheckObject_OccurredSequence_Sys_Tuple
String ID: argument must be callable or integer function address$cannot construct instance of this class: no argtypes
API String ID: 2570622991-2742191083
Opcode ID: 540973c798f55e8bddb45151d9b86c5f877ff1e98a5e2c5b0f3278a9c8d95e1e
Instruction ID: 8ebff92b8767da4ef9fdcc61a77bc7ecee94b60dbf89d82f6f9dbc57fa4e04b2
Opcode Fuzzy Hash: 540973c798f55e8bddb45151d9b86c5f877ff1e98a5e2c5b0f3278a9c8d95e1e
Instruction Fuzzy Hash: 9A514F25E0DF4289EA548B17955427D63A0EF65FF0F1840B1DE2E677B9EF2CE4419308

Function 00007FFE13251FFC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1325B170

Strings

VUUU, xrefs: 00007FFE132520B9
%d work, %d block, ratio %5.2f, xrefs: 00007FFE1325B156
too repetitive; using fallback sorting algorithm, xrefs: 00007FFE1325B179

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: 9108c4c4e2d6d5df63023b1ab5f74cbde5b98f3dbb4d4334f7fd8b373665a9e5
Instruction ID: 40afa703c65d5382ffe84ada64c55a8fd3ce94f2becb38a9cb66c7ef6ca7b51a
Opcode Fuzzy Hash: 9108c4c4e2d6d5df63023b1ab5f74cbde5b98f3dbb4d4334f7fd8b373665a9e5
Instruction Fuzzy Hash: 2B41A5B2A08B418BE710AF2694451B977A4FBE5B64F104375DA0E637B5EF3DE682C600

Function 00007FFE1A45C1D8 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C38C

Part of subcall function 00007FFE1A458EE4: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A459455
Part of subcall function 00007FFE1A458EE4: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45948A

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C33E

Strings

cli::pin_ptr<, xrefs: 00007FFE1A45C355
std::nullptr_t, xrefs: 00007FFE1A45C2B7
void , xrefs: 00007FFE1A45C24A
void, xrefs: 00007FFE1A45C222
cli::array<, xrefs: 00007FFE1A45C30B
std::nullptr_t , xrefs: 00007FFE1A45C2CA

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
Instruction ID: 6687bc44508bd485d866c25ff530da5c347406c5587ee02f6a3bf1957e2a0818
Opcode Fuzzy Hash: e6d89d71e33ac373f0738e0b515b9d7d47b180a069a0d86b59b00a9470073de2
Instruction Fuzzy Hash: B1514CA2F18F4598FB11DB62D8412BD77B0BB08B64F4442F6DA4D13AA5DF3C90A4C754

Function 00007FFE130C25C8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PySequence_Fast.PYTHON311(00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C25F0
PyObject_AsFileDescriptor.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C265C
PyErr_SetString.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26CA
_Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26D9
_Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C26E8

Strings

arguments 1-3 must be sequences, xrefs: 00007FFE130C25E3
too many file descriptors in select(), xrefs: 00007FFE130C26C0

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$DescriptorErr_FastFileObject_Sequence_String
String ID: arguments 1-3 must be sequences$too many file descriptors in select()
API String ID: 3320488554-3996108163
Opcode ID: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
Instruction ID: 897d4a1924f98709312bba0c75f7e7565735dc8aaa4f8fe449576fd6daa43a8f
Opcode Fuzzy Hash: 05e470237c1967013c16db83c877e5144c843c525c657350500e77854bb128da
Instruction Fuzzy Hash: 08417C32619F018AEA108F1AE94413977AAFBA4BB4F4042F5DE6E53BA4DF3CE454C300

Function 00007FFE13302600 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON311 ref: 00007FFE13307330
PyObject_CallFunction.PYTHON311 ref: 00007FFE13307349
_Py_Dealloc.PYTHON311 ref: 00007FFE13307358
PyObject_CallOneArg.PYTHON311 ref: 00007FFE1330738B
_PyTraceback_Add.PYTHON311 ref: 00007FFE133073AD
_Py_Dealloc.PYTHON311 ref: 00007FFE133073BC

Strings

GetResult, xrefs: 00007FFE133073A6
_ctypes/callproc.c, xrefs: 00007FFE1330739F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CallDeallocObject_$FromFunctionLongLong_Traceback_
String ID: GetResult$_ctypes/callproc.c
API String ID: 2301701745-4166898048
Opcode ID: 6b14f494761338040cbc18ac8ef32615b91be7de93a4bad4d1a784e7f6cbc817
Instruction ID: 8f0950a55ee070ba3f572378fbce4730311934dc6ef709895f8926dcaae0fbea
Opcode Fuzzy Hash: 6b14f494761338040cbc18ac8ef32615b91be7de93a4bad4d1a784e7f6cbc817
Instruction Fuzzy Hash: 9C318121B0DE46C9FE659B27E80017DA3A4EF65BB0F0850B0DE2E677B5DE2CE4418308

Function 00007FFE13309D58 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311(?,?,00000000,00007FFE13306BCC), ref: 00007FFE13309D73
PyObject_IsInstance.PYTHON311(?,?,00000000,00007FFE13306BCC), ref: 00007FFE13309DBB
PyErr_Format.PYTHON311(?,?,00000000,00007FFE13306BCC), ref: 00007FFE13309E4D

Strings

expected %s instance instead of pointer to %s, xrefs: 00007FFE13309DDF
???, xrefs: 00007FFE13309DD8
expected %s instance instead of %s, xrefs: 00007FFE13309E34

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: InstanceObject_$Err_Format
String ID: ???$expected %s instance instead of %s$expected %s instance instead of pointer to %s
API String ID: 215623467-1082101171
Opcode ID: c42a85ef290f4f7c7dec54bd01f908c692fe1a4d2cba32a0c83425372474c043
Instruction ID: 4e161a3b9d63e6f5c35625d50e32504bd2d309ca86a674f40f63be979fa1f2a9
Opcode Fuzzy Hash: c42a85ef290f4f7c7dec54bd01f908c692fe1a4d2cba32a0c83425372474c043
Instruction Fuzzy Hash: A0312D21A08E42C9EA549B67D54007D6361AF68FB4F5454B2EA3D677B5DF3CE841C308

Function 00007FFE132538BC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON311(?,?,?,00007FFE132538A7), ref: 00007FFE132538C9
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1325390F
PyThread_free_lock.PYTHON311(?,?,?,00007FFE132538A7), ref: 00007FFE13253950
PyErr_SetString.PYTHON311(?,?,?,00007FFE132538A7), ref: 00007FFE1325B775

Strings

Unable to allocate lock, xrefs: 00007FFE1325B76B

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: String$Bytes_Err_FromSizeThread_allocate_lockThread_free_lock
String ID: Unable to allocate lock
API String ID: 1127547223-3516605728
Opcode ID: c17eff7bc98fcddad25fa0aa7e8872bdeafa31c641a1adeb9191edbd123e9819
Instruction ID: 14eaf8b2cbd60f767584ab78343eb459cf40e1487f533eea8802d03239cb2a05
Opcode Fuzzy Hash: c17eff7bc98fcddad25fa0aa7e8872bdeafa31c641a1adeb9191edbd123e9819
Instruction Fuzzy Hash: 98314DB2A08E4289EB54AF32D5453B823A0FFA4F78F1443B4CA4D566A5EF3CD685C740

Function 00007FFE1330D81C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330D85C
PyTuple_New.PYTHON311 ref: 00007FFE1330D87B
PyLong_FromSsize_t.PYTHON311 ref: 00007FFE1330D89E
PyErr_Occurred.PYTHON311 ref: 00007FFE1330D8B8
_Py_Dealloc.PYTHON311 ref: 00007FFE1330D8CC
Py_BuildValue.PYTHON311 ref: 00007FFE1330D8EC

Strings

siN, xrefs: 00007FFE1330D8DB
not a ctypes type or object, xrefs: 00007FFE1330D852

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$BuildDeallocFromLong_OccurredSsize_tStringTuple_Value
String ID: not a ctypes type or object$siN
API String ID: 1444022424-92050270
Opcode ID: 26a9fcd1b49395e45c52150cf6bc8a8343daf74cdcd0b31558393dc906a49e26
Instruction ID: 6758697bf73cc464dc60aec8874013aed65d50006f45ef7fd120af1ec3e67543
Opcode Fuzzy Hash: 26a9fcd1b49395e45c52150cf6bc8a8343daf74cdcd0b31558393dc906a49e26
Instruction Fuzzy Hash: 4C212921B09F42C9EA549B27E59427D63A0FF68FB5F0440B5DA2E67779DF2CE4418308

Function 00007FFE13207988 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49timeCOMMON

Download Yara Rule

APIs

_PyTime_FromSeconds.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE1320799F
_PyTime_FromSecondsObject.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE132079B6
PyErr_SetString.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE132079D9
_PyTime_AsTimeval.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE132079FB
_PyTime_AsMilliseconds.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE13207A10
PyErr_SetString.PYTHON311(?,?,?,00007FFE13206397), ref: 00007FFE13207A43

Strings

timeout doesn't fit into C timeval, xrefs: 00007FFE13207A39
Timeout value out of range, xrefs: 00007FFE132079CF

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Time_$Err_FromSecondsString$MillisecondsObjectTimeval
String ID: Timeout value out of range$timeout doesn't fit into C timeval
API String ID: 4240314503-2798848688
Opcode ID: f4a3403413d0b3d7c856c31cf8b7ba7531603333823162405e1bc3dc7e5ad81e
Instruction ID: d1218579e37c8188ced54c8a40a4c9ca93e6683d600a028a0943f6c9a4dbb72c
Opcode Fuzzy Hash: f4a3403413d0b3d7c856c31cf8b7ba7531603333823162405e1bc3dc7e5ad81e
Instruction Fuzzy Hash: E1112E32A18E4286EA10AB6AE44013E2761EBE4BB0F045271DAAD577B4DF7DE449C301

Function 00007FFE13252780 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFE132527AA
PyObject_GetBuffer.PYTHON311 ref: 00007FFE132527BA
PyBuffer_IsContiguous.PYTHON311 ref: 00007FFE132527CB
PyBuffer_Release.PYTHON311 ref: 00007FFE132527F6
_PyArg_BadArgument.PYTHON311 ref: 00007FFE1325B35E

Part of subcall function 00007FFE132526EC: PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325270F
Part of subcall function 00007FFE132526EC: PyThread_release_lock.PYTHON311 ref: 00007FFE1325273B

Strings

compress, xrefs: 00007FFE1325B357
argument, xrefs: 00007FFE1325B350
contiguous buffer, xrefs: 00007FFE1325B349

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_$Arg_ArgumentBufferContiguousObject_ReleaseThread_acquire_lockThread_release_lockmemset
String ID: argument$compress$contiguous buffer
API String ID: 1731275941-2310704374
Opcode ID: b138ca2d2723dab52cb10e3a74fac2df87b6dda8ec1f7609b2bdead44722ed7b
Instruction ID: 4b37c937593851727c7551ad08223b0ec195494cd07061087c8e12624bd05480
Opcode Fuzzy Hash: b138ca2d2723dab52cb10e3a74fac2df87b6dda8ec1f7609b2bdead44722ed7b
Instruction Fuzzy Hash: CD1172A2A18B4295EB10EB26E8441F96360FBE8F94F9482B1D94D63674EE3CD645C700

Function 00007FFE13309FEC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330A00E
PyObject_GetBuffer.PYTHON311 ref: 00007FFE1330A024
PyErr_SetString.PYTHON311 ref: 00007FFE1330A04A
PyBuffer_Release.PYTHON311 ref: 00007FFE1330A055
memcpy.VCRUNTIME140 ref: 00007FFE1330A066
PyBuffer_Release.PYTHON311 ref: 00007FFE1330A070

Strings

cannot delete attribute, xrefs: 00007FFE1330A004
byte string too long, xrefs: 00007FFE1330A040

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_Err_ReleaseString$BufferObject_memcpy
String ID: byte string too long$cannot delete attribute
API String ID: 1128862751-688604938
Opcode ID: c0fad4b2d32ac0ab3663af02738014edb070c5b9f2759e00e789a8b2334ff090
Instruction ID: 6ce2c4e505abf9841be9d4a3bf664836cf2e77c7ab52b4deaf87338635bdc81a
Opcode Fuzzy Hash: c0fad4b2d32ac0ab3663af02738014edb070c5b9f2759e00e789a8b2334ff090
Instruction Fuzzy Hash: F1018B61B18D46C5FB20CB27E8400B96360FFA4BA8F504272D97E672B5DF2CE589C708

Function 00007FFE13206FFC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 32threadCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1320700F
PyEval_SaveThread.PYTHON311 ref: 00007FFE13207027
getprotobyname.WS2_32 ref: 00007FFE13207035
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13207041
PyErr_SetString.PYTHON311 ref: 00007FFE13207062

Strings

protocol not found, xrefs: 00007FFE13207058
s:getprotobyname, xrefs: 00007FFE13207008

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_ParseRestoreSaveSizeStringTuple_getprotobyname
String ID: protocol not found$s:getprotobyname
API String ID: 862796068-630402058
Opcode ID: a4d0f157e69161900fd295891aa016e7b70d442cf82c6e992c0432fa93d25ec1
Instruction ID: a991027e674c3f385160d65b168041f05399d09f4b26c14c64285638022dee1c
Opcode Fuzzy Hash: a4d0f157e69161900fd295891aa016e7b70d442cf82c6e992c0432fa93d25ec1
Instruction Fuzzy Hash: 51010861A18E428AEA04AB26E99403E67A1FBE8FE1F440471DA4E67634DE7CE04CC700

Function 00007FFE132075AC Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 29stringCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132075BF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE132075D5
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE132075F0
inet_addr.WS2_32 ref: 00007FFE13207600
PyErr_SetString.PYTHON311 ref: 00007FFE13207620

Strings

illegal IP address string passed to inet_aton, xrefs: 00007FFE13207616
s:inet_aton, xrefs: 00007FFE132075B8
255.255.255.255, xrefs: 00007FFE132075CE

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: SizeString$Arg_Bytes_Err_FromParseTuple_inet_addrstrcmp
String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
API String ID: 717551241-4110412280
Opcode ID: b3f22b26161e9026f1be4ea104701ab941468ac977f48e4eaa3df88f05bedf50
Instruction ID: 39e9ad3023ffb8f3b9693e0a3ae3b20b4af3f56d670cc47915b45f47336bbcf8
Opcode Fuzzy Hash: b3f22b26161e9026f1be4ea104701ab941468ac977f48e4eaa3df88f05bedf50
Instruction Fuzzy Hash: 7D01ECA1A08E438AEA14BB2AE89017E2761EFE57B4F500171D65EA75B4DF7CD44DC700

Function 00007FFE1320762C Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE1320763F
PyErr_SetString.PYTHON311 ref: 00007FFE13207662
PyBuffer_Release.PYTHON311 ref: 00007FFE1320766D
PyBuffer_Release.PYTHON311 ref: 00007FFE13207688
inet_ntoa.WS2_32 ref: 00007FFE13207690
PyUnicode_FromString.PYTHON311 ref: 00007FFE13207699

Strings

packed IP wrong length for inet_ntoa, xrefs: 00007FFE13207658
y*:inet_ntoa, xrefs: 00007FFE13207638

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_ReleaseString$Arg_Err_FromParseSizeTuple_Unicode_inet_ntoa
String ID: packed IP wrong length for inet_ntoa$y*:inet_ntoa
API String ID: 1492101624-3027498899
Opcode ID: ccab7d2a64d4296dd88b38da3c028862919155823b55703005afc4c29e9b2518
Instruction ID: 3b47b9e02cc78870ac4a176b5abe857303592be29cc4fb7bc6df7de6ce39a104
Opcode Fuzzy Hash: ccab7d2a64d4296dd88b38da3c028862919155823b55703005afc4c29e9b2518
Instruction Fuzzy Hash: 30012161A08E4286DA10AF26E89407E2360FFE4B94B540171D64E63674DE7CD10DCB00

Function 00007FFE13305950 Relevance: 13.7, APIs: 9, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFE13305978
__scrt_initialize_crt.LIBCMT ref: 00007FFE133059BD
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFE133059CA
_RTC_Initialize.LIBCMT ref: 00007FFE133059F8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFE13305A1E
__scrt_release_startup_lock.LIBCMT ref: 00007FFE13305A49

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 31b097c5beb5f15cde6c2b56eb33e70b4a1a94a0495c7f4a48947f332bb9daf1
Instruction ID: 976eb9ca490bdeb8ee8b52893b56f8f421b76d67cc0ad341a57930f5919ffdd4
Opcode Fuzzy Hash: 31b097c5beb5f15cde6c2b56eb33e70b4a1a94a0495c7f4a48947f332bb9daf1
Instruction Fuzzy Hash: 57819A21E1CA03CEF650AB6B948127D6290AFA57B0F5440B5EA6D737F7DE3CE8458708

Function 00007FFE13302FC0 Relevance: 13.7, APIs: 9, Instructions: 155COMMON

Download Yara Rule

APIs

PyTuple_GetItem.PYTHON311 ref: 00007FFE13302FE9
_PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13303049
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE133030E6
PyDict_Update.PYTHON311 ref: 00007FFE13303181
_Py_Dealloc.PYTHON311 ref: 00007FFE133031A4
_Py_CheckFunctionResult.PYTHON311 ref: 00007FFE13307D06

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dict_Item$CallCheckDeallocErrorFunctionMakeObject_ResultTuple_UpdateWith
String ID:
API String ID: 1807771726-0
Opcode ID: 42a6a9498eb4336f8fb7f7e14a875b7f35efea189098be1472c8111e8b538fde
Instruction ID: f45856ba144baee5ab0ccf33eca39afd7f82fe8a2115168b66493173047daa82
Opcode Fuzzy Hash: 42a6a9498eb4336f8fb7f7e14a875b7f35efea189098be1472c8111e8b538fde
Instruction Fuzzy Hash: 98616F21A09F4289FA558B27E94437D63A0BF65BB4F0840B5DA6D277B5DF3CE055C308

Function 00007FFE1320444C Relevance: 13.6, APIs: 9, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203864: PyErr_SetString.PYTHON311 ref: 00007FFE1320389A

memset.VCRUNTIME140 ref: 00007FFE1320448E

Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE13204763
Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE1320476B
Part of subcall function 00007FFE132046BC: PyErr_CheckSignals.PYTHON311 ref: 00007FFE1320477C

SetHandleInformation.KERNEL32 ref: 00007FFE132044ED
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE132044F9
closesocket.WS2_32 ref: 00007FFE13204502
PyLong_FromLongLong.PYTHON311 ref: 00007FFE13204515
closesocket.WS2_32 ref: 00007FFE13204526

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$ErrorFromLastLongclosesocket$CheckHandleInformationLong_SignalsStringWindowsmemset
String ID:
API String ID: 205095079-0
Opcode ID: 49c354e606523974a3277e7978bdea3490ed1b4ba92528b3e4dfffad4a66567c
Instruction ID: d3171a450ee13d4b427c1b5774ed98362ff0e449d42159c4311156843572dbe6
Opcode Fuzzy Hash: 49c354e606523974a3277e7978bdea3490ed1b4ba92528b3e4dfffad4a66567c
Instruction Fuzzy Hash: 8C416731608F8289EA64AB53E4403BE67A4FFE9BA0F444075DA8D27B65DF7CD448CB40

Function 00007FFE1A4561AA Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456690: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4566D4
Part of subcall function 00007FFE1A456690: RaiseException.KERNEL32 ref: 00007FFE1A45671A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A456247
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE1A4562A3

Strings

Attempted a typeid of nullptr pointer!, xrefs: 00007FFE1A456385
Bad read pointer - no RTTI data!, xrefs: 00007FFE1A4563A8
Access violation - no RTTI data!, xrefs: 00007FFE1A4561AA, 00007FFE1A4563CB
Bad dynamic_cast!, xrefs: 00007FFE1A456312

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
Instruction ID: ec8f4461fab7ece41ab71fbbe15d9c9515926b36fe585e8b5474011d9effbad8
Opcode Fuzzy Hash: ca6cf6770a5e62d56dc10247fecd8c14e7675c1b430a8679457d8e3be21ba961
Instruction Fuzzy Hash: DC51A1A2B18E4692EE20EB56F4802B9A360FF44FA4F5441B3EA4E43675DF3CE525C700

Function 00007FFE1A456B5C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456BE1
GetLastError.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456BEF
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C08
LoadLibraryExW.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C1A
FreeLibrary.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C60
GetProcAddress.KERNEL32(?,?,?,00007FFE1A456D1B,?,?,00000000,00007FFE1A456B4C,?,?,?,?,00007FFE1A456885), ref: 00007FFE1A456C6C

Strings

api-ms-, xrefs: 00007FFE1A456C01

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction ID: c3f432e5d3511cab6fd39c14fd46c7bff2044fef2dfb103abe1d927c75857ece
Opcode Fuzzy Hash: 936032d40fa96b032ac86a2d89c5a398f87e2a2d839e469644f99c68bf1566a7
Instruction Fuzzy Hash: CB31AE61B1AF4281EE22AB07A8005B5B2A4FB49FB5F5D05B6DD2D073A4EF3CE164C200

Function 00007FFE133021A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

PyMem_Malloc.PYTHON311 ref: 00007FFE133021E5
PyDict_Update.PYTHON311 ref: 00007FFE1330224F
_Py_Dealloc.PYTHON311 ref: 00007FFE13302272
PyErr_NoMemory.PYTHON311 ref: 00007FFE13307222
_Py_Dealloc.PYTHON311 ref: 00007FFE13307256

Strings

X{}, xrefs: 00007FFE1330220A

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$CallDict_Err_MakeMallocMem_MemoryObject_Update
String ID: X{}
API String ID: 3445980372-2140212134
Opcode ID: 3f2902342c13d165ca5a04ad6b751020229967bc3c101f7663baa985dba562bd
Instruction ID: 614ee071a9f402aab5257652768e436504bb5be4cf18f1e387ec16bd04652ba7
Opcode Fuzzy Hash: 3f2902342c13d165ca5a04ad6b751020229967bc3c101f7663baa985dba562bd
Instruction Fuzzy Hash: CD315E31A0CF42C9EA958B66A94427D63A4BB65BB0F5841B0DA6D637B1CF3CE4558308

Function 00007FFE13301860 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE133018A7
_Py_Dealloc.PYTHON311 ref: 00007FFE133018F5
_Py_Dealloc.PYTHON311 ref: 00007FFE13306AF1
PyCallable_Check.PYTHON311 ref: 00007FFE13306B12
PyErr_SetString.PYTHON311 ref: 00007FFE13306B31
_Py_Dealloc.PYTHON311 ref: 00007FFE13306B4A

Strings

restype must be a type, a callable, or None, xrefs: 00007FFE13306B27

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$AttrCallable_CheckErr_LookupObject_String
String ID: restype must be a type, a callable, or None
API String ID: 1528254987-4008198047
Opcode ID: 6452f5985481fdf810af319e620606f51f1d816ac9bc74436ba4aa13f9c82220
Instruction ID: f3cb330a21b9b1855cc4e7b8d07ba531b2b01c08a0eeed21457b3f529b3e6571
Opcode Fuzzy Hash: 6452f5985481fdf810af319e620606f51f1d816ac9bc74436ba4aa13f9c82220
Instruction Fuzzy Hash: 90318136F09F0289FA548B67E48037C63A0FF65BB5F1841B0CA2E666B4DF2CE5458308

Function 00007FFE1325C5F8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1325C630
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1325C693
PyList_Append.PYTHON311 ref: 00007FFE1325C6A7
_Py_Dealloc.PYTHON311 ref: 00007FFE1325C6C6
_Py_Dealloc.PYTHON311 ref: 00007FFE1325C6D9

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFE1325C626
Unable to allocate output buffer., xrefs: 00007FFE1325C685

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 9b026c52384d1bde9e7588ce781edc70c1283e8086e1dddbc8207b2c901252c2
Instruction ID: 837503b409e9afc93e8396d7a2a6f29f7ffa6b070091d009a0a8851e0df36be6
Opcode Fuzzy Hash: 9b026c52384d1bde9e7588ce781edc70c1283e8086e1dddbc8207b2c901252c2
Instruction Fuzzy Hash: 4A314DA160AE528AEE14EB17E4400B86360BBE4FB4B545771DA2D577B4FF2CE652C300

Function 00007FFE1330B5AC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330B5DE
PyErr_Format.PYTHON311 ref: 00007FFE1330B622
PyUnicode_AsWideChar.PYTHON311 ref: 00007FFE1330B639
PyUnicode_AsWideChar.PYTHON311 ref: 00007FFE1330B669

Strings

can't delete attribute, xrefs: 00007FFE1330B5D4
unicode string expected instead of %s instance, xrefs: 00007FFE1330B614
string too long, xrefs: 00007FFE1330B653

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CharErr_Unicode_Wide$FormatString
String ID: can't delete attribute$string too long$unicode string expected instead of %s instance
API String ID: 530648689-1577475929
Opcode ID: 54871f426e13d62f20164b13e72e16cb3eb4130456bf9d3dcc44f832ca140448
Instruction ID: e9badf54a58798d0a569a19540ceafa4d599100174a870d8a20312bcfb58e92b
Opcode Fuzzy Hash: 54871f426e13d62f20164b13e72e16cb3eb4130456bf9d3dcc44f832ca140448
Instruction Fuzzy Hash: AC214961B08E46CAEA58CF57E48017CA361FBA4FE0F5455B2DA2D2777ACF2CE4458708

Function 00007FFE1330EBE4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLongMask.PYTHON311 ref: 00007FFE1330EC1D

Strings

_ctypes/cfield.c pymem, xrefs: 00007FFE1330EC77
unicode string or integer address expected instead of %s instance, xrefs: 00007FFE1330EC3F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Long$Long_MaskUnsigned
String ID: _ctypes/cfield.c pymem$unicode string or integer address expected instead of %s instance
API String ID: 1805849926-901310697
Opcode ID: 2ce16603c6b5fb28991612c657e35fb793e2d5932663eadf79fd1512b973919a
Instruction ID: ae26200dfc8a741527e38f10ece6d1c4beac5a77c3d4dda285ebb2abc108e8d7
Opcode Fuzzy Hash: 2ce16603c6b5fb28991612c657e35fb793e2d5932663eadf79fd1512b973919a
Instruction Fuzzy Hash: B7113A62B1AF42C9EA44CF17E84427C6360BB68BA0F5054B6D92E22375EE3DE495C318

Function 00007FFE132537BC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FFE132537E9
PyThread_release_lock.PYTHON311 ref: 00007FFE13253819
PyErr_SetString.PYTHON311 ref: 00007FFE1325384E

Part of subcall function 00007FFE13253360: memmove.VCRUNTIME140 ref: 00007FFE132533DE

PyEval_SaveThread.PYTHON311 ref: 00007FFE1325B73A
PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325B74F
PyEval_RestoreThread.PYTHON311 ref: 00007FFE1325B758

Strings

End of stream already reached, xrefs: 00007FFE13253844

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemmove
String ID: End of stream already reached
API String ID: 4192957916-3466344095
Opcode ID: 9d24e192cd5e41aae34a11841e36e0bc5166bdf8702469d9357772ef0d70671f
Instruction ID: b1c38703de90fe77ac75fc9472168247dc382a8aabfd3b1da272db5a08c9de63
Opcode Fuzzy Hash: 9d24e192cd5e41aae34a11841e36e0bc5166bdf8702469d9357772ef0d70671f
Instruction Fuzzy Hash: 751130A1A08E4189EB04EB63E9442A96764FBD8FD4F0891B1DF1E53725EF3CE556C700

Function 00007FFE132056E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205708
PyErr_SetString.PYTHON311 ref: 00007FFE1320572D
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1320573D
_Py_Dealloc.PYTHON311 ref: 00007FFE13205773
_PyBytes_Resize.PYTHON311 ref: 00007FFE1320578A

Strings

n|i:recv, xrefs: 00007FFE13205701
negative buffersize in recv, xrefs: 00007FFE13205723

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Bytes_SizeString$Arg_DeallocErr_FromParseResizeTuple_
String ID: negative buffersize in recv$n|i:recv
API String ID: 1342606314-3647384195
Opcode ID: 0f2e265d39f511016bcec70da8533312cc5300a70e45771693c718f9922707e5
Instruction ID: eb9b525729a55f20f6f48e82ea5e51834a598bd50ac93590cd0178693f796c18
Opcode Fuzzy Hash: 0f2e265d39f511016bcec70da8533312cc5300a70e45771693c718f9922707e5
Instruction Fuzzy Hash: 2A116D65A0CE42C9EE24AB52E48017EA7A0FFE4BB4F500472D94D67674EEBCE04DD700

Function 00007FFE132526EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325270F
PyThread_release_lock.PYTHON311 ref: 00007FFE1325273B
PyEval_SaveThread.PYTHON311 ref: 00007FFE1325275A
PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325276C
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13252775

Strings

Compressor has been flushed, xrefs: 00007FFE1325B32F

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 4f10c9a98a270c81542dec47670a47e5c1056ddde1cac534f6d7ef28f75aec1e
Instruction ID: ed0fc833e44afe2e1020c279f94429115d0e55cedc5523ac39bcdf773a7a2ef8
Opcode Fuzzy Hash: 4f10c9a98a270c81542dec47670a47e5c1056ddde1cac534f6d7ef28f75aec1e
Instruction Fuzzy Hash: 0E1142B1A08E4285EB10EB13E9441B96364FBD9FE1B048571DE0D67B65EF3CE592C340

Function 00007FFE13252134 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325214E
PyThread_release_lock.PYTHON311 ref: 00007FFE13252186
PyEval_SaveThread.PYTHON311 ref: 00007FFE1325B196
PyThread_acquire_lock.PYTHON311 ref: 00007FFE1325B1A8
PyEval_RestoreThread.PYTHON311 ref: 00007FFE1325B1B1
PyErr_SetString.PYTHON311 ref: 00007FFE1325B1CE

Part of subcall function 00007FFE13252CF8: PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE13252D37
Part of subcall function 00007FFE13252CF8: PyList_New.PYTHON311 ref: 00007FFE13252D4E
Part of subcall function 00007FFE13252CF8: PyEval_SaveThread.PYTHON311 ref: 00007FFE13252DBB
Part of subcall function 00007FFE13252CF8: PyEval_RestoreThread.PYTHON311 ref: 00007FFE13252DD5

Strings

Repeated call to flush(), xrefs: 00007FFE1325B1C4

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: a7363f18bb3a4be2b1f04e20a3cf77806fbf112a27042f4a7a0e0242247e6c36
Instruction ID: feb254720267ded960d97438f0c1665b65b895ba80ad43bc42a5b4bf40f27fe9
Opcode Fuzzy Hash: a7363f18bb3a4be2b1f04e20a3cf77806fbf112a27042f4a7a0e0242247e6c36
Instruction Fuzzy Hash: 06115171A08E4286E710AB27E9441B92360FBD9FA0F008270DA0E57765EF3CE696C740

Function 00007FFE1330F574 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFE1330F5AA
PyUnicode_AsWideChar.PYTHON311 ref: 00007FFE1330F5C5
_Py_Dealloc.PYTHON311 ref: 00007FFE1330F5DA
PyErr_SetString.PYTHON311 ref: 00007FFE1330F5F1
_Py_Dealloc.PYTHON311 ref: 00007FFE1330F60A

Strings

one character unicode string expected, xrefs: 00007FFE1330F5E7
unicode string expected instead of %s instance, xrefs: 00007FFE1330F59C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_$CharFormatStringUnicode_Wide
String ID: one character unicode string expected$unicode string expected instead of %s instance
API String ID: 3624372013-2255738861
Opcode ID: a442bb40f20c3a4dd4081ba5bcb0ae0298b6afa5f68cd383e2f326c911a818c9
Instruction ID: d257e66e32795929fd4be178c5299c33ce3efdfd56641a94a71b1a1f1f992de8
Opcode Fuzzy Hash: a442bb40f20c3a4dd4081ba5bcb0ae0298b6afa5f68cd383e2f326c911a818c9
Instruction Fuzzy Hash: AF111965B08E42C9EB448F66E8441796360FB68FB4F1455B2DA2E56635DE2CD488C308

Function 00007FFE1330DC30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DC4F
GetLastError.KERNEL32 ref: 00007FFE1330DC65
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFE1330DC8E
LocalFree.KERNEL32 ref: 00007FFE1330DC9A

Strings

<no description>, xrefs: 00007FFE1330DCA2
|i:FormatError, xrefs: 00007FFE1330DC44

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_CharErrorFreeFromLastLocalParseTupleUnicode_Wide
String ID: <no description>$|i:FormatError
API String ID: 935104296-1632374824
Opcode ID: da62cbb651d4d48137c88a006a0480f238e20f846b976fc73609049c0e997912
Instruction ID: 0a48965377d8aaeb0e659e23c3ac1346c9bdd6f4270f3cb26ea240511d58a161
Opcode Fuzzy Hash: da62cbb651d4d48137c88a006a0480f238e20f846b976fc73609049c0e997912
Instruction Fuzzy Hash: E4018461B08E828AEA549B23B84807DA2E1FF64BB0F144270D97E533F5EE7CE4448708

Function 00007FFE1330DCC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DCE5
PyEval_SaveThread.PYTHON311 ref: 00007FFE1330DCF3
FreeLibrary.KERNEL32 ref: 00007FFE1330DD01
PyEval_RestoreThread.PYTHON311 ref: 00007FFE1330DD1C
PyErr_SetFromWindowsErr.PYTHON311 ref: 00007FFE1330DD28

Strings

O&:FreeLibrary, xrefs: 00007FFE1330DCD7

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FreeFromLibraryParseRestoreSaveTupleWindows
String ID: O&:FreeLibrary
API String ID: 204461231-2600264430
Opcode ID: 078f241c74f91baaec2f50080a5493ab98081374dae74a9cab3a0cffd8d54dea
Instruction ID: 1947d321dc2878390689a60f6397c33c6205d5da9a006850cc025ceb4d9f0cbb
Opcode Fuzzy Hash: 078f241c74f91baaec2f50080a5493ab98081374dae74a9cab3a0cffd8d54dea
Instruction Fuzzy Hash: D9011B25B0CE42CAE6418B67A84403D63A0EFA4BA4F1444B1DA7E63639DE3CE4458708

Function 00007FFE1330A9E4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330AA18
PyObject_GetAttrString.PYTHON311 ref: 00007FFE1330AA2C
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1330AA46
_Py_BuildValue_SizeT.PYTHON311 ref: 00007FFE1330AA65

Strings

ctypes objects containing pointers cannot be pickled, xrefs: 00007FFE1330AA0E
O(O(NN)), xrefs: 00007FFE1330AA53
__dict__, xrefs: 00007FFE1330AA22

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: String$Size$AttrBuildBytes_Err_FromObject_Value_
String ID: O(O(NN))$__dict__$ctypes objects containing pointers cannot be pickled
API String ID: 1770468409-724424928
Opcode ID: 3ee03d1d2b345c529b1bd3c85f0488fda98b0b8f69e1e8ea5ec09f1cc578dd04
Instruction ID: 29c205897f5429e9d5aca930ae88f2c5ac6517040f4e43d099c45220e9e08b12
Opcode Fuzzy Hash: 3ee03d1d2b345c529b1bd3c85f0488fda98b0b8f69e1e8ea5ec09f1cc578dd04
Instruction Fuzzy Hash: FB015B25A08F42CAEA508B17E940079A3A0FB68BE0F4445B1DEAD63775DF2CE166C708

Function 00007FFE1320752C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13207546
if_nametoindex.IPHLPAPI ref: 00007FFE13207562
_Py_Dealloc.PYTHON311 ref: 00007FFE13207575
PyErr_SetString.PYTHON311 ref: 00007FFE13207590

Strings

no interface with this name, xrefs: 00007FFE13207586
O&:if_nametoindex, xrefs: 00007FFE1320753F

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_DeallocErr_ParseSizeStringTuple_if_nametoindex
String ID: O&:if_nametoindex$no interface with this name
API String ID: 3052430728-3835682882
Opcode ID: 12e8203fb0cf7461e24a3d4e215b3143ca18e6a039aed69a66b3869146dbc896
Instruction ID: f8c89767551c3a2533173f3694a069e23bdf916be87f16fb4d88c2c9f3f1575f
Opcode Fuzzy Hash: 12e8203fb0cf7461e24a3d4e215b3143ca18e6a039aed69a66b3869146dbc896
Instruction Fuzzy Hash: E801EC64A08E438AEB10AB67E89007E2761BFE8B64F5044B1DA4E66634DE7CE44DC710

Function 00007FFE132072A8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE132072BB
PyErr_SetString.PYTHON311 ref: 00007FFE132072DE
htons.WS2_32 ref: 00007FFE132072FB
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE13207304

Strings

htons: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE132072EF
i:htons, xrefs: 00007FFE132072B4
htons: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE132072CD

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: htons: Python int too large to convert to C 16-bit unsigned integer$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
API String ID: 1102113319-997571130
Opcode ID: f5f3be2852d41024977e316b61593436f03594a4b4df2368eb7feee68b79267f
Instruction ID: 708f509f3b464f42b11beffa01566c915073372c5555fc9bddee5308ff1163d4
Opcode Fuzzy Hash: f5f3be2852d41024977e316b61593436f03594a4b4df2368eb7feee68b79267f
Instruction Fuzzy Hash: 3AF0FF64E08E539DEE04BB17E85007D2660BFE4761F9044B2D54EAB170DE6CE40DD700

Function 00007FFE13207920 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13207933
PyErr_SetString.PYTHON311 ref: 00007FFE13207956
htons.WS2_32 ref: 00007FFE13207973
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE1320797C

Strings

ntohs: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE13207945
ntohs: Python int too large to convert to C 16-bit unsigned integer, xrefs: 00007FFE13207967
i:ntohs, xrefs: 00007FFE1320792C

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_Err_FromLongLong_ParseSizeStringTuple_Unsignedhtons
String ID: i:ntohs$ntohs: Python int too large to convert to C 16-bit unsigned integer$ntohs: can't convert negative Python int to C 16-bit unsigned integer
API String ID: 1102113319-2476431691
Opcode ID: ce4feceb5a90c14b92646f1ea5f8c4eaf36e6cf8efd11a848fc75c933ffc50eb
Instruction ID: 24ee4e9faf5a533eba8afb599393acb1acc77441712f26c9e3cdf16c2fda9529
Opcode Fuzzy Hash: ce4feceb5a90c14b92646f1ea5f8c4eaf36e6cf8efd11a848fc75c933ffc50eb
Instruction Fuzzy Hash: 4DF01260E08F5799EA04BB1BD89017E2760BFE5B61F9004B1D58EAB170DE7CE44CD310

Function 00007FFE1A452818 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4528D0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4528EE
__AdjustPointer.LIBCMT ref: 00007FFE1A45292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45293C
__AdjustPointer.LIBCMT ref: 00007FFE1A452978
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45298D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4529D2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A4529D9

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction ID: b073622a3ceda261b0e01387bbdde0ab96bfadc6a741147bf3c4341d91097703
Opcode Fuzzy Hash: cf0ce418dbf8095189d4875bbd922365259c44d693191a2e82a2bfde5589004d
Instruction Fuzzy Hash: A751B1B1F09F4281EA69BB57944427963A0AF44FA4F0945F7EA4E077B5DE3CE461C300

Function 00007FFE1A4529FC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452AB6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452AD5
__AdjustPointer.LIBCMT ref: 00007FFE1A452B16
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452B23
__AdjustPointer.LIBCMT ref: 00007FFE1A452B5F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452B74
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452BB9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A452BC0

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction ID: d69d25f26ad970d347bc150744c37bca5baeb512cba4ef2993ac404ef6882b0a
Opcode Fuzzy Hash: 33b9a28e85c1583a9e53f416898540066328f1663c9e5eff4cdc8514e51169f9
Instruction Fuzzy Hash: 7551B0A1B0AF4281FA65AF17944463863A4AF04FA1F0985F7EA4E077A5DF7CE861C310

Function 00007FFE1330F990 Relevance: 12.1, APIs: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PyMem_Free.PYTHON311 ref: 00007FFE1330F9AE
PyMem_Free.PYTHON311 ref: 00007FFE1330F9BB
PyMem_Free.PYTHON311 ref: 00007FFE1330F9D0
PyMem_Malloc.PYTHON311 ref: 00007FFE1330FAA6
PyMem_Malloc.PYTHON311 ref: 00007FFE1330FAE5
memcpy.VCRUNTIME140 ref: 00007FFE1330FB0C
PyMem_Malloc.PYTHON311 ref: 00007FFE1330FB27
PyErr_NoMemory.PYTHON311 ref: 00007FFE1330FB36

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_$FreeMalloc$Err_Memorymemcpy
String ID:
API String ID: 920471837-0
Opcode ID: c91e9501240dbb047462beff57c3e24aa08f07d97696b8881faa54e688d9ffaf
Instruction ID: 05178dc246662e386b4b8a436ce59b4ec7ad4ae14ddd862f900cbe4573e2d0ea
Opcode Fuzzy Hash: c91e9501240dbb047462beff57c3e24aa08f07d97696b8881faa54e688d9ffaf
Instruction Fuzzy Hash: 75512022A09F8596EB498F3595503BC6360FB68F94F049275DF6D232A6DF38B0E9C304

Function 00007FFE13302894 Relevance: 12.1, APIs: 8, Instructions: 105COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE1330756E
PyTuple_New.PYTHON311 ref: 00007FFE13307585
_Py_Dealloc.PYTHON311 ref: 00007FFE1330759C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Tuple_
String ID:
API String ID: 828192933-0
Opcode ID: 5e62f5604a1117c70738b5e9d10e81d038eb8c1c9d08bc44558772b595a0c4de
Instruction ID: 695367868a6d72fa1de4cec850fd78df970c02ab2b316c290722fce6fab288d0
Opcode Fuzzy Hash: 5e62f5604a1117c70738b5e9d10e81d038eb8c1c9d08bc44558772b595a0c4de
Instruction Fuzzy Hash: B141BF32A09F46CDEAA68F26A80467D63A0FF65BA5F080174DD6E26670DF3CE485C704

Function 00007FFE13301178 Relevance: 12.1, APIs: 8, Instructions: 95COMMON

Download Yara Rule

APIs

_PyDict_ContainsId.PYTHON311 ref: 00007FFE13301E1D
PyDict_Update.PYTHON311 ref: 00007FFE13301E5B
_Py_Dealloc.PYTHON311 ref: 00007FFE13301E7E
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE13301EB7
_PyObject_SetAttrId.PYTHON311 ref: 00007FFE13301ECF
PyErr_Occurred.PYTHON311 ref: 00007FFE13301EF0
_Py_Dealloc.PYTHON311 ref: 00007FFE13306FA7

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsErr_ErrorItemMakeOccurredUpdateWith
String ID:
API String ID: 3953964043-0
Opcode ID: 514ed9f4908b8c8283f0e0c27daf6479cf123024387674585ac24fe74f6d228d
Instruction ID: bbf44c0f32c64eb9a319b6fa32edcd471b10676542714ead802b0720d1944c80
Opcode Fuzzy Hash: 514ed9f4908b8c8283f0e0c27daf6479cf123024387674585ac24fe74f6d228d
Instruction Fuzzy Hash: D1418C31F09F4389EA548B23A9402BD63A0EF25BB4F1852B4D96E267B5DF2CE0448308

Function 00007FFE13304D38 Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE13304DC6

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 068abb66bbfb9b3a2a685b208f6aebfac36357060354af221ed5b1c6e4112d13
Instruction ID: b4b1286f97a3c2aeae90510dc3aa665e9f1bd48d7682c45f56367a81f832ab03
Opcode Fuzzy Hash: 068abb66bbfb9b3a2a685b208f6aebfac36357060354af221ed5b1c6e4112d13
Instruction Fuzzy Hash: 4831F972E09E4289FF598F76885437C23A8AB75B38F1541B4CA3E650B6CF2DA6458708

Function 00007FFE1A4557C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A455889
_local_unwind.LIBVCRUNTIME ref: 00007FFE1A45592C

Strings

RCC, xrefs: 00007FFE1A45580E
MOC, xrefs: 00007FFE1A455802
csm, xrefs: 00007FFE1A455824
csm, xrefs: 00007FFE1A45596F

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction ID: af3261410b8b57851e1c5ea53baac3f38bf4cde2f13c01307c8b3dcb3715ac65
Opcode Fuzzy Hash: 48d146a85fba6cc68383d4a357e19a92ddcb549a58e0a70336f33e234ca841ed
Instruction Fuzzy Hash: ED5163B2B09E1286EB60AB26904137D66A0FF44FB4F1410F3DA4D977A5DF3CE465C642

Function 00007FFE1A45E520 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E594
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E5A3

Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C81D
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C856
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CB83

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E643
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E653
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45E6FF

Strings

{for , xrefs: 00007FFE1A45E5CC

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
Instruction ID: 97ed77b46a60022236015673ed4870fce22d5ef1c1a3cbaa0c846a6da1d03f47
Opcode Fuzzy Hash: 416ecf82abdc7693f83b664dab0e642ebc660969777f9551cf3e7d4c265d34da
Instruction Fuzzy Hash: 2A514AB2B08A85A9E711EF26D4413F867A1EB44B98F8084F2EA5C47BA5DF7CD564C340

Function 00007FFE13302050 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE13307003
PyObject_IsInstance.PYTHON311 ref: 00007FFE13307015
_PyObject_LookupAttrId.PYTHON311 ref: 00007FFE133070CE
_Py_Dealloc.PYTHON311 ref: 00007FFE133070FC

Part of subcall function 00007FFE13303DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FFE133046A2,?,?,?,00007FFE13301959), ref: 00007FFE13303DCB

Strings

wrong type, xrefs: 00007FFE13307116

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Object_$Dealloc$AttrInstanceLookup
String ID: wrong type
API String ID: 1828014136-2191655096
Opcode ID: 48019a5db2fa545bbb614ff61a29e7f0ff849fa01fd9e197cdd365b54569e53e
Instruction ID: 2d28c106b54cd63f23ed4b08460839d1c37933373f2fab76b4c6d633f29ff0ae
Opcode Fuzzy Hash: 48019a5db2fa545bbb614ff61a29e7f0ff849fa01fd9e197cdd365b54569e53e
Instruction Fuzzy Hash: 63515D21B09F0289FE559B13DA5017D63A4AFA4BB0F1845B1D96EA77B2EF2CE441C348

Function 00007FFE1330BE84 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE1330BF0F

Strings

wrong type, xrefs: 00007FFE1330C02C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc
String ID: wrong type
API String ID: 3617616757-2191655096
Opcode ID: bdb23b902ebc4893c2a5809fa917940e2479e1e06ed5718a6fa12672c04d635d
Instruction ID: d94ccf195dc7443e7e1a3f094ea0a8a849b71e2879d78c34eb07d645f22215b3
Opcode Fuzzy Hash: bdb23b902ebc4893c2a5809fa917940e2479e1e06ed5718a6fa12672c04d635d
Instruction Fuzzy Hash: 03512C21B19E4288FE589F53E95017D63A0AFA4BF0F4846B1DA2E677B5DF2CE441C708

Function 00007FFE13259CC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE13259D14
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE13259D4D
memmove.VCRUNTIME140 ref: 00007FFE13259D8D
_Py_Dealloc.PYTHON311 ref: 00007FFE13259DA4

Strings

Unable to allocate output buffer., xrefs: 00007FFE1325C55C

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemmove
String ID: Unable to allocate output buffer.
API String ID: 3327154725-2565006440
Opcode ID: 9c30319a8999428dde325e815d48d283bad5c3e6560c2351fca3ed9412fd7cc3
Instruction ID: d0b71c84646209c6cb8f335b5105d53de9307fdfe67e73c47ede88731da765cb
Opcode Fuzzy Hash: 9c30319a8999428dde325e815d48d283bad5c3e6560c2351fca3ed9412fd7cc3
Instruction Fuzzy Hash: 89413CB2B09E4289EB15AF17D4402A923A0FBA9FA4F544672DE0D67365EF3CD695C300

Function 00007FFE1A45DB00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE1A45D217), ref: 00007FFE1A45DBC4
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45DBE3

Strings

`template-parameter, xrefs: 00007FFE1A45DBF1
void, xrefs: 00007FFE1A45DB46

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
Instruction ID: d799e140f4e2e25e6ee784e37a1a86591171988aadf1b5130a3f4c64bf3e4f20
Opcode Fuzzy Hash: 7b7e14213947c3780e213c190a7c5fdcdd2a49ff05635447eaaef3bd9456bf2e
Instruction Fuzzy Hash: EA417B62F08F4688FB00DB66D8512FC2371BF48BA8F5401B6DE5C67A68DF789465C340

Function 00007FFE1A458900 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45874C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A4587CB

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A4589B2

Strings

..., xrefs: 00007FFE1A4589EF
,..., xrefs: 00007FFE1A458980
,<ellipsis>, xrefs: 00007FFE1A458990
<ellipsis>, xrefs: 00007FFE1A4589FF
void, xrefs: 00007FFE1A458A24

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 1405650943-2211150622
Opcode ID: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
Instruction ID: 4b7c24c9c4c32a3e6b0cc09325b764d7474eed1009fb21bd1135b9d4b64c048f
Opcode Fuzzy Hash: 463b429a368d480f938697e6d099cec3f907049628b5d1349ecbd199c78a6655
Instruction Fuzzy Hash: 114146A2F08F8699F7129B26D8402B877B0BB08B58F4445F6CA5C533A4DF7CA5A1D341

Function 00007FFE1A45A6E4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A7D5

Strings

char , xrefs: 00007FFE1A45A770
short , xrefs: 00007FFE1A45A767
int , xrefs: 00007FFE1A45A758
unsigned , xrefs: 00007FFE1A45A7A9
long , xrefs: 00007FFE1A45A749

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
Instruction ID: 2e23e24836c591e60cb760a3ae457d19dbb094d1e5b238fa4d6f5533e3d4cc64
Opcode Fuzzy Hash: 01c330b6d3460536b725c75710ede4031362a47bdaf6c5878ce89829e4b6ba2f
Instruction Fuzzy Hash: 88313AB2F18B4589F7019B2AC8583B827B1BB05B68F5481F2CA1C16AB8DF3CD564C750

Function 00007FFE130C1090 Relevance: 10.6, APIs: 7, Instructions: 62COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FFE130C10A6
_Py_Dealloc.PYTHON311 ref: 00007FFE130C110D

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocModule_State
String ID:
API String ID: 1903735390-0
Opcode ID: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
Instruction ID: c5c7d4f3a5147a7474569e3d5601aa67c7e3ee9c19d7022071730b64ea7bfeb0
Opcode Fuzzy Hash: a7a767094c4d1de27d1ae5cfedc4f2a8987a46609b88e723d83c121dba346a55
Instruction Fuzzy Hash: A8210A31D09E428CEF698F77985837823EAAF75B69FA440F0CA0E651A0CF6EA5448340

Function 00007FFE1330D8F8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON311 ref: 00007FFE1330D92C
PyNumber_AsSsize_t.PYTHON311 ref: 00007FFE1330D942
PyErr_Occurred.PYTHON311 ref: 00007FFE1330D951
PyErr_Format.PYTHON311 ref: 00007FFE1330D988

Strings

byref, xrefs: 00007FFE1330D91A
byref() argument must be a ctypes instance, not '%s', xrefs: 00007FFE1330D96F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Arg_FormatNumber_OccurredSsize_tTupleUnpack
String ID: byref$byref() argument must be a ctypes instance, not '%s'
API String ID: 169608245-1446499295
Opcode ID: 1c7a6bb527df66017d67d4d6c8e7051229e04b236d9d6aec440ba77389511a69
Instruction ID: 297abcddb39d00ec55aae81602bb36d8784164352ab99f31eb59d957fe5a4618
Opcode Fuzzy Hash: 1c7a6bb527df66017d67d4d6c8e7051229e04b236d9d6aec440ba77389511a69
Instruction Fuzzy Hash: 3F212C25708F02CAEB108B52E45427DA3A0FBA8BB4F140675DABD573A5DF7DD544C344

Function 00007FFE1330B96C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311(?,?,00000001,00007FFE133077AC), ref: 00007FFE1330B9AD
PyErr_Occurred.PYTHON311(?,?,00000001,00007FFE133077AC), ref: 00007FFE1330B9BC
PyErr_Format.PYTHON311(?,?,00000001,00007FFE133077AC), ref: 00007FFE1330B9ED

Strings

not enough arguments, xrefs: 00007FFE1330B9F5
required argument '%S' missing, xrefs: 00007FFE1330B9E6

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Dict_ErrorFormatItemOccurredWith
String ID: not enough arguments$required argument '%S' missing
API String ID: 62204369-3448764933
Opcode ID: 28da8afa7e9ef03481714140949b522f70dd2a78d8c2b5e7d138b51459312286
Instruction ID: 8a79cd0251addf8000997ac1fb10cbf8ecb765523c604da1fdd2a57542ce476a
Opcode Fuzzy Hash: 28da8afa7e9ef03481714140949b522f70dd2a78d8c2b5e7d138b51459312286
Instruction Fuzzy Hash: 13114C61B19E82C9EE598F17E58413CA370EF64BE0F1494B1DA6E66779DF2CE841C308

Function 00007FFE1330EB34 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFE1330EB75
PyUnicode_AsWideChar.PYTHON311 ref: 00007FFE1330EB95
PyErr_Format.PYTHON311 ref: 00007FFE1330EBBF
PyUnicode_AsWideChar.PYTHON311 ref: 00007FFE1330EBD0

Strings

string too long (%zd, maximum length %zd), xrefs: 00007FFE1330EBAF
unicode string expected instead of %s instance, xrefs: 00007FFE1330EB67

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CharErr_FormatUnicode_Wide
String ID: string too long (%zd, maximum length %zd)$unicode string expected instead of %s instance
API String ID: 2195588020-2061977717
Opcode ID: 3df54ba06c241b92dbf221aa78cdec5a2b91a3063c00f8d20a6361d5b8dc2ae5
Instruction ID: 7d894be9cf6ccf22af00a023c41a163ff2e42ce1a49609a0f41420c5e5808808
Opcode Fuzzy Hash: 3df54ba06c241b92dbf221aa78cdec5a2b91a3063c00f8d20a6361d5b8dc2ae5
Instruction Fuzzy Hash: 5D118F20B0DF46C9EA808B17E984169A361BFA8FF4F145672DE7E63BB5CE2CD4458704

Function 00007FFE13206B98 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206BCC
PySys_Audit.PYTHON311 ref: 00007FFE13206BEB
PyMem_Free.PYTHON311 ref: 00007FFE13206C24

Strings

idna, xrefs: 00007FFE13206BBC
socket.gethostbyname, xrefs: 00007FFE13206BE4
et:gethostbyname, xrefs: 00007FFE13206BC3

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditFreeMem_ParseSizeSys_Tuple_
String ID: et:gethostbyname$idna$socket.gethostbyname
API String ID: 3195760359-1353326193
Opcode ID: 558c1271e238177000cd76bc81e05b3b59b431a06bc453976089f167e60497e9
Instruction ID: eafbec54fb4d2667096b736a86c48792811df1cda97e42fe234a45a13c3fee5e
Opcode Fuzzy Hash: 558c1271e238177000cd76bc81e05b3b59b431a06bc453976089f167e60497e9
Instruction Fuzzy Hash: 8B115461708F4299EA20BB23E85006E6760FFE8BF4F404171DA4E6B675DE3CE148CB00

Function 00007FFE132078B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON311 ref: 00007FFE132078CD
PyErr_Occurred.PYTHON311 ref: 00007FFE132078DA
htonl.WS2_32 ref: 00007FFE132078F3
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE132078FB
PyErr_Format.PYTHON311 ref: 00007FFE13207918

Strings

expected int, %s found, xrefs: 00007FFE1320790A

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: a3453a56261eb3c186c7b8bdd434c21c6932fca0058d9441addc655e6fad4964
Instruction ID: a0648358acca7a232b4bdaac0b051ebac568ce864be5d081d7f583f0c0ae554d
Opcode Fuzzy Hash: a3453a56261eb3c186c7b8bdd434c21c6932fca0058d9441addc655e6fad4964
Instruction Fuzzy Hash: 23F0CD60E08F42CAEA54BB66A88417E27A0BFE9B65F140575D54E636B0DF7CE48CE300

Function 00007FFE13207238 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON311 ref: 00007FFE13207255
PyErr_Occurred.PYTHON311 ref: 00007FFE13207262
htonl.WS2_32 ref: 00007FFE1320727B
PyLong_FromUnsignedLong.PYTHON311 ref: 00007FFE13207283
PyErr_Format.PYTHON311 ref: 00007FFE132072A0

Strings

expected int, %s found, xrefs: 00007FFE13207292

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_LongLong_Unsigned$FormatFromOccurredhtonl
String ID: expected int, %s found
API String ID: 3347179618-1178442907
Opcode ID: 893823f66e6f6138382749383a10c6f8a354538b557eed5e75274922f4b27436
Instruction ID: 88f6010061a2a9a8d4a49b142cf7890bfe2edf1a5d1604508544db5302d6dcc7
Opcode Fuzzy Hash: 893823f66e6f6138382749383a10c6f8a354538b557eed5e75274922f4b27436
Instruction Fuzzy Hash: D4F03160A08F428EEA54BB66E84417E27A0BFE9B61F1405B5D54E637B0DE7CE48CD300

Function 00007FFE1325C748 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1325C755

Part of subcall function 00007FFE1325C704: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1325C73A

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1325C781
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1325C79B

Strings

bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFE1325C768
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFE1325C78A
1.0.8, 13-Jul-2019, xrefs: 00007FFE1325C75B

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: 39f94f7b81e53d96969a5455d7e6e9458db4137e20d4da26f7d9a91deb3b3694
Instruction ID: a3dd0c0f8c24537363ac1e6fe736588bc7af99907da855cec0665bfb08d821fc
Opcode Fuzzy Hash: 39f94f7b81e53d96969a5455d7e6e9458db4137e20d4da26f7d9a91deb3b3694
Instruction Fuzzy Hash: 26E030D4A18D1659FB187BA2D4552F41255AFE4770F004779C50D276B1FD2C2745C342

Function 00007FFE13252CF8 Relevance: 9.1, APIs: 6, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE13252D37
PyList_New.PYTHON311 ref: 00007FFE13252D4E
PyEval_SaveThread.PYTHON311 ref: 00007FFE13252DBB
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13252DD5
_Py_Dealloc.PYTHON311 ref: 00007FFE1325B4E5
_Py_Dealloc.PYTHON311 ref: 00007FFE1325B525

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: ea514226ac897717a144e055f78113507add513ccc51a98260a4e0d553d29f9f
Instruction ID: ef530663ff4ea3231b313dc094c590cf4657af391de522965b5f07a3d440b5e7
Opcode Fuzzy Hash: ea514226ac897717a144e055f78113507add513ccc51a98260a4e0d553d29f9f
Instruction Fuzzy Hash: 754189B2A09F428AEA646B2795441B923A0BBA9B70F140375DE5D637E0FF3CF651C740

Function 00007FFE1A456570 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE1A4565C6
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A456609
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE1A456633
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE1A456650
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A45665C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE1A456665

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
Instruction ID: 46bfee7169a7b774ce68bc71c4467136af0c612f772fbebac381b7c865fffa3f
Opcode Fuzzy Hash: de3a4ec1d6e9946eef6b348e6d8a6ead344041b39e9dfd9c2ce66c677152b10d
Instruction Fuzzy Hash: 1031B261B19B9591EB119B27B804579A3A4FF08FF4B5946B6DD2D433A0EE3DD462C300

Function 00007FFE1330C050 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1330C174: PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE1330C1CA
Part of subcall function 00007FFE1330C174: strchr.VCRUNTIME140 ref: 00007FFE1330C1DA
Part of subcall function 00007FFE1330C174: PyErr_Format.PYTHON311 ref: 00007FFE1330C20D

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

Part of subcall function 00007FFE13303FD4: PyDict_New.PYTHON311(?,?,00000000,00007FFE13303F5E,?,?,00000001,00007FFE13306D32), ref: 00007FFE13303FF2

_Py_Dealloc.PYTHON311 ref: 00007FFE1330C0CF
PyDict_New.PYTHON311 ref: 00007FFE1330C0D5
PyLong_FromVoidPtr.PYTHON311 ref: 00007FFE1330C10B
PyDict_SetItem.PYTHON311 ref: 00007FFE1330C123
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C134
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C148

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocDict_$CallErr_FormatFromItemLong_MakeObject_Unicode_Voidstrchr
String ID:
API String ID: 4054517332-0
Opcode ID: 183dbe4e66a78b5f82bf9fcbdc5b815f8fe5dd19242b5949e3bcf8ed559180f2
Instruction ID: 6e6983152fe162f7edae19bed832d06dfb7179501c9e172507c11c4f0ee885fe
Opcode Fuzzy Hash: 183dbe4e66a78b5f82bf9fcbdc5b815f8fe5dd19242b5949e3bcf8ed559180f2
Instruction Fuzzy Hash: 04312C21B09F0289EE589B67E95013DA2A1BF65FA4F0845B0DE2D6B7B5DF3CE4418308

Function 00007FFE132064F0 Relevance: 9.0, APIs: 6, Instructions: 33threadnetworkCOMMON

Download Yara Rule

APIs

PyLong_AsLongLong.PYTHON311 ref: 00007FFE132064F9
PyErr_Occurred.PYTHON311 ref: 00007FFE13206508
PyEval_SaveThread.PYTHON311 ref: 00007FFE1320651C
closesocket.WS2_32 ref: 00007FFE13206528
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13206533
WSAGetLastError.WS2_32 ref: 00007FFE13206542

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_LongThread$Err_ErrorLastLong_OccurredRestoreSaveclosesocket
String ID:
API String ID: 586723380-0
Opcode ID: efd93951f5ba0042c1773d41bbcb51adbf44491de160b19c8b4e08a2f928464e
Instruction ID: acad2310257a967c174ae27bd1b885af9843a291f474542a7dec11f085b8ed01
Opcode Fuzzy Hash: efd93951f5ba0042c1773d41bbcb51adbf44491de160b19c8b4e08a2f928464e
Instruction Fuzzy Hash: 3501E650A19E4689EE1477E7A58803E1B51EFF8BB1F5406B0D92E673F4DE7CA48CD210

Function 00007FFE133037B0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 257COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON311 ref: 00007FFE13303874
PyErr_SetString.PYTHON311 ref: 00007FFE133086D3
_Py_Dealloc.PYTHON311 ref: 00007FFE133086E2

Strings

has no _stginfo_, xrefs: 00007FFE1330856F, 00007FFE133086C9

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_StringSubtypeType_
String ID: has no _stginfo_
API String ID: 402260271-2912685656
Opcode ID: 9230919844186ca5f41c7b1a63fcb82edb38cf4c596bbf94e99535158fbb2ad0
Instruction ID: e70aed5830a43a21a44ab91e04f385ddbaaa7280e5015f980be7ad96df3f1f2d
Opcode Fuzzy Hash: 9230919844186ca5f41c7b1a63fcb82edb38cf4c596bbf94e99535158fbb2ad0
Instruction Fuzzy Hash: 29B19E72A09F898AEA64CF16E49023E73A4FB64BA4F014475DA6E67764DF3CE454C304

Function 00007FFE1A453AEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

EncodePointer.KERNEL32 ref: 00007FFE1A453B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A453BA7
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453DD5

Strings

RCC, xrefs: 00007FFE1A453B78
MOC, xrefs: 00007FFE1A453B70

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
Instruction ID: 5c64eea22f5e13ad19ae8b0426fc0bbcd175eecf271101e4558b188fb0d97d02
Opcode Fuzzy Hash: bc23f9d190e68b0d649da4772cf0aebac2cf99f7a7c8ea39b120ae49b64f19ea
Instruction Fuzzy Hash: CA91B2B3B08B818AE711DB66E4502BD77B0F745B98F1041AAEB4D17765DF38E1A5CB00

Function 00007FFE1A45BF20 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C1C0

Strings

volatile, xrefs: 00007FFE1A45BF96, 00007FFE1A45C0C7
volatile , xrefs: 00007FFE1A45BF87, 00007FFE1A45C0B8
std::nullptr_t, xrefs: 00007FFE1A45C179
std::nullptr_t , xrefs: 00007FFE1A45C150

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
Instruction ID: 29c53ade6ae3f4328f2829b6d4b15d187fcb185a19ff92ec2a2bb5f26bb3bcdb
Opcode Fuzzy Hash: e51d893b916fd38dc1e020bc8963aa6f83aa847b46c3d095f24d6897074767ca
Instruction Fuzzy Hash: 14716AB2F08E4294EB14AF6699400BC67A1BB05FA4F4446F6DA5D83A74DF3CE5B0CB40

Function 00007FFE1A4538D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

EncodePointer.KERNEL32 ref: 00007FFE1A45391C
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE1A45396B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A453AE3

Strings

RCC, xrefs: 00007FFE1A453939
MOC, xrefs: 00007FFE1A453930

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
Instruction ID: 4eb49792d1089a7686f51271e6a78c53ac0f7dc4092eaef492428ecd1f46ecac
Opcode Fuzzy Hash: 227e5baf7e5e9155f58c31c3fecc157e2e687fbe3eaaf077a93d355b17988fc2
Instruction Fuzzy Hash: 3C612BB2A08B458AEB109F66D4403BD77A0FB44B98F0442A6EE4D17BA9CF78E565C700

Function 00007FFE13253A90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFE1325B8C9
{0x%08x, 0x%08x}, xrefs: 00007FFE1325B879

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: 69a7ee2d0339cf96717ad35ba872c5bfcdb46555bf6c34d719e37fdf827b1516
Instruction ID: da5b46a59abba5ec83b18eddc1a95fe1a5d779dee9d4ff26069906aa5fc887dd
Opcode Fuzzy Hash: 69a7ee2d0339cf96717ad35ba872c5bfcdb46555bf6c34d719e37fdf827b1516
Instruction Fuzzy Hash: 364154B1A0CD42CEEB20AF2694446F83390EBA4B64F146375D70D676A5EF38AA45CB10

Function 00007FFE133024A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311(?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00007FFE13303784), ref: 00007FFE133024ED
PyMem_Free.PYTHON311(?,?,?,?,?,?,?,?,?,00000000,00000000,?,00000000,00007FFE13303784), ref: 00007FFE133025DB

Strings

%zd,, xrefs: 00007FFE1330255A
%zd), xrefs: 00007FFE13302568

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_$FreeMalloc
String ID: %zd)$%zd,
API String ID: 3308143561-2233965340
Opcode ID: 97bbcc1d359357e3c252192984d3b0109526b27b564f2bbea6cf16545a3b7b27
Instruction ID: 85a815f5b7591ab0f4b6670a2649be0d46e464dd115ab405f476dcba61e431b1
Opcode Fuzzy Hash: 97bbcc1d359357e3c252192984d3b0109526b27b564f2bbea6cf16545a3b7b27
Instruction Fuzzy Hash: D141B322B09B8589EF158F16A4103BDA7A0FB65BE4F880171DE6DA77A1DF3CE445C318

Function 00007FFE1330A3C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330A3F3
PyObject_IsInstance.PYTHON311 ref: 00007FFE1330A42E
PyErr_Format.PYTHON311 ref: 00007FFE1330A45E

Strings

expected %s instead of %s, xrefs: 00007FFE1330A441
Pointer does not support item deletion, xrefs: 00007FFE1330A3E9

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$FormatInstanceObject_String
String ID: Pointer does not support item deletion$expected %s instead of %s
API String ID: 341772743-2046472288
Opcode ID: 56d4fabad618d8a5c8e6f1fde8dcb41e7996936431b442245916351dcbdf5c73
Instruction ID: 47abd7299ad805528777a5884072f69e0f3386aafe52104caf32f375d84ae755
Opcode Fuzzy Hash: 56d4fabad618d8a5c8e6f1fde8dcb41e7996936431b442245916351dcbdf5c73
Instruction Fuzzy Hash: C5212F65A08E42C9FA449B67E8401BD6360FF65BB4F1446B2DE2DA73B6DE3CD4868304

Function 00007FFE1330DB58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DB7E
PyLong_FromLong.PYTHON311 ref: 00007FFE1330DBE9
_Py_Dealloc.PYTHON311 ref: 00007FFE1330DC01
_Py_Dealloc.PYTHON311 ref: 00007FFE1330DC16

Strings

OO:CopyComPointer, xrefs: 00007FFE1330DB71

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Arg_FromLongLong_ParseTuple
String ID: OO:CopyComPointer
API String ID: 1908940310-822416302
Opcode ID: a50de67720cd425b58803957e1784c7b340943145018a53cdb6de08dc5e3c1c0
Instruction ID: a8e3023e3e39d7956c23584ca757278953e7785a0e783f7b6c631099458e8b57
Opcode Fuzzy Hash: a50de67720cd425b58803957e1784c7b340943145018a53cdb6de08dc5e3c1c0
Instruction Fuzzy Hash: FF213036B08E4289EB558F7698441BC63B1BB64BB8F084675DA2D676A5CE3CE0458308

Function 00007FFE133057CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

PyDict_Next.PYTHON311 ref: 00007FFE133093A2
PyErr_SetString.PYTHON311 ref: 00007FFE133093C2

Strings

args not a tuple?, xrefs: 00007FFE133093B1
too many initializers, xrefs: 00007FFE13309367

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dict_Err_NextString
String ID: args not a tuple?$too many initializers
API String ID: 1977209248-2791065560
Opcode ID: f4fd08385035d02860af40dbb96f0e851c8c10ea306c559d0ae5fa500cb6d0af
Instruction ID: c2181fe455845b03f2ce6df355ed2c7ed345d7a5e31f6708746841be87694879
Opcode Fuzzy Hash: f4fd08385035d02860af40dbb96f0e851c8c10ea306c559d0ae5fa500cb6d0af
Instruction Fuzzy Hash: 3E216061A08F41C5E6508B26E44037EA360FB64BF4F1456B2E97D626F5CF6CD485CB04

Function 00007FFE13252354 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON311 ref: 00007FFE13252396
_PyArg_NoKeywords.PYTHON311 ref: 00007FFE1325B24C
_PyArg_CheckPositional.PYTHON311 ref: 00007FFE1325B26F
PyErr_Occurred.PYTHON311 ref: 00007FFE1325B282

Strings

BZ2Compressor, xrefs: 00007FFE1325B245, 00007FFE1325B265

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_$CheckErr_KeywordsLong_OccurredPositional
String ID: BZ2Compressor
API String ID: 1699739194-1096114097
Opcode ID: 428fb968040cf0367ecb5975a9571f17589fde077a9351a0a9a78da93643c136
Instruction ID: c3a25468668f038ffccb3717a2e1c631e101818d17bbe8a48d15bcca10091453
Opcode Fuzzy Hash: 428fb968040cf0367ecb5975a9571f17589fde077a9351a0a9a78da93643c136
Instruction Fuzzy Hash: B81157B1B0CF429AEA107B1394401B96250EFF5BA0F544271E55DA76F5EF2CE685C640

Function 00007FFE1330E008 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE1330E022
PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330E060
_Py_Dealloc.PYTHON311 ref: 00007FFE1330E096
PyLong_FromLong.PYTHON311 ref: 00007FFE1330E09E

Strings

ctypes.set_errno, xrefs: 00007FFE1330E011

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_errno
API String ID: 928689845-1564666054
Opcode ID: 59a8a5489d63178a80b732e192b127fc94092e90c4c175c04c3ca01ed042f338
Instruction ID: 0bad0ba39468f1b434599743e5ca40f36dce97c60b43df41b7eb988d2f4eb284
Opcode Fuzzy Hash: 59a8a5489d63178a80b732e192b127fc94092e90c4c175c04c3ca01ed042f338
Instruction Fuzzy Hash: A711E9A1F18E42CAEF544B63E84407D63A0EF687A0F485071DE3D56371DE2CE589C718

Function 00007FFE1330E0B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330E060
_Py_Dealloc.PYTHON311 ref: 00007FFE1330E096
PyLong_FromLong.PYTHON311 ref: 00007FFE1330E09E
PySys_Audit.PYTHON311 ref: 00007FFE1330E0CA

Strings

ctypes.set_last_error, xrefs: 00007FFE1330E0B9

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditDeallocFromLongLong_ParseSys_Tuple
String ID: ctypes.set_last_error
API String ID: 928689845-913187751
Opcode ID: f23f19bccc13864e0ba767f98ec326220a154fbbf3424597505e894eb8dd0003
Instruction ID: 553701f721bcf15de9ced731ec928aebd92e0edfb4ff2bb4c9e4bef2748858a1
Opcode Fuzzy Hash: f23f19bccc13864e0ba767f98ec326220a154fbbf3424597505e894eb8dd0003
Instruction Fuzzy Hash: B811E9A1F18E02CAFF544B63E8840BD6360DF697A0F085071DE2D56371DE2CE589C714

Function 00007FFE1330B8B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13303D98: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FFE1330132C), ref: 00007FFE13303DB1

PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE1330B90C
strchr.VCRUNTIME140 ref: 00007FFE1330B91C
PyErr_Format.PYTHON311 ref: 00007FFE1330B952

Strings

'out' parameter %d must be a pointer type, not %s, xrefs: 00007FFE1330B945
PzZ, xrefs: 00007FFE1330B912

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: 'out' parameter %d must be a pointer type, not %s$PzZ
API String ID: 3500358371-2360062653
Opcode ID: fceb702919c06022e64addd7c9aaba2d34447d85d2b2cb0159e7ba4236f850e0
Instruction ID: 72a245404170f5e0abeec0d673e6aae872e867dc389692f392f006190f99f02d
Opcode Fuzzy Hash: fceb702919c06022e64addd7c9aaba2d34447d85d2b2cb0159e7ba4236f850e0
Instruction Fuzzy Hash: A4112E21B08E4388EB449F17D44027D6360EFA5FA8F4450B2DDAD67275DF2CE845C308

Function 00007FFE1330C174 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13303D98: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FFE1330132C), ref: 00007FFE13303DB1

PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE1330C1CA
strchr.VCRUNTIME140 ref: 00007FFE1330C1DA
PyErr_Format.PYTHON311 ref: 00007FFE1330C20D

Strings

sPzUZXO, xrefs: 00007FFE1330C1D0
cast() argument 2 must be a pointer type, not %s, xrefs: 00007FFE1330C203

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_FormatSubtypeType_Unicode_strchr
String ID: cast() argument 2 must be a pointer type, not %s$sPzUZXO
API String ID: 3500358371-1038790478
Opcode ID: 00c494f3386268376c83a7897981a44eeb5e2169e225d7a55c5354403a66d736
Instruction ID: 93ab4f353f731806750853fc58ea5c9d2c6e132036f87ccf5ebaba044bebfbda
Opcode Fuzzy Hash: 00c494f3386268376c83a7897981a44eeb5e2169e225d7a55c5354403a66d736
Instruction Fuzzy Hash: 2B110D61B08F4288FE589B57D85427D2360AFB5BA4F4840B5CD2DAB671DF2CE845C308

Function 00007FFE132523CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON311(?,?,?,00007FFE132523B0), ref: 00007FFE132523E7

Part of subcall function 00007FFE132521A0: memset.VCRUNTIME140 ref: 00007FFE132522F3

PyThread_free_lock.PYTHON311 ref: 00007FFE1325B2AA
PyErr_SetString.PYTHON311(?,?,?,00007FFE132523B0), ref: 00007FFE1325B2C8

Strings

Unable to allocate lock, xrefs: 00007FFE1325B29D
compresslevel must be between 1 and 9, xrefs: 00007FFE1325B2BE

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_StringThread_allocate_lockThread_free_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 681419693-2500606449
Opcode ID: 60b2f2588c32191dab62882afd88846cf50051bc512abb92ff4babc415602f46
Instruction ID: e05c894386cb1268a22ac05e3d76a199a6c07cd44817d3eeff2b0f1821cde9cc
Opcode Fuzzy Hash: 60b2f2588c32191dab62882afd88846cf50051bc512abb92ff4babc415602f46
Instruction Fuzzy Hash: 141133B1A18E0299EB00AB26E4803FC23A4FFE4B65F5042B5D50D962B5FF3CD685C790

Function 00007FFE13205D1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13205D47

Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE13204763
Part of subcall function 00007FFE132046BC: WSAGetLastError.WS2_32 ref: 00007FFE1320476B
Part of subcall function 00007FFE132046BC: PyErr_CheckSignals.PYTHON311 ref: 00007FFE1320477C

PyBuffer_Release.PYTHON311 ref: 00007FFE13205DAC
PyBuffer_Release.PYTHON311 ref: 00007FFE13205DB6
PyLong_FromSsize_t.PYTHON311 ref: 00007FFE13205DC1

Strings

y*|i:send, xrefs: 00007FFE13205D40

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Buffer_ErrorLastRelease$Arg_CheckErr_FromLong_ParseSignalsSizeSsize_tTuple_
String ID: y*|i:send
API String ID: 3302300731-3140140677
Opcode ID: 65f0f47cc3e35a20b7a47ff68169340699073e0cd887fd1f95b4273f027bc594
Instruction ID: acfdb8c8906eab61d4a76555816e61df900aa9839d3c3d7895476f5f3321a980
Opcode Fuzzy Hash: 65f0f47cc3e35a20b7a47ff68169340699073e0cd887fd1f95b4273f027bc594
Instruction Fuzzy Hash: 22113672608F46CAEB10AF62E8443AE77A0FB98794F500176DA8C93764DF7DD448CB40

Function 00007FFE13304F94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON311(?,?,?,00007FFE13304F7C), ref: 00007FFE13304FA8
PyDict_New.PYTHON311(?,?,?,00007FFE13304F7C), ref: 00007FFE13304FBC
PyErr_NewException.PYTHON311(?,?,?,00007FFE13304F7C), ref: 00007FFE13304FDA

Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330504E
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305065
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330507D
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050A0
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050C6
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133050EC
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305112
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305138
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE1330515E
Part of subcall function 00007FFE13305028: PyType_Ready.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305181
Part of subcall function 00007FFE13305028: PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051A7
Part of subcall function 00007FFE13305028: PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051CD
Part of subcall function 00007FFE13305028: PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE133051F3
Part of subcall function 00007FFE13305028: PyModule_AddType.PYTHON311(?,?,00000000,00007FFE13304FF4,?,?,?,00007FFE13304F7C), ref: 00007FFE13305219

Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330532F
Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305366
Part of subcall function 00007FFE13305304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330538B
Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053AA
Part of subcall function 00007FFE13305304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053CC
Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE133053EB
Part of subcall function 00007FFE13305304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330540D
Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE1330542C
Part of subcall function 00007FFE13305304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305451
Part of subcall function 00007FFE13305304: PyModule_AddObjectRef.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305470
Part of subcall function 00007FFE13305304: PyLong_FromLong.PYTHON311(?,?,00000000,00007FFE1330500E,?,?,?,00007FFE13304F7C), ref: 00007FFE13305495

Strings

_unpickle, xrefs: 00007FFE13304F9E
ctypes.ArgumentError, xrefs: 00007FFE13304FD1

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Module_ReadyType_$Object$FromLongLong_$Type$AttrDict_Err_ExceptionObject_String
String ID: _unpickle$ctypes.ArgumentError
API String ID: 4217053054-165408235
Opcode ID: 32827969c832a808a66d5017e69f26ea533dafa79bf6c295bc1895e8a6d04efa
Instruction ID: 7eaa80491fb7b417d1fd7c75e2a0ad19a901a4c951569a391692f6279624f78e
Opcode Fuzzy Hash: 32827969c832a808a66d5017e69f26ea533dafa79bf6c295bc1895e8a6d04efa
Instruction Fuzzy Hash: 3F012924B1DF03CAFA419B6BAA901396294BF687B0F4445B4D96C653B6EF3CE055C248

Function 00007FFE13305820 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_DelItem.PYTHON311 ref: 00007FFE1330583B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330585E
_Py_Dealloc.PYTHON311 ref: 00007FFE13305888
_PyErr_WriteUnraisableMsg.PYTHON311 ref: 00007FFE133093D9

Strings

on calling _ctypes.DictRemover, xrefs: 00007FFE133093D2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Dict_Err_ItemUnraisableWrite
String ID: on calling _ctypes.DictRemover
API String ID: 2766432985-2232269487
Opcode ID: 256ea331e05c61a4a808f1e36cd886345c9bade03a7633d5d0aea444e30aedf2
Instruction ID: 438fdb558c23933d6390f3ce56a3165f77d6072a7e0a873ee55eb763e4ff5b48
Opcode Fuzzy Hash: 256ea331e05c61a4a808f1e36cd886345c9bade03a7633d5d0aea444e30aedf2
Instruction Fuzzy Hash: 5C011B61F0AE0AC9FE598B26989833D6360EF74B65F1805B0CD2E251F0CF2CD4518344

Function 00007FFE1330B368 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330B397
PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330B3C9
_Py_Dealloc.PYTHON311 ref: 00007FFE1330B3DB

Strings

%s(%R), xrefs: 00007FFE1330B3BB
<%s object at %p>, xrefs: 00007FFE1330B390

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: FormatFromUnicode_$Dealloc
String ID: %s(%R)$<%s object at %p>
API String ID: 1714529502-296555854
Opcode ID: 7e64ef3b32a657b11c2f44244a8f51ce1e0c9cec8aec46fab4d60a3fe1e5b4e0
Instruction ID: 11b1e626b4afb5b060e27d5598a9eb817fa255984962545c6681cc8ee4e9fb24
Opcode Fuzzy Hash: 7e64ef3b32a657b11c2f44244a8f51ce1e0c9cec8aec46fab4d60a3fe1e5b4e0
Instruction Fuzzy Hash: 8B011E61A09E42C9DE049F27D88016DA360FF68FE4B1451B2CE2D673B5DE7CD895C304

Function 00007FFE1330C938 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON311 ref: 00007FFE1330C96C
PyOS_vsnprintf.PYTHON311 ref: 00007FFE1330C98F
PyFile_WriteString.PYTHON311 ref: 00007FFE1330C9AB
PyErr_Print.PYTHON311 ref: 00007FFE1330C9B1

Strings

stderr, xrefs: 00007FFE1330C965

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_File_ObjectPrintS_vsnprintfStringSys_Write
String ID: stderr
API String ID: 1103062482-1769798200
Opcode ID: 9a0837009893c9ce3f6b921fad968050c61bacc10e62fde9b4fb5cee5af4f5c7
Instruction ID: e5dced5fcd548be4f593450a33104139378b02fd1c4645dfea3e90a298066380
Opcode Fuzzy Hash: 9a0837009893c9ce3f6b921fad968050c61bacc10e62fde9b4fb5cee5af4f5c7
Instruction Fuzzy Hash: 23012162A18F81D5FA208B12F4993A9B360FBA8B50F440076D99D17375DF3CE554CB48

Function 00007FFE1330F4E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON311 ref: 00007FFE1330F515
memcpy.VCRUNTIME140 ref: 00007FFE1330F539
PyErr_Format.PYTHON311 ref: 00007FFE1330F560

Strings

bytes too long (%zd, maximum length %zd), xrefs: 00007FFE1330F556
expected bytes, %s found, xrefs: 00007FFE1330F507

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_Format$memcpy
String ID: bytes too long (%zd, maximum length %zd)$expected bytes, %s found
API String ID: 437140070-1985973764
Opcode ID: d9cd41fcd4a9d7115470baacfbcd2da228f5ee59300fb10d52ed7cf167236025
Instruction ID: 0f6dfa96e4d24c1403cce99bc0bb72b258135c0a711c0d4f4f54b9ef37c12310
Opcode Fuzzy Hash: d9cd41fcd4a9d7115470baacfbcd2da228f5ee59300fb10d52ed7cf167236025
Instruction Fuzzy Hash: 8901E1A1E08E46CDEA509B97D4802B86360BB65B74F6052B2D53D672B5CE2CE4598308

Function 00007FFE130C1120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FFE130C112D
PyUnicode_InternFromString.PYTHON311 ref: 00007FFE130C113D
PyModule_AddObjectRef.PYTHON311 ref: 00007FFE130C115F

Strings

error, xrefs: 00007FFE130C1152
close, xrefs: 00007FFE130C1133

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: Module_$FromInternObjectStateStringUnicode_
String ID: close$error
API String ID: 4029360594-371397155
Opcode ID: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
Instruction ID: 56f27c8f8f3edc93603da42c9ab807af5cac6d64684d4ffb6717e49b79c089ef
Opcode Fuzzy Hash: d1d56f56bfa3555b9ef12796d8bede51d7c66017a5d4b22be61f28461ee977ed
Instruction Fuzzy Hash: 01F03031A29E4799EE048B6AF4540A923E1FF19BA4B8441F5DD1D563B0DF3CD1588300

Function 00007FFE1330D770 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1330D474: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FFE133072F4), ref: 00007FFE1330D488

PyErr_SetString.PYTHON311 ref: 00007FFE1330D796
PySys_Audit.PYTHON311 ref: 00007FFE1330D7B5

Strings

(O), xrefs: 00007FFE1330D7A7
ctypes.addressof, xrefs: 00007FFE1330D7AE
invalid type, xrefs: 00007FFE1330D78C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditErr_StringSubtypeSys_Type_
String ID: (O)$ctypes.addressof$invalid type
API String ID: 288810468-3457326693
Opcode ID: 1ed79e3af6a29a22ef0b12f793c3d6b77dfb8862b8c0b7dc43e2b4ad75ba5f26
Instruction ID: cb8e89c5e2a9cb4de224f05e36033eec6effe10817ae21ab5eb6a5c536110048
Opcode Fuzzy Hash: 1ed79e3af6a29a22ef0b12f793c3d6b77dfb8862b8c0b7dc43e2b4ad75ba5f26
Instruction Fuzzy Hash: 09F01251B08D07C5FF459B67E89507963A0BFA4BB8F0454B1C93DA6172EE2CE1D59308

Function 00007FFE13201000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON311 ref: 00007FFE1320100D
_Py_Dealloc.PYTHON311 ref: 00007FFE13201042
_Py_Dealloc.PYTHON311 ref: 00007FFE1320104A
_Py_Dealloc.PYTHON311 ref: 00007FFE13201052

Strings

_socket.CAPI, xrefs: 00007FFE13201006

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Capsule_Pointer
String ID: _socket.CAPI
API String ID: 2597503022-3774308389
Opcode ID: 2ec5b829a4a7df79f3a2774a172ac27ce3b012500a101fcb8e3879bc7c06c298
Instruction ID: 87aedd18cfbe895835e6baa82de868140caf429716072e48cbeb45f4427c5ebb
Opcode Fuzzy Hash: 2ec5b829a4a7df79f3a2774a172ac27ce3b012500a101fcb8e3879bc7c06c298
Instruction Fuzzy Hash: B2F0B735D48D42CEE7596B6BD99803D2761ABE4B64B2840B0CA5E26270CE7DB85DC310

Function 00007FFE1330D264 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330D27E
PySys_Audit.PYTHON311 ref: 00007FFE1330D29B

Strings

ctypes.PyObj_FromPtr, xrefs: 00007FFE1330D294
O&:PyObj_FromPtr, xrefs: 00007FFE1330D270
(O), xrefs: 00007FFE1330D28D

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditParseSys_Tuple
String ID: (O)$O&:PyObj_FromPtr$ctypes.PyObj_FromPtr
API String ID: 3491098224-1450318991
Opcode ID: 2bb121435f85e257f9b1056af5b6aad70d99910b320661e3d929a3a09f6eb257
Instruction ID: 0eb9ae3ba5965d63ecf89db3d066214b29068407bf1f858a28f244179c8d4aa9
Opcode Fuzzy Hash: 2bb121435f85e257f9b1056af5b6aad70d99910b320661e3d929a3a09f6eb257
Instruction Fuzzy Hash: 50F08561B0CE87C9EA049B13E8800AD63B0FB60BB8F8000B2D62D63275DE6CE546D348

Function 00007FFE13204088 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE1320409E
PyErr_SetObject.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE132040B6
_Py_Dealloc.PYTHON311(?,?,?,00007FFE13203320), ref: 00007FFE132040C5

Strings

(is), xrefs: 00007FFE13204097
host not found, xrefs: 00007FFE13204090

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$host not found
API String ID: 3413694139-3306034047
Opcode ID: 6a53d895d2facd3bd2467535f0768359fb6939f11af5027f1c80c0e72059fe2d
Instruction ID: 922b3e1fdf7fc4d23d2f44479dd62e9055f9ce41b3949268590139691d856a66
Opcode Fuzzy Hash: 6a53d895d2facd3bd2467535f0768359fb6939f11af5027f1c80c0e72059fe2d
Instruction Fuzzy Hash: 60E0ED60E19E0389EF19AB73A84507A27A1AFE8770B0444B5C80E6B270EE3CE54DC300

Function 00007FFE1320403C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_Py_BuildValue_SizeT.PYTHON311(?,?,00000000,00007FFE132043B9), ref: 00007FFE13204052
PyErr_SetObject.PYTHON311(?,?,00000000,00007FFE132043B9), ref: 00007FFE1320406A
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE132043B9), ref: 00007FFE13204079

Strings

(is), xrefs: 00007FFE1320404B
getaddrinfo failed, xrefs: 00007FFE13204044

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: BuildDeallocErr_ObjectSizeValue_
String ID: (is)$getaddrinfo failed
API String ID: 3413694139-582941868
Opcode ID: 9cf4b89af8fc84022e11251e8872f527d159937c4b888d4879492c9bab817e05
Instruction ID: f0dcc70a18234714227188bf8e72573c5cd3731ba483d294aa96515b99e24c6f
Opcode Fuzzy Hash: 9cf4b89af8fc84022e11251e8872f527d159937c4b888d4879492c9bab817e05
Instruction Fuzzy Hash: A3E0ED60E19F0389EF197BB3A84407927916FF8B70B4440B5C80E6A271DE3CE48DC301

Function 00007FFE1A45A340 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A3B9
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A3DB
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A3EA
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A421
DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A42C

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
Instruction ID: b029dc21146869ec79ed8f9616f236c7ab6478d00e32a27ae3c843548e7260f5
Opcode Fuzzy Hash: bce8ca39c1d4cdf7971423a01a1e8e868c385637c9e3d3eec5322708e8c4e6dd
Instruction Fuzzy Hash: 1A415AA2B08F9694EB10EB62D8940B82774BB15FA8F6444F3DA5D533A5DF38E465C300

Function 00007FFE13303F0C Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON311(?,?,00000001,00007FFE13306D32), ref: 00007FFE13303FA1
_Py_Dealloc.PYTHON311(?,?,00000001,00007FFE13306D32), ref: 00007FFE13308B3B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocDict_Item
String ID:
API String ID: 1953171116-0
Opcode ID: 3e79e8a0ec8c6a2242c0b13afb3047cb975f84468eaa628f38e07b0f45846962
Instruction ID: 2769eaea4a5e3d2cbcf8e29b43c84fe386429c2b3145075519d102dbac1c5abe
Opcode Fuzzy Hash: 3e79e8a0ec8c6a2242c0b13afb3047cb975f84468eaa628f38e07b0f45846962
Instruction Fuzzy Hash: 77213361E0DE42C9EE548B27A95413DA6B0AF65BF0B1846B0DA2E677B5DF2CE4418308

Function 00007FFE130C2724 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32 ref: 00007FFE130C274A
PyList_New.PYTHON311(00007FFDFB926CC8,?,?,00007FFE130C224F), ref: 00007FFE130C276B
__WSAFDIsSet.WS2_32 ref: 00007FFE130C2797
PyList_SetItem.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C27B1
_Py_Dealloc.PYTHON311(?,?,00007FFE130C224F), ref: 00007FFE130C27F3

Memory Dump Source

Source File: 00000001.00000002.2983683177.00007FFE130C1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFE130C0000, based on PE: true

Associated: 00000001.00000002.2983665437.00007FFE130C0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983700891.00007FFE130C3000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983719451.00007FFE130C5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000001.00000002.2983737529.00007FFE130C6000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe130c0000_uOsIQqfgiT.jbxd

Similarity

API ID: List_$DeallocItem
String ID:
API String ID: 1559017468-0
Opcode ID: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
Instruction ID: 013ea0315c5ff0a0e3fcedd47edaf32f74724485b0bfea0b9926e54ed8ffcafe
Opcode Fuzzy Hash: ca1c250aef14b2cb80a943dd37ef050920af6dc516bc50837cea6f6d33c8ee49
Instruction Fuzzy Hash: 83218B32A18F028AEA108F17A5442AA73F6FB28BA0F9445F5CB4D53B60DF3DE1568340

Function 00007FFE13301DD8 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_PyDict_ContainsId.PYTHON311 ref: 00007FFE13301E1D
PyDict_Update.PYTHON311 ref: 00007FFE13301E5B
_Py_Dealloc.PYTHON311 ref: 00007FFE13301E7E
_PyDict_GetItemIdWithError.PYTHON311 ref: 00007FFE13301EB7
_PyObject_SetAttrId.PYTHON311 ref: 00007FFE13301ECF
PyErr_Occurred.PYTHON311 ref: 00007FFE13301EF0
_Py_Dealloc.PYTHON311 ref: 00007FFE13306FA7

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dict_$DeallocObject_$AttrCallContainsErr_ErrorItemMakeOccurredUpdateWith
String ID:
API String ID: 3953964043-0
Opcode ID: 83de81b2cdb9a0b5f02c82c61faec42d8a7f4e94c71193b3e965a821689d7666
Instruction ID: e4f1e8ab8719c844a7eb32259bc4cd9069502bd2f6471fefd2bc680d19e1741a
Opcode Fuzzy Hash: 83de81b2cdb9a0b5f02c82c61faec42d8a7f4e94c71193b3e965a821689d7666
Instruction Fuzzy Hash: 9B215A31A09F4289EA448B27A9401BD63A0EF64BB4F4851B5E96D277B5DF3CE485C308

Function 00007FFE13304C60 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE13304CD9
_Py_Dealloc.PYTHON311 ref: 00007FFE13304CF2
_Py_Dealloc.PYTHON311 ref: 00007FFE133090A4
_Py_Dealloc.PYTHON311 ref: 00007FFE133090B0

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: abd2609812ce25a27d1ac097890b043a0477b61f164c4d0ec192c4a938d68858
Instruction ID: 5bbbccd729d693dd713ed6bbc7b99d608927d67cb430ff9176f8319e730da629
Opcode Fuzzy Hash: abd2609812ce25a27d1ac097890b043a0477b61f164c4d0ec192c4a938d68858
Instruction Fuzzy Hash: 65214A71A09E0299FF94CF72980437C22A8EB31B38F1440B4CA6EB91B5CF2D66458718

Function 00007FFE13259FA8 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON311 ref: 00007FFE13259FBA
PyType_FromModuleAndSpec.PYTHON311 ref: 00007FFE13259FD0
PyModule_AddType.PYTHON311 ref: 00007FFE13259FE6
PyType_FromModuleAndSpec.PYTHON311 ref: 00007FFE13259FFD
PyModule_AddType.PYTHON311 ref: 00007FFE1325A012

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: 61a4d07700435b38e5979996beba01b9920bec42d73c56830fb738b2919386a3
Instruction ID: 4ef4e86e13d485892fad9af9ad8b056baff597ac39f2d0bda86fabe6e8c7a268
Opcode Fuzzy Hash: 61a4d07700435b38e5979996beba01b9920bec42d73c56830fb738b2919386a3
Instruction Fuzzy Hash: 8B0180A1B2DF4286FB10AF23A55437A63A0AF98FE0B548271CD5D56764EE3CE245C700

Function 00007FFE132063D0 Relevance: 7.5, APIs: 5, Instructions: 39threadnetworkCOMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON311 ref: 00007FFE13206400
PyEval_SaveThread.PYTHON311 ref: 00007FFE13206416
WSADuplicateSocketW.WS2_32 ref: 00007FFE1320642C
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13206437

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Arg_DuplicateParseRestoreSaveSizeSocketTuple_
String ID:
API String ID: 3898289384-0
Opcode ID: 30e3d47e4dfef95f6ca91981072f17e0fb37058b27de1da86756e3aef9c53be1
Instruction ID: 4d63f499fb24528093aa90896dcce042780744bfaf6360377e99bf0d6ab17583
Opcode Fuzzy Hash: 30e3d47e4dfef95f6ca91981072f17e0fb37058b27de1da86756e3aef9c53be1
Instruction Fuzzy Hash: C2111261A18F8285EA20AB62E4583AE7350FFE8BB0F500571D95D23765DF7CE14DC600

Function 00007FFE1330DE38 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON311 ref: 00007FFE1330DE50
PyObject_CallOneArg.PYTHON311 ref: 00007FFE1330DE61
PyErr_Occurred.PYTHON311 ref: 00007FFE1330DE69
PyObject_CallOneArg.PYTHON311 ref: 00007FFE1330DE8D
_Py_Dealloc.PYTHON311 ref: 00007FFE1330DE9F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: CallObject_$DeallocDict_Err_ErrorItemOccurredWith
String ID:
API String ID: 4058657591-0
Opcode ID: 1a35c4ab6dce3baf8b5148636fef7374f6697dae909102b08545470e9d818853
Instruction ID: 90c169d406e46118a6dc6c0fd1c30c922ec19f740f529cf48df46a05d5f4d042
Opcode Fuzzy Hash: 1a35c4ab6dce3baf8b5148636fef7374f6697dae909102b08545470e9d818853
Instruction Fuzzy Hash: 46012161B09E02C9EF545B27A94813D92D1AF78FE0B144075D92E17775DE3CF440C304

Function 00007FFE1320647C Relevance: 7.5, APIs: 5, Instructions: 34threadCOMMON

Download Yara Rule

APIs

_PyLong_AsInt.PYTHON311 ref: 00007FFE1320648C
PyErr_Occurred.PYTHON311 ref: 00007FFE13206499
PyEval_SaveThread.PYTHON311 ref: 00007FFE132064AD
shutdown.WS2_32 ref: 00007FFE132064BC
PyEval_RestoreThread.PYTHON311 ref: 00007FFE132064C7

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Err_Long_OccurredRestoreSaveshutdown
String ID:
API String ID: 24305128-0
Opcode ID: 8ed085b80c573facd8b5490791f9e95c22dfd687bf32148a1c5aff15e421c6a6
Instruction ID: 91dc248762e28f274706e37c6de6be12bb95625122c9b0b8f9e68ecaac890292
Opcode Fuzzy Hash: 8ed085b80c573facd8b5490791f9e95c22dfd687bf32148a1c5aff15e421c6a6
Instruction Fuzzy Hash: 5D01FF25A08F428AEA34ABA3B48403F67A0EFE8BB4B140570DA5E53774CF7CE449D210

Function 00007FFE1325243C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE1325B2DB

Strings

final combined CRC = 0x%08x , xrefs: 00007FFE1325B313
block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFE1325B2E6

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: 943b634fa9d07ff961db70dbb74d68f24273f83e3e6fcba7a578889a90a7400e
Instruction ID: 83064ce48fb4d802104b79ec05dec937da7fdfa180d156d2ba4fa3803bbc870b
Opcode Fuzzy Hash: 943b634fa9d07ff961db70dbb74d68f24273f83e3e6fcba7a578889a90a7400e
Instruction Fuzzy Hash: 6861D576705B428AE710BF1794092ED3760BBD6BD4F445274DE092B3A6EE3CE646CB00

Function 00007FFE1A454288 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454407

Strings

csm, xrefs: 00007FFE1A4542D7
csm, xrefs: 00007FFE1A454441
, xrefs: 00007FFE1A454358

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
Instruction ID: 1f72a46c834549d45eb11ed1d147bc08c03d31bb0ee9ea56f6e0bc8d4b14b8c4
Opcode Fuzzy Hash: 0334d4e6c50ab9b6f685e521b3ae1a91d89b048a29f68cf2dce9c00bf400fe87
Instruction Fuzzy Hash: 8F71B4B2708A9186D7209F26D44067D7BA1FB05FA8F1481B6DB4D0BAA6CF3CD571C701

Function 00007FFE1A45F050 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A45F110
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A45EE15), ref: 00007FFE1A45F15F

Strings

f, xrefs: 00007FFE1A45F08E
csm, xrefs: 00007FFE1A45F0F6

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind
String ID: csm$f
API String ID: 451473138-629598281
Opcode ID: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
Instruction ID: 7e831c63e7f39ba5bea0feed3d577344677cbe944ed3091fee3527b0d662808e
Opcode Fuzzy Hash: 94627d9c7195f9c36ee16ac86650ab8a4e652cd15aa300a0b5f08846187e0d97
Instruction Fuzzy Hash: FF51D1B6F09A0286DB14EB16E444A3937A5FB44FA8F1081F2EA1E43758DF39ED51C701

Function 00007FFE1A454060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454157
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE1A454167

Strings

csm, xrefs: 00007FFE1A4541B9
csm, xrefs: 00007FFE1A4540AA

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction ID: 58992b9c435c5bbc932f50acbf3265273fe226f0ae3696863c92f27f8a329ed3
Opcode Fuzzy Hash: d96c539858820a31a9c1340fe1861477bc26c032fcc487563b75466d3052f7d1
Instruction Fuzzy Hash: 995174B6B08B4286EB649B12944427877A1FB55FA4F1441F7DA9D4BBA6CF3CE470CB00

Function 00007FFE1A45AAD8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45AB32

Strings

%lf, xrefs: 00007FFE1A45AB6D, 00007FFE1A45ABA1, 00007FFE1A45ABD1

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
Instruction ID: ce0494d6ca2f1158f8dd5910f0907ff8ce922109df9029a0d76a768f3fce7af2
Opcode Fuzzy Hash: ce39b8ddb33b1742c1c733f8d1258caa8bc8f3cdabe38b30e72aebe8897d44a3
Instruction Fuzzy Hash: C431D3A1B08F8685E621EB13A8510B9B360BF45FA0F4481F7EA6E57771DF3CE1658740

Function 00007FFE1330A8D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330A91B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330A999
memcpy.VCRUNTIME140 ref: 00007FFE1330A9AC

Strings

abstract class, xrefs: 00007FFE1330A911

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_Stringmemcpy
String ID: abstract class
API String ID: 4155950771-1623945838
Opcode ID: 39caa09f7d9a9fa5dd63c26db85cad3ebfb1af8ff0279c48b353af220d1a1222
Instruction ID: 21070fe0ff8c37ed22a7a2237564bcd9f9c7fb15a6091991e4ee7adaad1a0efe
Opcode Fuzzy Hash: 39caa09f7d9a9fa5dd63c26db85cad3ebfb1af8ff0279c48b353af220d1a1222
Instruction Fuzzy Hash: 17216B32B09F058AEB548F23E44016D73A0FB68FA4F195275DEAD27765CF38E4628348

Function 00007FFE13301904 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON311 ref: 00007FFE1330193A
PyErr_SetString.PYTHON311 ref: 00007FFE13306B72
PyObject_IsSubclass.PYTHON311 ref: 00007FFE13306BB1

Strings

abstract class, xrefs: 00007FFE13306B68

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Object_$Err_InstanceStringSubclass
String ID: abstract class
API String ID: 1122563627-1623945838
Opcode ID: 6c7db8fb0eb44c7424908bf4032845ff0e9bfd72eafbca4c076b0be6399d20a6
Instruction ID: 2ede6729e722538e4cf431f8315359a00693b3213e4fef264cd5a3369b6f1f5e
Opcode Fuzzy Hash: 6c7db8fb0eb44c7424908bf4032845ff0e9bfd72eafbca4c076b0be6399d20a6
Instruction Fuzzy Hash: F6214525F0CE0789FA509B27A85007E1364EF64BB4F1855B1D96E622BADE2CE4419308

Function 00007FFE1330402C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13303A00: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE13303A4B

PyUnicode_FromStringAndSize.PYTHON311 ref: 00007FFE13304090

Strings

:%x, xrefs: 00007FFE13308B5D
ctypes object structure too deep, xrefs: 00007FFE13308B7B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: FromSizeStringUnicode___stdio_common_vsprintf
String ID: :%x$ctypes object structure too deep
API String ID: 1484205955-3091822184
Opcode ID: 2459c21495d6783b8173aaa301187f361a2d8e91fe46e9680da2c72f9c63c0db
Instruction ID: bfa2412f46e5dab1cb3f41fa86ec0b69e8130577af3877114fb2a2458a07a9f5
Opcode Fuzzy Hash: 2459c21495d6783b8173aaa301187f361a2d8e91fe46e9680da2c72f9c63c0db
Instruction Fuzzy Hash: CD215131718E86C9EA20CB16E4502AEA3A0FB9C7A0F444171DA9D67775DF3CE645CB04

Function 00007FFE1330A840 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE1330A866
PyErr_SetString.PYTHON311 ref: 00007FFE1330A891

Strings

abstract class, xrefs: 00007FFE1330A887
ctypes.cdata, xrefs: 00007FFE1330A858

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditErr_StringSys_
String ID: abstract class$ctypes.cdata
API String ID: 1384585920-3531133667
Opcode ID: 9146581257e5cd249a8ce15bd5017c0ced05df42edf8eab21e35891fecd2194b
Instruction ID: b995d63405e3f9f8152c6920bac1cef69bd62394504935c032f090540a39df60
Opcode Fuzzy Hash: 9146581257e5cd249a8ce15bd5017c0ced05df42edf8eab21e35891fecd2194b
Instruction Fuzzy Hash: 0A013561B18F42C5EB448B13F8801797BA0FBA8BA4F0885B5DA6DA7725DF28E052C304

Function 00007FFE13303E98 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyBytes_AsString.PYTHON311 ref: 00007FFE13303EC5
PyLong_AsUnsignedLongLongMask.PYTHON311 ref: 00007FFE13303EEC

Strings

bytes or integer address expected instead of %s instance, xrefs: 00007FFE13308AEB

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Long$Bytes_Long_MaskStringUnsigned
String ID: bytes or integer address expected instead of %s instance
API String ID: 3464282214-706233300
Opcode ID: c48ceac9eea2b1fa827f2cbb00a6abdd9340ea2753a13b5f87d6d5264b647cc5
Instruction ID: f9fa89a6e96eddb4dad69d3459f755f94f18d5eb6949a1ba0fa31e06b060cc45
Opcode Fuzzy Hash: c48ceac9eea2b1fa827f2cbb00a6abdd9340ea2753a13b5f87d6d5264b647cc5
Instruction Fuzzy Hash: 61011B76B19E46C9EA408B17E88027CA360FB68BB4F509572DA6E56375CE3CD495C308

Function 00007FFE1330DD4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE1330DD59
PyLong_FromLong.PYTHON311 ref: 00007FFE1330DDA4
_Py_Dealloc.PYTHON311 ref: 00007FFE1330DDB6

Strings

ctypes.get_errno, xrefs: 00007FFE1330DD52

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_errno
API String ID: 2276389247-2892954555
Opcode ID: c6ace954750aef6584acdef0dbafe0f2db3ad2dcd629e74672a8309c43f57945
Instruction ID: dfa52343045c0910aa22aa0f1fca3dea3b9941271af3182674d321315614a50b
Opcode Fuzzy Hash: c6ace954750aef6584acdef0dbafe0f2db3ad2dcd629e74672a8309c43f57945
Instruction Fuzzy Hash: 2FF0F921B19E42C9EB449B27E84807DA2E0EFA47E0F440070D93E53774DF3CD0818704

Function 00007FFE1330DDCC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON311 ref: 00007FFE1330DDA4
_Py_Dealloc.PYTHON311 ref: 00007FFE1330DDB6
PySys_Audit.PYTHON311 ref: 00007FFE1330DDD9

Strings

ctypes.get_last_error, xrefs: 00007FFE1330DDD2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditDeallocFromLongLong_Sys_
String ID: ctypes.get_last_error
API String ID: 2276389247-1232113872
Opcode ID: 853979658a44e765c27009c70b8a62aa63505b1bac88553f7faa954c15010c56
Instruction ID: 0cbf4427ffadded666e7a9026c59c75f27d6ea9e02689df542c916bc2fe406c7
Opcode Fuzzy Hash: 853979658a44e765c27009c70b8a62aa63505b1bac88553f7faa954c15010c56
Instruction Fuzzy Hash: 45F0A921F19E42C9EB449B37E94817DA2E1EFA87E0F480074D92E52775DF2CD1918704

Function 00007FFE13304F04 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyUnicode_AsUTF8.PYTHON311 ref: 00007FFE13304F39
PyLong_AsUnsignedLongMask.PYTHON311 ref: 00007FFE133091C0
PyErr_SetString.PYTHON311 ref: 00007FFE133091F5

Strings

function name must be string, bytes object or integer, xrefs: 00007FFE133091EB

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_LongLong_MaskStringUnicode_Unsigned
String ID: function name must be string, bytes object or integer
API String ID: 2115587880-3177123413
Opcode ID: 81ea3209a1b354214586730592f4c670ad1da60d41d4e62eb4eacb33d520f56b
Instruction ID: a456cc585a94c077344d0a6bcfaf46ef16b0b91fa1b11111497923e726ae6b61
Opcode Fuzzy Hash: 81ea3209a1b354214586730592f4c670ad1da60d41d4e62eb4eacb33d520f56b
Instruction Fuzzy Hash: 5601A422B19E02C9FB254F67E89427C6291AFA8B64F4480B1C46DA7671EE3CA4458708

Function 00007FFE1330D9D4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DA03
PySys_Audit.PYTHON311 ref: 00007FFE1330DA25

Part of subcall function 00007FFE13302980: memset.VCRUNTIME140 ref: 00007FFE13302A27
Part of subcall function 00007FFE13302980: PyObject_CallOneArg.PYTHON311 ref: 00007FFE13302A7E

Strings

ctypes.call_function, xrefs: 00007FFE1330DA1E
O&O!, xrefs: 00007FFE1330D9F8

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: 17adec98670e9f6cdebf84fa662457cca95efbc4de64805adf32e68e07ce2538
Instruction ID: 6e50364ab7b6fe08d3baba63fad5f2e7b8f2352b744fc5f10e2938f021d85b75
Opcode Fuzzy Hash: 17adec98670e9f6cdebf84fa662457cca95efbc4de64805adf32e68e07ce2538
Instruction Fuzzy Hash: F1014072A1CF46CAEB008F12E4487AE67A0FB587A4F401176E95D63675DF3CE145CB48

Function 00007FFE1330DA68 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON311 ref: 00007FFE1330DA97
PySys_Audit.PYTHON311 ref: 00007FFE1330DAB9

Part of subcall function 00007FFE13302980: memset.VCRUNTIME140 ref: 00007FFE13302A27
Part of subcall function 00007FFE13302980: PyObject_CallOneArg.PYTHON311 ref: 00007FFE13302A7E

Strings

ctypes.call_function, xrefs: 00007FFE1330DAB2
O&O!, xrefs: 00007FFE1330DA8C

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_AuditCallObject_ParseSys_Tuplememset
String ID: O&O!$ctypes.call_function
API String ID: 886791329-313584727
Opcode ID: 956f25cfe963604cb9d4e30e000f0088442d622793c0436951a4906829bed983
Instruction ID: 5588578002ceab599fbd2a80ba7ee183950dbd2efa492fa2bc14ac8310871c90
Opcode Fuzzy Hash: 956f25cfe963604cb9d4e30e000f0088442d622793c0436951a4906829bed983
Instruction Fuzzy Hash: 9E018072A1CF46C6EB008F12E4487AD63A0FB687A4F4001B6E95C66634DF7CE145CB08

Function 00007FFE13302F60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE13307CC5
_Py_Dealloc.PYTHON311 ref: 00007FFE13307CDF

Strings

_type_ must have storage info, xrefs: 00007FFE13307CB4
_type_ must be a type, xrefs: 00007FFE13302FA5

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_String
String ID: _type_ must be a type$_type_ must have storage info
API String ID: 1259552197-214983684
Opcode ID: f9c93959e9af95d6c9b4c14054f54ac853c0c588ad50044a4a2a3fec31618313
Instruction ID: c8544afe0cd9ca70127636c16f892ff2901c877aef9b545ea69731a3a5a36db2
Opcode Fuzzy Hash: f9c93959e9af95d6c9b4c14054f54ac853c0c588ad50044a4a2a3fec31618313
Instruction Fuzzy Hash: 250112B5E09E42CDFA54DB57D44017C6360AF69BF0F5446B1D93D722B1DF2CA4848309

Function 00007FFE1330E7AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330E7E9

Strings

cannot be converted to pointer, xrefs: 00007FFE1330E7DF

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String
String ID: cannot be converted to pointer
API String ID: 1450464846-3065012988
Opcode ID: ba69f6be1e03f64db6319ffa1c479f40c92e1bf7f208d3a0c57e532b4c3c8d90
Instruction ID: 2b699347727947e80e033a2222af2c54f3570ae1727d913cf5d96e395a75ceff
Opcode Fuzzy Hash: ba69f6be1e03f64db6319ffa1c479f40c92e1bf7f208d3a0c57e532b4c3c8d90
Instruction Fuzzy Hash: 43016261F08E46C9FA448B17E48033863A0FB68FA4F1490B1E92D17375DE3CE4848708

Function 00007FFE1330B1F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON311 ref: 00007FFE1330B210
PyErr_SetString.PYTHON311 ref: 00007FFE1330B22B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330B252

Strings

the errcheck attribute must be callable, xrefs: 00007FFE1330B221

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Callable_CheckDeallocErr_String
String ID: the errcheck attribute must be callable
API String ID: 3907376375-3049503998
Opcode ID: 40a5e4c9387a9eacadc56f8a50b5cb35d6fcf5bb7bd3e5eec0ef331718cf67ff
Instruction ID: 4273922177a2f75e729cf79e7eaf60765076a7f2ad482bc031b1c5e4081abf90
Opcode Fuzzy Hash: 40a5e4c9387a9eacadc56f8a50b5cb35d6fcf5bb7bd3e5eec0ef331718cf67ff
Instruction Fuzzy Hash: 51F04461B08E42C5EE988F67E95413C6364BFA8FB4F548171CA7D96171DF3CD4958308

Function 00007FFE1A452630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45266E

Strings

MOC, xrefs: 00007FFE1A452648
RCC, xrefs: 00007FFE1A452640
csm, xrefs: 00007FFE1A452650

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction ID: 1406a3691859c820e7c6b7b2eb8b42ec6b3705f1f4027804d61b479fb79fc8c7
Opcode Fuzzy Hash: e63037d86fd6ed08c01758bd2d278b6a49b1453d2f75febe4acf0c3d16fc865e
Instruction Fuzzy Hash: 5FF03CB2A18A0682E7506B66A18117877A4EF48F64F0951F3DB4806266CF3CD4B0CA41

Function 00007FFE13309A20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE13309A4E
PyLong_AsVoidPtr.PYTHON311 ref: 00007FFE13309A5B
PyErr_Occurred.PYTHON311 ref: 00007FFE13309A64

Strings

integer expected, xrefs: 00007FFE13309A44

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$Long_OccurredStringVoid
String ID: integer expected
API String ID: 1621529885-2140524511
Opcode ID: 7b49f154c6c6e067b1201768131b658a8a7bf5851dad34e5bb971b0d47541ff1
Instruction ID: 31730defe8ccb4b5b7cd74c48fe946866f0c34651bc413c27b94d4cf061af3fe
Opcode Fuzzy Hash: 7b49f154c6c6e067b1201768131b658a8a7bf5851dad34e5bb971b0d47541ff1
Instruction Fuzzy Hash: 5BF03021B08E46C9EE448B17E984279A360AF69FF0F0490B1E92E27775DE2CD4848704

Function 00007FFE13205CC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFE13205CEC
PyErr_SetString.PYTHON311 ref: 00007FFE13205D11

Strings

no printf formatter to display the socket descriptor in decimal, xrefs: 00007FFE13205D07
<socket object, fd=%ld, family=%d, type=%d, proto=%d>, xrefs: 00007FFE13205CE1

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_FormatFromStringUnicode_
String ID: <socket object, fd=%ld, family=%d, type=%d, proto=%d>$no printf formatter to display the socket descriptor in decimal
API String ID: 1884982852-285600062
Opcode ID: 21ded50ad9b951d9327c489c5827ede9c202102ff5d17ea57af7a995111f4177
Instruction ID: c06d14e8acaf5b8331cef5d296545f38fa9a40d8bcabb9abccddadae2671263b
Opcode Fuzzy Hash: 21ded50ad9b951d9327c489c5827ede9c202102ff5d17ea57af7a995111f4177
Instruction Fuzzy Hash: 08F0D0B5A08D42CADA10AB26D45042D2761FBA5B78F604771D93D676F4DE6DE40EC700

Function 00007FFE13308162 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON311 ref: 00007FFE13308165
PyMem_Free.PYTHON311 ref: 00007FFE1330816E
PyErr_Format.PYTHON311 ref: 00007FFE13308188

Strings

second item in _fields_ tuple (index %zd) must be a C type, xrefs: 00007FFE1330817E

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_FormatFreeMem_
String ID: second item in _fields_ tuple (index %zd) must be a C type
API String ID: 3237669406-2717732800
Opcode ID: 6c5e0c61733740b2a0fd8058cc8b9152b4a417e0ab55625c6ded04eac5423bae
Instruction ID: 694d4c7d201d88a50ddb992f721ddc0f242199d7690b8a5be6c013ae679ee300
Opcode Fuzzy Hash: 6c5e0c61733740b2a0fd8058cc8b9152b4a417e0ab55625c6ded04eac5423bae
Instruction Fuzzy Hash: E5E06264B0CE43CAFA549B67D854078A320BFA5FB5B5012B1D83F726B1CE7CA54A920D

Function 00007FFE1A45A058 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C81D
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C856
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CB83

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A1B3
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A212
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A244
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A254

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
Instruction ID: 7cffc8259f363674fcbccbc7fddc10bcbe89d4e6fa2fc52a99d6043b0db07be4
Opcode Fuzzy Hash: 648336d396e82ff845145f22116d02ab074a94aa94e21a1e761fb2f6b175ab31
Instruction Fuzzy Hash: AD9159A2F08B9289FB119B62D8453BC27B1BB04B28F5480F7DA4D576A5DF3CA865C340

Function 00007FFE1A45A814 Relevance: 6.1, APIs: 4, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE1A45A8C6
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A8D6
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A8F3

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
Instruction ID: a1e437d170aa1544db8bc42d17c7c28063bf885a19cfb1ec2374dab86c07ae47
Opcode Fuzzy Hash: 98efd56155e24b1ceec94087ea0ccb087ffd731ce7e45ec66b02000ff67e82c1
Instruction Fuzzy Hash: 055179B2B18F6689E711DF22D8443BC37A0BB44F64F1448B2DA1D477A5DF38A460C740

Function 00007FFE1A45CC48 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45E72C: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE1A45E786

Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C81D
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45C856
Part of subcall function 00007FFE1A45C78C: DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CB83

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CCC6
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CCD5
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CD52
DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45CD61

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+$Replicator::operator[]
String ID:
API String ID: 3863519203-0
Opcode ID: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
Instruction ID: 808aaa399ed648a811891340229277dda68c3743c18f443813332c5838aa8627
Opcode Fuzzy Hash: 59a8e1a8bea4fa0d3053ac7b282f3cf586ef513a0d49dabd13085b0ba4a6c699
Instruction Fuzzy Hash: FE4164B2B08B8589EB01DF65D8403BC3BB0BB45B68F5481B6DA4D97769DF3C9861C740

Function 00007FFE1330B42C Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON311 ref: 00007FFE1330B448
memcpy.VCRUNTIME140 ref: 00007FFE1330B461
PyMem_Free.PYTHON311 ref: 00007FFE1330B480
_Py_Dealloc.PYTHON311 ref: 00007FFE1330B4B7

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Mem_$DeallocFreeMallocmemcpy
String ID:
API String ID: 1346496523-0
Opcode ID: 8c08fdf6c3f6743b583b35e04fc598e2fc29906b9b2b5698a8cb90300fdd1926
Instruction ID: eb00d8fe03a1d59cd8f5563b2d1a30825129f8e37c3e53e6dbdee4d041285fc7
Opcode Fuzzy Hash: 8c08fdf6c3f6743b583b35e04fc598e2fc29906b9b2b5698a8cb90300fdd1926
Instruction Fuzzy Hash: 24215B62A19F4286EB588F12E84013D63A0FB68FA4B0445B5DA6D27765EF3CD5A18348

Function 00007FFE133049BC Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PyDescr_NewGetSet.PYTHON311 ref: 00007FFE133049E9
PyDict_SetItemString.PYTHON311 ref: 00007FFE13304A00
_Py_Dealloc.PYTHON311 ref: 00007FFE1330907F
_Py_Dealloc.PYTHON311 ref: 00007FFE13309097

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Descr_Dict_ItemString
String ID:
API String ID: 975051370-0
Opcode ID: cbfa8e76cbb37faade4b4752a761ba53e7deef88f0e4638b9d9c9114bc06fd37
Instruction ID: debf139e2faca90dfe7640d4f5d717a03a03805816b28b7c197cf834c1d0c133
Opcode Fuzzy Hash: cbfa8e76cbb37faade4b4752a761ba53e7deef88f0e4638b9d9c9114bc06fd37
Instruction Fuzzy Hash: AA115121B0DE4289EE548B13A91033DA260EFA9BE0F084170DE6E73B65DF3CD5918608

Function 00007FFE133015F4 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE133022B0: _PyObject_MakeTpCall.PYTHON311 ref: 00007FFE13302301

PyWeakref_NewProxy.PYTHON311(?,?,00000000,00007FFE1330156A), ref: 00007FFE1330163E
PyDict_SetItem.PYTHON311(?,?,00000000,00007FFE1330156A), ref: 00007FFE1330165F
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330156A), ref: 00007FFE13306A71
_Py_Dealloc.PYTHON311(?,?,00000000,00007FFE1330156A), ref: 00007FFE13306A80

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$CallDict_ItemMakeObject_ProxyWeakref_
String ID:
API String ID: 1512266493-0
Opcode ID: edfa2a0c717579e9911386e870fa1321e468c4d2dd0d8facd930d0c933b2ac38
Instruction ID: a19739b311063cb60d8e38f8d68bc97a2158e69526d61699ab49a834eaf750fe
Opcode Fuzzy Hash: edfa2a0c717579e9911386e870fa1321e468c4d2dd0d8facd930d0c933b2ac38
Instruction Fuzzy Hash: 17114F25A09E42C9EA545F27AC4007DA3A4FF69BE0B1C4571DE6E277B5CF3CE4518348

Function 00007FFE13259B99 Relevance: 6.0, APIs: 4, Instructions: 45threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON311 ref: 00007FFE13259BEF
PyMem_Free.PYTHON311 ref: 00007FFE13259C17
_Py_Dealloc.PYTHON311 ref: 00007FFE13259C1F

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 5aeb15387b95166676224402c5d5f2316a130d4eb9e2bcf5365a9fe41ac904a5
Instruction ID: 415150c8d89a325c2b92e93c6053300fe84716d7ec1545133ba1bff8aacfe8e5
Opcode Fuzzy Hash: 5aeb15387b95166676224402c5d5f2316a130d4eb9e2bcf5365a9fe41ac904a5
Instruction Fuzzy Hash: 24116D72B0DA4289EB05AF3698503BC3360EBE6F55F0842B1CA4E575A2EF2CDA55C300

Function 00007FFE13204CA4 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203864: PyErr_SetString.PYTHON311 ref: 00007FFE1320389A

memset.VCRUNTIME140 ref: 00007FFE13204CF0
PyEval_SaveThread.PYTHON311 ref: 00007FFE13204CF5
getsockname.WS2_32 ref: 00007FFE13204D0C
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13204D17

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetsocknamememset
String ID:
API String ID: 772546412-0
Opcode ID: 1577330f62de6ded43e8dddc616ca128f006a8c56b02915f3c7181489a52fc15
Instruction ID: bc23449bb6e36fd98040c5fbc8efe77a0b9a6d9526676be9b80bc6d722fdd2ba
Opcode Fuzzy Hash: 1577330f62de6ded43e8dddc616ca128f006a8c56b02915f3c7181489a52fc15
Instruction Fuzzy Hash: 50111221618F8286EA30AB53F4403AFA361FFD4794F404172D68D27A55DE7CE149CB00

Function 00007FFE13204BE4 Relevance: 6.0, APIs: 4, Instructions: 43threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203864: PyErr_SetString.PYTHON311 ref: 00007FFE1320389A

memset.VCRUNTIME140 ref: 00007FFE13204C30
PyEval_SaveThread.PYTHON311 ref: 00007FFE13204C35
getpeername.WS2_32 ref: 00007FFE13204C4C
PyEval_RestoreThread.PYTHON311 ref: 00007FFE13204C57

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$Err_RestoreSaveStringgetpeernamememset
String ID:
API String ID: 1387529023-0
Opcode ID: 1c7e6d5011a2135e8c06ff2d843152878263a225684895c46d3c4021394f55f9
Instruction ID: 96fc3b711b16f22da2ea708826ab1154a8b7aaccb4655fcc9f1dca1c613ec3b5
Opcode Fuzzy Hash: 1c7e6d5011a2135e8c06ff2d843152878263a225684895c46d3c4021394f55f9
Instruction Fuzzy Hash: 5411F161618F8286EA70AB52F4403AFA361FFD8794F404172DA8D67A69DF7CE149CB40

Function 00007FFE1330C458 Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON311 ref: 00007FFE1330C461
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C476
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C48B
_Py_Dealloc.PYTHON311 ref: 00007FFE1330C4A0

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dealloc$Object_Track
String ID:
API String ID: 887704541-0
Opcode ID: 3d42f6f96641afa8e40a9b95133215a649903610cae807ab0b9964238f53290f
Instruction ID: 868375dd7e3232b7a61920fca3ee9e89a7fb844db6649e34a65dcd920af290c9
Opcode Fuzzy Hash: 3d42f6f96641afa8e40a9b95133215a649903610cae807ab0b9964238f53290f
Instruction Fuzzy Hash: 4E01EC35E0AF02C8FE9A8F77989413C63A0FF64F35B1801B0C96E16671CE2DA4818348

Function 00007FFE13204864 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON311 ref: 00007FFE13204888
closesocket.WS2_32 ref: 00007FFE13204894
PyEval_RestoreThread.PYTHON311 ref: 00007FFE1320489F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE132048AE

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Eval_Thread$RestoreSave_errnoclosesocket
String ID:
API String ID: 1624953543-0
Opcode ID: 1179f49cef2614599ac27385311664bb38b10ace598ec30c3f873f2a9e03a6a8
Instruction ID: 977882a311b48df4cdab43bcd5f66d74c06635a86121abe0dd098ba35ab968b6
Opcode Fuzzy Hash: 1179f49cef2614599ac27385311664bb38b10ace598ec30c3f873f2a9e03a6a8
Instruction Fuzzy Hash: 71F0FF21A18F918AE6146B56B88407D77A0EB98BB1B144770DA7A237F4CF7CD449C640

Function 00007FFE1330C8D4 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Py_IsInitialized.PYTHON311 ref: 00007FFE1330C8F1
Py_Initialize.PYTHON311 ref: 00007FFE1330C8FB
PyGILState_Ensure.PYTHON311 ref: 00007FFE1330C901
PyGILState_Release.PYTHON311 ref: 00007FFE1330C91B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: State_$EnsureInitializeInitializedRelease
String ID:
API String ID: 2621580956-0
Opcode ID: 228736a826a5a1ff67be1b297f58c8bae0a48c2954096bea5476443be523e544
Instruction ID: 13026b6d2111fe9cfb5dac086220bcc430d23360fc0d2bccb92844b270536fc8
Opcode Fuzzy Hash: 228736a826a5a1ff67be1b297f58c8bae0a48c2954096bea5476443be523e544
Instruction Fuzzy Hash: 91F03021B08F81CAEB405B63B88402DA260AB68FE0F585075EA5D67726DE3CD4818B04

Function 00007FFE13207310 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLong.PYTHON311 ref: 00007FFE1320732C
if_indextoname.IPHLPAPI ref: 00007FFE1320733E
PyErr_SetFromErrno.PYTHON311 ref: 00007FFE13207353
PyUnicode_DecodeFSDefault.PYTHON311 ref: 00007FFE13207362

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: DecodeDefaultErr_ErrnoFromLongLong_Unicode_Unsignedif_indextoname
String ID:
API String ID: 1147600871-0
Opcode ID: 90c782a69252593657e351c54f1b06e3e0398504c2af1d4c3f456dd59c26aa3c
Instruction ID: 9286fb64499978a3d42c93117c7164924d35e0356cebbfa436444ac7cb2d0da0
Opcode Fuzzy Hash: 90c782a69252593657e351c54f1b06e3e0398504c2af1d4c3f456dd59c26aa3c
Instruction Fuzzy Hash: 76F01221B18E4289FA64B736E45437E27A0BFE8764F844571D95E926B4DE3CE10DC600

Function 00007FFE1A4549B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE1A454A86
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A454AE4

Strings

csm, xrefs: 00007FFE1A454B8A

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction ID: ddd726ff11c4f69a2b64972a1da2433f4786721e8ed4bd159520cc3cc2a0e7ae
Opcode Fuzzy Hash: 5e4671b1cbff3658d511699c3cf653202505efa909c7ec854f7fa1af4338784c
Instruction Fuzzy Hash: 20511CB6718B4186E660AB16E44027E77B4F788FA0F1405B6DB8D07B66DF3CE465CB40

Function 00007FFE1A459F44 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE1A45A042

Strings

void, xrefs: 00007FFE1A459FA4
void , xrefs: 00007FFE1A459FCC

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
Instruction ID: 875731d20529edb4b255745a62000598e67eb6746bd7be3a9cadca225dcbe56d
Opcode Fuzzy Hash: 7dcf970a61f58172c3a4f39e178d28c376ed2dbead67cac1058dce2bd18ce07b
Instruction Fuzzy Hash: 223146A2F18B5598FB01DFA1E8410FC37B0BB48B58B4405B6EA4EA3B69DF3C9164C750

Function 00007FFE132040D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13207AE8: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFE13207B2C

PyErr_SetString.PYTHON311(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE13203635), ref: 00007FFE132041AF

Strings

%X:%X:%X:%X:%X:%X%c, xrefs: 00007FFE132040FF
bad bluetooth address, xrefs: 00007FFE132041A5

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String__stdio_common_vsscanf
String ID: %X:%X:%X:%X:%X:%X%c$bad bluetooth address
API String ID: 3283897942-3956635471
Opcode ID: 2a7f0246533caa97d69931e1c2b3aab3f1e9f99ef436862b711c96c1fe23d8e7
Instruction ID: 3829c7717e1cf446e44c90a0d05b2361ca9fbce6cf19d0d51852f4103f8c4e8e
Opcode Fuzzy Hash: 2a7f0246533caa97d69931e1c2b3aab3f1e9f99ef436862b711c96c1fe23d8e7
Instruction Fuzzy Hash: 9421AC72718F9186DB10CB12E8880AD73A2F7947E0F418136EAAC57BA8DF3DD858C710

Function 00007FFE1A4562EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A456690: RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4566D4
Part of subcall function 00007FFE1A456690: RaiseException.KERNEL32 ref: 00007FFE1A45671A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A45635F

Strings

Access violation - no RTTI data!, xrefs: 00007FFE1A4562EF
Bad dynamic_cast!, xrefs: 00007FFE1A456312

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
Instruction ID: e172b658535d01e83bd57d5162ab50a7ca66e582ba5a7e9cdacb51fc8cdf2ccc
Opcode Fuzzy Hash: 7bbd72394c3e749fc10370465baa4d9a755cb91736d17097c685b3404c0deaff
Instruction Fuzzy Hash: F0015EA1B29E8691EE40AB16F450178A321FF40FA4F4850F3E65E07675EF6CE564C700

Function 00007FFE1330EDAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON311 ref: 00007FFE1330EE1B
PyErr_Format.PYTHON311 ref: 00007FFE1330EE3D

Strings

one character bytes, bytearray or integer expected, xrefs: 00007FFE1330EE33

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_FormatLongLong_
String ID: one character bytes, bytearray or integer expected
API String ID: 832222675-2748977362
Opcode ID: 4171aea13ba1fa0aee4d8e851ffe7b5e382af772fa60775af7b968a914772540
Instruction ID: 5bdc3f168d210f0190978de3135da1124fe8d56fe57de5593bfd29414e5d1a74
Opcode Fuzzy Hash: 4171aea13ba1fa0aee4d8e851ffe7b5e382af772fa60775af7b968a914772540
Instruction Fuzzy Hash: 29116032B08F86CDEB558F2AD48427C67A0EF65BA4F1850B1CA6D67375CE2CD494C318

Function 00007FFE13302DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,00007FFE13306C1D), ref: 00007FFE13307B85
_Py_Dealloc.PYTHON311 ref: 00007FFE13307B9E

Strings

abstract class, xrefs: 00007FFE13307B7B

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_String
String ID: abstract class
API String ID: 1259552197-1623945838
Opcode ID: 889cc83bd7e42d210c141f1a36b7b4f58b9fb1ebab554f935c723b1e3cc6fbc7
Instruction ID: 00190adee1b8d167be7e8c0d94366f719e6bf973401adca962d3e5ddb5a0aa0b
Opcode Fuzzy Hash: 889cc83bd7e42d210c141f1a36b7b4f58b9fb1ebab554f935c723b1e3cc6fbc7
Instruction Fuzzy Hash: 76115E22B08F068AEA559B27E45877D63A0EFADBB5F1451B4C92D663B1DF3CE444C308

Function 00007FFE1A456690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE1A4566D4
RaiseException.KERNEL32 ref: 00007FFE1A45671A

Strings

csm, xrefs: 00007FFE1A456707

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction ID: 7bc0cbed7bf8ecaba938c7922a3b33647ad9e37d51fd8fc8727a111cf8f43bc5
Opcode Fuzzy Hash: 51a2530866bc70b3fa6e7487cc130fe87b9602d28e5a22477376607ad08b6180
Instruction Fuzzy Hash: 52113D72608F8182EB108F16F440269B7A5FB88F94F1842B6DF8C07B68DF3DD5658700

Function 00007FFE1330A15C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330A185

Part of subcall function 00007FFE1330AA7C: PyErr_SetString.PYTHON311(?,?,?,?,00007FFE1330947D,?), ref: 00007FFE1330AABD

Strings

Pointer does not support item deletion, xrefs: 00007FFE1330A17B
NULL pointer access, xrefs: 00007FFE1330A1A3

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String
String ID: NULL pointer access$Pointer does not support item deletion
API String ID: 1450464846-1262937747
Opcode ID: cc63e7bd2d2a3bc22265ebdaaeb10ee6e24a6e51b4ebc2f3b89706aefd929760
Instruction ID: 0982293c90c9d122a81ffc6548d29fca6db1da8d64c50279ba6d1c82be943abb
Opcode Fuzzy Hash: cc63e7bd2d2a3bc22265ebdaaeb10ee6e24a6e51b4ebc2f3b89706aefd929760
Instruction Fuzzy Hash: 1E01AD61B08F4685EA48CB47F8804BD7324BBAABE4B104272DD6D677B6CF3CD5418348

Function 00007FFE132048D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE13203588: PyErr_Format.PYTHON311 ref: 00007FFE132037DF

PySys_Audit.PYTHON311 ref: 00007FFE1320492C

Part of subcall function 00007FFE13203A8C: PyEval_SaveThread.PYTHON311 ref: 00007FFE13203AAA
Part of subcall function 00007FFE13203A8C: connect.WS2_32 ref: 00007FFE13203ABD
Part of subcall function 00007FFE13203A8C: PyEval_RestoreThread.PYTHON311 ref: 00007FFE13203AC8
Part of subcall function 00007FFE13203A8C: WSAGetLastError.WS2_32 ref: 00007FFE13203AD6
Part of subcall function 00007FFE13203A8C: WSAGetLastError.WS2_32 ref: 00007FFE13203AE2
Part of subcall function 00007FFE13203A8C: PyErr_CheckSignals.PYTHON311 ref: 00007FFE13203AEF
Part of subcall function 00007FFE13203A8C: WSASetLastError.WS2_32 ref: 00007FFE13203B2C

Strings

socket.connect, xrefs: 00007FFE13204925
connect, xrefs: 00007FFE132048F3

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLast$Err_Eval_Thread$AuditCheckFormatRestoreSaveSignalsSys_connect
String ID: connect$socket.connect
API String ID: 2206401578-326844852
Opcode ID: bb7157e97fb890ddb199d144b1d46a56a8d34667c59f5b315390c2e9786cec5b
Instruction ID: 285cd923aa889735be36bb2086a59c08498174d4bdf6f4dd450be2249f9479a3
Opcode Fuzzy Hash: bb7157e97fb890ddb199d144b1d46a56a8d34667c59f5b315390c2e9786cec5b
Instruction Fuzzy Hash: 37113321708F4685EA20AB52F4507AA6360FBD4BE0F444172DE9D67769DE2DD148CB40

Function 00007FFE1330E98C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1330EA24: PyType_IsSubtype.PYTHON311(?,?,?,?,00007FFE1330E889), ref: 00007FFE1330EA31

PyErr_SetString.PYTHON311 ref: 00007FFE1330E9C8

Part of subcall function 00007FFE1330AA7C: PyErr_SetString.PYTHON311(?,?,?,?,00007FFE1330947D,?), ref: 00007FFE1330AABD

Strings

can't delete attribute, xrefs: 00007FFE1330E9E0
not a ctype instance, xrefs: 00007FFE1330E9B7

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String$SubtypeType_
String ID: can't delete attribute$not a ctype instance
API String ID: 3320257282-2740123057
Opcode ID: 18fbc3005ffdff5a035a76096331e82b7bdea77d6c35e831de142f80868fa9ec
Instruction ID: 098673337a91c68d1f76fc4d3a60f7cbf80dc43a61fa3789ccc72ae4adb34567
Opcode Fuzzy Hash: 18fbc3005ffdff5a035a76096331e82b7bdea77d6c35e831de142f80868fa9ec
Instruction Fuzzy Hash: F0113961B08F41C5EB50CF17E94006D63A0FB68BF4B104272EEAD63BA9DF2CD5518708

Function 00007FFE13309638 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PySequence_SetItem.PYTHON311 ref: 00007FFE13309677
PyErr_SetString.PYTHON311 ref: 00007FFE133096A3

Strings

args not a tuple?, xrefs: 00007FFE13309699

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_ItemSequence_String
String ID: args not a tuple?
API String ID: 138718260-274370407
Opcode ID: f981f7e703dfeb18ac4443360c7dfc39ae4566ed3aa42caf66e0419349738e14
Instruction ID: 1e5d6ac4923d52b6b25c76f45f34765b8eb40bbfcaf6493bbde6c5f06d446db1
Opcode Fuzzy Hash: f981f7e703dfeb18ac4443360c7dfc39ae4566ed3aa42caf66e0419349738e14
Instruction Fuzzy Hash: DE018C61B08F42C9E6408B16E44006DA360FB54FB0F589671EABD677B5CF28D491C704

Function 00007FFE13309414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE13309490

Strings

invalid index, xrefs: 00007FFE13309486
Array does not support item deletion, xrefs: 00007FFE1330942A

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String
String ID: Array does not support item deletion$invalid index
API String ID: 1450464846-799983634
Opcode ID: 67e0225e1662b2c6de7c64aa0e1a7725335fd733c618b52c26417df970fd658a
Instruction ID: 55fbb53215aa8878f92f8483c6c6ffc38d83be3fa6695e10f8b54b1097b7562c
Opcode Fuzzy Hash: 67e0225e1662b2c6de7c64aa0e1a7725335fd733c618b52c26417df970fd658a
Instruction Fuzzy Hash: 70015AB1E08F46C9EA00DB47E85087D2364FBA4BE0B4152B2D96E673B1DF2CE1948308

Function 00007FFE13304680 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311(?,?,?,00007FFE13301959), ref: 00007FFE13308EE9

Part of subcall function 00007FFE13303DC0: _PyObject_New.PYTHON311(?,?,?,?,00007FFE133046A2,?,?,?,00007FFE13301959), ref: 00007FFE13303DCB

_Py_Dealloc.PYTHON311(?,?,?,00007FFE13301959), ref: 00007FFE13308EF4

Strings

expected CData instance, xrefs: 00007FFE13308EDF

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: DeallocErr_Object_String
String ID: expected CData instance
API String ID: 3982460303-1581534645
Opcode ID: cb84d01ecd15a1eda4d8d1b175decd3e5ebb0d94a1c0848139c17e093e1ac344
Instruction ID: ed6a2c41dd6652ffd2ff4ba294b98cea131a0745f0a20e874986b915086f4317
Opcode Fuzzy Hash: cb84d01ecd15a1eda4d8d1b175decd3e5ebb0d94a1c0848139c17e093e1ac344
Instruction Fuzzy Hash: F2014B61B08F07C8EA148B27D84003D63A0AF68BB4F1404B1C93E6A772DF3DE155C319

Function 00007FFE1330B4F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GenericSetAttr.PYTHON311 ref: 00007FFE1330B510
_PyUnicode_EqualToASCIIString.PYTHON311 ref: 00007FFE1330B539

Strings

_fields_, xrefs: 00007FFE1330B52F

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AttrEqualGenericObject_StringUnicode_
String ID: _fields_
API String ID: 947992268-3196300388
Opcode ID: c6dedb99678c499afd6badd1b017026620a4ab54dad84f9f25f416736ac5017a
Instruction ID: 72c1cc51bf2717eca87ea831c3a9efbfc50c5f61b96e2ef3037bf9dfeaff5c51
Opcode Fuzzy Hash: c6dedb99678c499afd6badd1b017026620a4ab54dad84f9f25f416736ac5017a
Instruction Fuzzy Hash: 9CF04421B1CB4289E7548F67A44026E5260AF65BE0F5895B0E92E526A5DE2CD4918708

Function 00007FFE1330B2A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1330B2D3
_PyDict_SetItemId.PYTHON311 ref: 00007FFE1330B300

Strings

abstract class, xrefs: 00007FFE1330B2C9

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Dict_Err_ItemString
String ID: abstract class
API String ID: 960913676-1623945838
Opcode ID: 152bc656983328e65481e0599e2526a4dd7c8e873d35052210cfab64f93eb631
Instruction ID: cf6b3fee704b71a7289d7edeee20ac8ddec0a975cdee6a636f292fd426ac2689
Opcode Fuzzy Hash: 152bc656983328e65481e0599e2526a4dd7c8e873d35052210cfab64f93eb631
Instruction Fuzzy Hash: 6EF06850B18E07C8FA589F67F88407C5360AF69BF0F145271D93E667B6DE2CD4958308

Function 00007FFE13253858 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_PyArg_NoPositional.PYTHON311 ref: 00007FFE1325387C
_PyArg_NoKeywords.PYTHON311 ref: 00007FFE13253895

Strings

BZ2Decompressor, xrefs: 00007FFE13253875, 00007FFE1325388E

Memory Dump Source

Source File: 00000001.00000002.2983986729.00007FFE13251000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFE13250000, based on PE: true

Associated: 00000001.00000002.2983967997.00007FFE13250000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984007302.00007FFE1325D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984025780.00007FFE13261000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2984043492.00007FFE13262000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13250000_uOsIQqfgiT.jbxd

Similarity

API ID: Arg_$KeywordsPositional
String ID: BZ2Decompressor
API String ID: 1300771297-1337346095
Opcode ID: 358a44a62b11731d470d0bbb96af668936168ddb6404ce11f0731b6ca31f1a24
Instruction ID: 1d80f8048721ab67d4abed883b5d3f7997fd3137da0192ca6071e6f0d6ae31b3
Opcode Fuzzy Hash: 358a44a62b11731d470d0bbb96af668936168ddb6404ce11f0731b6ca31f1a24
Instruction Fuzzy Hash: 0AF062A0F08E4245FA58AB27B5482B56261AFA4BF0F5453B0EA2D97AB5FF1CD641C700

Function 00007FFE1330C398 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE1330C3BC
PyUnicode_FromWideChar.PYTHON311 ref: 00007FFE1330C3E4

Strings

ctypes.wstring_at, xrefs: 00007FFE1330C3B5

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditCharFromSys_Unicode_Wide
String ID: ctypes.wstring_at
API String ID: 614261396-2169766756
Opcode ID: c82b687e7251797f6e5b90717e26ccc800462a1ff5413f444b11774fb9a74885
Instruction ID: b1c1a081cf80604021e7cd1b249d49000866044780aa015e4dd1a9cb2671bedf
Opcode Fuzzy Hash: c82b687e7251797f6e5b90717e26ccc800462a1ff5413f444b11774fb9a74885
Instruction Fuzzy Hash: CAF08951B18E42D9EE544B73F9900BD5250AF28BF4F4453B1D93EDA1F1DD6CD5548308

Function 00007FFE1330C33C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PySys_Audit.PYTHON311 ref: 00007FFE1330C360
PyBytes_FromStringAndSize.PYTHON311 ref: 00007FFE1330C387

Strings

ctypes.string_at, xrefs: 00007FFE1330C359

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: AuditBytes_FromSizeStringSys_
String ID: ctypes.string_at
API String ID: 1783689829-1910480597
Opcode ID: ad0ccf7f71804dd0e038b4a23bae58c0fa799e11b1e17efbe4fa3c6d44ce38ba
Instruction ID: 4c17467b8ddb0be2434de266ac3f933a2c7be5b402336b6eff615164287f4e15
Opcode Fuzzy Hash: ad0ccf7f71804dd0e038b4a23bae58c0fa799e11b1e17efbe4fa3c6d44ce38ba
Instruction Fuzzy Hash: 3DF03091B18F4389EF604B37A98017D6651AF64BF4F1493B1D93E965F5DE1C90849208

Function 00007FFE13203864 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON311 ref: 00007FFE1320389A

Strings

getsockaddrlen: bad family, xrefs: 00007FFE1320387A
getsockaddrlen: unknown BT protocol, xrefs: 00007FFE13203889

Memory Dump Source

Source File: 00000001.00000002.2983774222.00007FFE13201000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FFE13200000, based on PE: true

Associated: 00000001.00000002.2983755967.00007FFE13200000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983792906.00007FFE13208000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983812090.00007FFE13210000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000001.00000002.2983830090.00007FFE13212000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13200000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_String
String ID: getsockaddrlen: bad family$getsockaddrlen: unknown BT protocol
API String ID: 1450464846-3381576205
Opcode ID: cbb85a40afec8d8469eadcacea966656172139c73b3414318d60d7fc7aec7ced
Instruction ID: 0f3d502339f0bcf230f4bc3d8d3068864c654bdfd6a00a16aedc3941d2211f77
Opcode Fuzzy Hash: cbb85a40afec8d8469eadcacea966656172139c73b3414318d60d7fc7aec7ced
Instruction Fuzzy Hash: 41F0FFB1908D02C9F7246F0AE88427E22A1ABE4760FA044F1C60DA62B0CFBCE48DD741

Function 00007FFE13302470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON311 ref: 00007FFE1330248E

Strings

this type has no size, xrefs: 00007FFE13307308

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: FromLong_Ssize_t
String ID: this type has no size
API String ID: 168540982-982649334
Opcode ID: 6f14cdcc885872a6a1df23694bcedff85d145f2805944da9bd946685c2c050ae
Instruction ID: 16c317b2751862e0d6d57e8eac9b714ae5fbc169d0e0f6883e019296ed7a163f
Opcode Fuzzy Hash: 6f14cdcc885872a6a1df23694bcedff85d145f2805944da9bd946685c2c050ae
Instruction Fuzzy Hash: 2EF0C050B18D03C9FE599B63D95503D6364AFA8FB4F1414B1DD2EA6272DE2CE484835C

Function 00007FFE1A45EE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE1A45F050: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1A45F110
Part of subcall function 00007FFE1A45F050: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1A45EE15), ref: 00007FFE1A45F15F

Part of subcall function 00007FFE1A4569C0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE1A4525CE), ref: 00007FFE1A4569CE

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1A45EE3A

Strings

csm, xrefs: 00007FFE1A45EE1B
f, xrefs: 00007FFE1A45EE15

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: CurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 4189928240-629598281
Opcode ID: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
Instruction ID: 439b4ab186a30d8487f58195f1504811de730e969a15e9b3a06dd8e9fb9fa11c
Opcode Fuzzy Hash: 41dc89b1ce5f079b65ce2aaee024a8a434243f0f20765bf48ba2e403aae6c5bc
Instruction Fuzzy Hash: 99E065F1E18B4281EB607B63B58517D67A4AF05F74F1C80F6DA8807666CF3DD8B08641

Function 00007FFE1330DDFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_PyUnicode_IsPrintable.PYTHON311(?,?,?,00007FFE1330D3BD), ref: 00007FFE1330DE12

Strings

\, xrefs: 00007FFE1330DE1C
', xrefs: 00007FFE1330DE21

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: PrintableUnicode_
String ID: '$\
API String ID: 1291510985-1366717710
Opcode ID: 8f056e593a683e8d15de34f78a6f47cb157d5505191b12e7d535d23602ebe9e6
Instruction ID: aaf9ceb52ef53e7658d27218692c79a66aa6bddb75665610f2313d72dffe1ff3
Opcode Fuzzy Hash: 8f056e593a683e8d15de34f78a6f47cb157d5505191b12e7d535d23602ebe9e6
Instruction Fuzzy Hash: 16E04F31F18E058AFB641727A88827D13D25BA5370E4D1171DA6D152F9CD2CD8819708

Function 00007FFE1330E940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

PyUnicode_FromFormat.PYTHON311 ref: 00007FFE1330E96E

Strings

<Field type=%s, ofs=%zd, size=%zd>, xrefs: 00007FFE1330E979
<Field type=%s, ofs=%zd:%zd, bits=%zd>, xrefs: 00007FFE1330E962

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: FormatFromUnicode_
String ID: <Field type=%s, ofs=%zd, size=%zd>$<Field type=%s, ofs=%zd:%zd, bits=%zd>
API String ID: 3889672380-2914491812
Opcode ID: 08e4dafb61acecda0dd77ce9d4e7f7947246ca23280beaed436fd91f997484e9
Instruction ID: 54860d05508b55a4d794971cbaaa3334239b08cb3908d86df124ffd2279b4478
Opcode Fuzzy Hash: 08e4dafb61acecda0dd77ce9d4e7f7947246ca23280beaed436fd91f997484e9
Instruction Fuzzy Hash: 99E01A76B04E45C5DB548B0ED8404697720FB65F68BA101A6CEAC23375CF3CD5ABD748

Function 00007FFE13303DF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON311 ref: 00007FFE13308A90
PyErr_SetString.PYTHON311 ref: 00007FFE13308AAC

Strings

PyObject is NULL, xrefs: 00007FFE13308AA2

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Err_$OccurredString
String ID: PyObject is NULL
API String ID: 114435612-3221357749
Opcode ID: 2e5002b93a88984c719b4076089918ef8885b05004490f6185a51e22d0327163
Instruction ID: b6175d3ba9257dfda5e03c78a1974b71d8285d3f3e8487ddea6c174be1275722
Opcode Fuzzy Hash: 2e5002b93a88984c719b4076089918ef8885b05004490f6185a51e22d0327163
Instruction Fuzzy Hash: 2CE0BF21B09E03D8EE455B17D84013867A0AF68B75F5455B5C52E6A371DE2CE0859704

Function 00007FFE1330F3B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON311 ref: 00007FFE1330F3BF
PyMem_Free.PYTHON311 ref: 00007FFE1330F3CD

Strings

_ctypes/cfield.c pymem, xrefs: 00007FFE1330F3B8

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes/cfield.c pymem
API String ID: 1268649101-2578739719
Opcode ID: 13f5c1952ace5f4f8c9f181e4b2ebf5f0c2b934a391285e14cb501e27f568ab5
Instruction ID: 341ea4783d907054730c83bcae0b95236d1d242313524834173ea2fc307eb3e2
Opcode Fuzzy Hash: 13f5c1952ace5f4f8c9f181e4b2ebf5f0c2b934a391285e14cb501e27f568ab5
Instruction Fuzzy Hash: CDC01210F0EE02CAED49AB63A88413813606F28B34F8804B4C02D25236EE6CA49A8308

Function 00007FFE1330DEB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

PyCapsule_GetPointer.PYTHON311 ref: 00007FFE1330DEC3
PyMem_Free.PYTHON311 ref: 00007FFE1330DED1

Strings

_ctypes pymem, xrefs: 00007FFE1330DEBC

Memory Dump Source

Source File: 00000001.00000002.2984157337.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true

Associated: 00000001.00000002.2984137935.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984177976.00007FFE13310000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984197194.00007FFE13317000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2984217707.00007FFE1331B000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe13300000_uOsIQqfgiT.jbxd

Similarity

API ID: Capsule_FreeMem_Pointer
String ID: _ctypes pymem
API String ID: 1268649101-201515578
Opcode ID: 62ef90d10503a54e82f353289ff9a1ab72bad7d0f7bb64e3368930f79f513158
Instruction ID: de52e28e0ed93d449f7ddcd4e5c9c278e7a2688f32474b9dc8ebb0cdf2821f4e
Opcode Fuzzy Hash: 62ef90d10503a54e82f353289ff9a1ab72bad7d0f7bb64e3368930f79f513158
Instruction Fuzzy Hash: 0CC08050F0AF43C6ED486B13EC4403413607F34B15F8404B4C52D25335DE2C6055C308

Function 00007FFE1A4569DC Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE1A456859,?,?,?,?,00007FFE1A45FF42,?,?,?,?,?), ref: 00007FFE1A4569FB
SetLastError.KERNEL32(?,?,?,00007FFE1A456859,?,?,?,?,00007FFE1A45FF42,?,?,?,?,?), ref: 00007FFE1A456A84

Memory Dump Source

Source File: 00000001.00000002.2984256147.00007FFE1A451000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE1A450000, based on PE: true

Associated: 00000001.00000002.2984237068.00007FFE1A450000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984279636.00007FFE1A461000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984300789.00007FFE1A466000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2984319263.00007FFE1A467000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe1a450000_uOsIQqfgiT.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction ID: c537d69b825f7dc53fcf8138677aa6a089e144648b5cfd350e592b649c7ac000
Opcode Fuzzy Hash: bbe9895d534b658101cce7e74ca5bd95b80ee12bf15f37732e53d0ee5c009e2b
Instruction Fuzzy Hash: 46112160F0DA4242FA14AB27B844134B2A16F49FF4F1C86F6D96E077F5DF2CE8619640

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uOsIQqfgiT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\341vtfaf.exe

C:\Users\user\AppData\Local\Temp\_MEI34682\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI34682\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI34682\libcrypto-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI34682\libffi-8.dll

C:\Users\user\AppData\Local\Temp\_MEI34682\python311.dll

C:\Users\user\AppData\Local\Temp\_MEI34682\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI34682\unicodedata.pyd

Static File Info

General

File Icon

Windows Analysis Report
uOsIQqfgiT.exe